Privacy Policy

Last updated September 16, 2026

1. Who We Are

MyHorseBase ("MyHorseBase", "we", "us") provides horse, stable and breeding management software at https://myhorsebase.com. This Privacy Policy explains what personal data we collect, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have over it.

For any privacy question, or to exercise any of the rights described below, contact us at info@myhorsebase.com. We act as the data controller for account and service data, and as a processor for the stable records our customers enter about their own horses, staff and clients.

2. Information We Collect

We collect the following categories of information:

• Account information: Your name, email address, and (for email sign-up) a password, which is stored only as a salted hash by our authentication provider — we never see or store your plaintext password.
• Google Sign-In information: If you choose "Continue with Google", we receive your Google account's email address, basic profile information (name and profile picture URL) and your Google account identifier. See section 5.
• Profile and workspace information: Display name, optional profile photo, preferred language, stable/workspace name, currency, role within a workspace, and invitations you send or accept.
• Stable records you enter: Horse records (name, identification and passport/microchip details, breed, age, sex, colour, markings, pedigree and sire/dam entries), health and veterinary records, medication, farrier and deworming entries, breeding, covering, pregnancy and foaling records, feed plans, tasks, shift handovers, calendar events, lessons and participants, stalls and stable map areas, tack and inventory, travel/transport documents, documents and notes, sale listings and owner updates.
• People information you enter: Names and contact details of team members, grooms, boarders, horse owners, lesson students and similar contacts you choose to add to your workspace. You are responsible for having a lawful basis to enter other people's details.
• Financial records you enter: Invoices, boarding contracts and fees, expenses and payment status. These are records you create; we do not process card payments (see section 6).
• Uploaded files: Horse photos, profile images and documents you upload.
• Support and communications: Support tickets, contact-form messages, feedback and the emails you exchange with us.
• Technical information: Authentication session tokens, the language and cookie-consent choices stored in your browser, and standard server and security logs kept by our hosting and authentication provider (including IP address, timestamp and browser/user-agent information) for security and abuse prevention.
• Activity records inside your workspace: An activity log records which member performed which action on which record and when, so stables can see their own audit history.

We do not run third-party advertising, marketing or behavioural tracking scripts on the site, and we do not operate a third-party analytics tool on the public website or in the application.

3. How We Use Your Information

We process each category of information for specific purposes:

• Creating and maintaining your account — name, email address and Google Sign-In information are used to create your account, identify you and let you sign back in.
• Authentication and security — session tokens, sign-in events and server logs are used to keep you signed in, protect accounts against unauthorised access and abuse, and investigate security incidents.
• Providing the service — the horse, health, breeding, feed, task, lesson, inventory and financial records you enter are stored and displayed back to you and to the members of your workspace so the product works.
• Collaboration — workspace, member, role and invitation data is used so that the people you invite can access the shared stable records you grant them.
• Notifications and service emails — your email address and language preference are used to send account emails (sign-up confirmation, password reset, invitations), the reminders and digests you have configured, and important service notices.
• Support — support tickets and messages are used to answer you and fix problems.
• Subscriptions and plan limits — plan, trial and subscription status are stored to determine which features and limits apply to your workspace.
• Legal and accounting obligations — limited records may be processed where we are legally required to keep them.

Where you are in the EEA or UK, our legal bases are: performance of a contract (providing the service you signed up for), our legitimate interests (security, abuse prevention, improving and supporting the service), consent (optional communications and any non-essential cookies), and compliance with legal obligations.

4. Data Storage & Security

Your data is stored on secure cloud infrastructure. Connections to the site use HTTPS/TLS, data is encrypted in transit and at rest by our hosting provider, passwords are stored only as salted hashes, and database access is restricted by per-row security policies so that records are reachable only by the account or workspace they belong to. Uploaded documents are served through time-limited signed links, administrative access is limited to a small number of authorised people, and workspace activity is logged.

No online service can be guaranteed to be completely secure. We work to protect your information using the measures above, but we cannot promise absolute security. If a breach affects your personal data and the law requires it, we will notify you and the relevant supervisory authority.

5. Google Sign-In and Google User Data

MyHorseBase offers "Continue with Google" as an optional way to create an account and sign in. Using it is entirely voluntary — you can instead sign up with an email address and password.

