Carb load: vibes.
Carb load: vibes.
Last updated: 29th Sep 2026
Welcome to Next Lap — the place where athletes, almost-athletes, and thinking-about-starting-again humans come to track races and dreams.
1.
Next Lap helps you:
This policy explains what personal data we collect, why we use it, and who we share it with. We design our practices with India’s Digital Personal Data Protection Act, 2023 and the IT Act SPDI Rules, 2011 in mind.
TL;DR - We help you find events, register, train, and reflect — and we tell you how we handle your data.
2.
We collect only what we need to run Next Lap:
We only ask for health information when it is needed for event safety or eligibility. You will see a short notice under those registration questions.
TL;DR - Account, profile, registration, optional health fields for safety, payments via partners, and basic analytics.
3.
We use your data to:
We do not use health / medical registration answers for marketing or ads.
TL;DR - We use your info to run the product and your events — not to sell ads from your health data.
4.
Here is every person and company that can see your personal data, and exactly what reaches them. Nobody outside this list gets it.
| Who | What they can access | TL;DR |
|---|---|---|
| Event organisers (and their race / medical / safety team) | Your registration answers for the events you join: name, email, phone, date of birth, gender, emergency contact, and health answers where that event asks for them. They can view these in their dashboard and download them as a spreadsheet. | Everything you filled in for their race. |
| Supabase — database and file storage | All of it: your account, profile, race calendar, registrations, uploaded documents, messages and consent records. | The filing cabinet everything sits in. |
| Vercel — hosting (United States) | Every request your browser makes to Next Lap, and anything our server code handles while answering it. | The building the app runs in. |
| Razorpay — payments (India) | The amount, the contact details you type on their checkout, and reference IDs linking the payment to your registration. | Your payment, nothing else. |
| Cashfree — payments (India) | Your name, phone, email and the order details for that payment. | Your payment, nothing else. |
| MSG91 — SMS (India) | Your mobile number and the one-time code we send it, including a guardian's number for parental consent. | Your number, so the code arrives. |
| Twilio — SMS and WhatsApp (United States) | Your phone number, your display name, and the content of WhatsApp messages you exchange with us. | Your number and our chat. |
| Resend — email (United States) | Your email address and name, the event details inside each email, and attachments such as tickets and invoices. | Your email and what is in it. |
| Google Gemini — reads uploaded documents (United States) | The full photo ID, medical fitness certificate or qualification proof you upload, so we can read the name and date of birth off it and check it matches your registration. | Your uploaded document, to check it matches. |
| OpenAI, reached through OpenRouter — training plans (United States) | The training details you enter for a plan: name, age, gender, height, weight, fitness level, injury history, goals and race dates. | Your training details, to write the plan. |
| Strava — only if you connect it (United States) | Your Strava name, city, sex and photo, and your activities including heart rate and route maps. | Only if you press Connect Strava. |
| Google Analytics, via Tag Manager (United States) | Pages you visit, searches and filters you use, and registration steps you complete, with your user ID. | Only if you allow analytics cookies. |
| PostHog — product analytics (United States) | The same page and action history, your email, name and phone attached to it, and recordings of your session if you allow those. | Only if you allow analytics cookies. |
| Hotjar — session replay (European Union) | A recording of what you do on screen during a visit. | Only if you allow session recordings. |
| Microsoft Clarity — session replay (United States) | A recording of what you do on screen, and your user ID. | Only if you allow session recordings. |
| Vercel Analytics — traffic counting (United States) | Page views and loading-speed measurements. No profile attached. | Counts visits, does not know you. |
| Sentry — crash reports (United States) | The technical details of an error, which can include the request that failed and the account it happened on. | Only when something breaks. |
| Google Maps Places (United States) | The place name you type into a location search box. | Only what you type into search. |
| Upstash — abuse protection (United States) | Your IP address or user ID, used as a counter to stop spam and abuse. | A counter so nobody floods us. |
| Web3Forms — report form (United States) | Your email address and your message, if you report an image to us. | Only if you send us a report. |
Several of these companies are outside India, so your data is processed abroad by them. We only use them where we need to, and only for the purpose listed above.
We do not sell your personal data. Ever. Organisers must use registration data to run their event — not for unrelated marketing unless they get their own lawful permission from you.
TL;DR - Organisers see your event answers, vendors see only the slice they need, some sit abroad. No selling.
5.
When an event collects health or medical details, we use them only for event safety, eligibility, and emergency response for that registration.
If you have questions about how a specific organiser handles your health data on race day, you can also contact that organiser.
TL;DR - Health data is for race safety — shared with the organiser/med team for that event, not for ads.
6.
We use cookies and similar tech for:
You can manage analytics preferences in Privacy Settings and limit cookies in your browser.
We do not use cookies to sell your data or track you across the open web for advertising networks we control.
TL;DR - Cookies make Next Lap work; analytics ones are optional.
7.
TL;DR - Your stuff = yours. We just show it where the product needs to.
8.
We take reasonable steps to protect your data using industry-standard practices, including access controls and private storage for registration uploads.
No system is 100% perfect, so we cannot guarantee absolute security.
TL;DR - We lock the doors; digital life is still never risk-free.
9.
If you are under 18, use Next Lap with a parent or legal guardian.
Event registration for minors must be done by a parent or legal guardian who accepts the terms on their behalf.
We do not knowingly collect data from minors without appropriate consent.
TL;DR - Under 18? A parent or guardian must help.
10.
How long we keep data depends on what it is:
If you delete your account or ask us to erase information, we remove what we can from our systems. Some records may need to stay longer where the law or an active event obligation requires it — we will explain if that applies.
TL;DR - We keep data while the account or event needs it; you can ask us to erase.
11.
You can:
Email our Grievance Officer, Udayan Anand, at udayan.anand@nextlap.in and we will help as quickly as we can.
TL;DR - You're the boss of your data.
12.
We may update this Privacy Policy when our product or the law changes.
When we make material updates, we may ask you to accept the new version before continuing.
TL;DR - We update when needed and tell you when it matters.
13.
If you have a privacy complaint, or want to use any of the rights above, write to our Grievance Officer. This is the named person responsible for answering privacy questions under India's DPDP Act, 2023.
If you are not happy with how we handle it, you can escalate to the Data Protection Board of India.
TL;DR - Write to Udayan Anand at udayan.anand@nextlap.in. Reply within 7 days.
14.
Questions about privacy?
admin@nextlap.in — we read every email.
TL;DR - Talk to us. We're humans.