• What we receive: Only the basic sign-in scopes — openid, email and profile. In practice this means your email address, whether it is verified, your name, your profile picture URL and your Google account identifier.
• Why we receive it: Solely to verify your identity, create or match your MyHorseBase account, and sign you in.
• How we use it: Your email address identifies your account and receives service emails; your name and profile picture pre-fill your MyHorseBase profile and show you to the members of your own workspace; the Google account identifier links your Google login to your existing account so repeat sign-ins work.
• Whether it is stored: Yes — your email address, name, profile picture URL and account identifier are stored in your MyHorseBase account record for as long as your account exists, so the account keeps working between sessions.
• What we do NOT access: We request no other Google scopes and have no access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos or any other Google service or the data in them.
• Advertising: We do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties for advertising, credit-scoring, or independent purposes. It is used only to provide the sign-in and account functionality described above.
• Human access: Google user data is not read by our staff except where you explicitly ask us to help with a support issue, where it is necessary for security or to comply with the law, or in aggregated/anonymised form.
• Sharing: Google account information is shared only with the infrastructure providers listed in section 6 that host our authentication and database, acting on our instructions to run the service.
• Deletion: You can ask us to delete your account and the Google account information attached to it at any time by emailing info@myhorsebase.com — see section 8. You can also revoke MyHorseBase's access at any time from your Google Account permissions page at https://myaccount.google.com/permissions.

MyHorseBase's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Service Providers and Third Parties

We use a small number of processors to run MyHorseBase. They process data only on our instructions and only for the purposes below:

• Lovable Cloud / Supabase — hosting of the application, authentication (including the Google Sign-In exchange), the database and file storage. All account and stable data described in section 2 is stored here.
• Lovable managed email delivery — sending account and service emails (sign-up confirmation, password reset, invitations, reminders, digests, support replies). It receives the recipient email address, the message content and delivery status information such as bounces and complaints.
• Google LLC — only where you choose Google Sign-In, for authenticating you (see section 5).
• Paddle — our payments and subscription provider for paid plans. Paid checkout is currently not enabled for the public; when it is, Paddle acts as merchant of record and processes your billing details directly. MyHorseBase never receives or stores card numbers.

We may also disclose information where we are legally required to (for example a valid legal request or court order), where necessary to protect the rights, safety or security of users or the service, or in connection with a business transfer, in which case we will notify affected users. We do not sell your personal data and we do not share it with third parties for their own marketing.

7. Cookies and Local Storage

MyHorseBase uses strictly necessary cookies and browser local storage for authentication and session management — keeping you signed in, protecting the sign-in flow, and remembering your language and cookie-consent choice. These are required for the service to function.

We do not currently run advertising or behavioural tracking cookies. If we add optional analytics in future, it will only run where you have accepted it in the consent panel, and this policy will be updated first. The Paddle checkout script, which loads only for paid checkout, may set cookies necessary for the payment process. See our Cookie Policy for more details.

8. Data Retention and Account Deletion

We retain your data for as long as your account is active, because the service exists to keep your stable's historical records available to you. Records you delete inside the app (a horse, an invoice, a document) are removed from the live service when you delete them. The Reset Workspace tool in the app lets you permanently delete your workspace's records and start again.

MyHorseBase does not currently offer a one-click self-service account deletion button. To have your account and its associated personal data deleted, email info@myhorsebase.com from the address on the account. We will verify the request and delete the account and its data within 30 days, except where we must keep limited information for legal, accounting, tax, fraud-prevention or security reasons, or where records also belong to another workspace that you were only a member of. Backups are overwritten on a rolling basis and any residual copies are deleted as those backups expire.

9. International Data Transfers

Our infrastructure and email providers may store or process data in, or transfer it to, countries outside the European Economic Area, including the United States. Where that happens we rely on appropriate safeguards recognised under EU data protection law, such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask us for more detail at info@myhorsebase.com.

10. Your Rights

Depending on where you live, and in particular if you are in the EEA or UK, you have the right to:

• Access the personal information we hold about you and request a copy.
• Correct information that is inaccurate or incomplete — most of it you can edit directly in the app.
• Delete your personal information (see section 8).
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Receive your data in a portable format — the app also provides export functions for your records.
• Withdraw consent at any time where processing is based on consent, without affecting processing already carried out.
• Opt out of non-essential communications using the unsubscribe link in our emails or your notification settings.

To exercise any of these rights, email info@myhorsebase.com. We respond within one month. If you are in the EEA or UK and believe we have not handled your data properly, you also have the right to complain to your local data protection supervisory authority.

11. Children

MyHorseBase is a business tool for horse owners, yards and stables and is not directed at children. In line with our Terms of Service, you must be at least 18 years old to create an account. We do not knowingly collect personal information from children. If you believe a child has created an account, contact info@myhorsebase.com and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy as the service develops. The "last updated" date at the top of this page always reflects the current version, and we will notify account holders by email of material changes before they take effect.

13. Contact

For privacy-related questions, requests or complaints, contact MyHorseBase at info@myhorsebase.com. We aim to reply within a few working days and, for formal data protection requests, within one month.