Privacy Policy

1. Data controller

HoofTrail is owned and operated by Lucas IT Services, Ireland, which acts as the data controller for personal data collected through this site, in accordance with the EU General Data Protection Regulation (GDPR).

2. What we collect

Account data: your email address, name, username, and profile details you choose to add (bio, location).
Content: photos, videos, captions, comments, and horse profile details you post.
Usage & technical data: login sessions, IP address, browser/device type, and, for horse profiles, view counts (visible only to the horse's owner).
Communications: messages you send us through the contact form, and any information you provide in them.

3. How we use it

To provide the core service — logging you in via emailed one-time codes, showing your profile and posts to others per your visibility settings, enabling features like following horses and ownership transfers, and showing recommended horse profiles based on general popularity signals (this doesn't involve any automated decision-making that produces legal or similarly significant effects on you). If you submit a contact or investor enquiry, we use those details only to respond to you. We don't sell your data or use it for third-party advertising.

4. Legal basis for processing

We process your data on the basis of: performance of a contract (providing the service you sign up for), and legitimate interest (keeping the platform functional and secure, and responding to enquiries you send us).

5. Who we share data with

We use a small number of service providers (sub-processors) to run HoofTrail, each only processing data as needed to provide their service to us:

• DigitalOcean — application hosting and infrastructure.
• Aiven — managed PostgreSQL database (account and post data).
• Cloudflare — content delivery network and DNS; R2 object storage and Stream for photos and video; Email Service for sending login codes and other transactional email.
• Google Analytics — aggregate, anonymised website usage statistics (which pages are visited, how often, from which country), so we can understand and improve the service. This only runs if you accept non-essential cookies in the cookie banner — see Section 8.

We don't share your personal data with advertisers or data brokers, and we don't sell it.

6. Where your data is stored and international transfers

Account and post data is stored in a PostgreSQL database hosted by Aiven. Photos and videos are stored on Cloudflare R2 object storage, with video processed by Cloudflare Stream. These providers may process or store data outside your home country, including outside the EEA/UK or outside the US depending on where you're located; where that happens, we rely on the provider's own standard contractual clauses or equivalent safeguards as required by applicable law.

7. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS) between your device and our servers, and passwordless login (emailed one-time codes) so there's no account password that could be reused or leaked elsewhere. No method of transmission or storage is completely secure, so we can't guarantee absolute security, but we work to keep your data protected and will notify affected users and relevant authorities of any data breach as required by applicable law.

8. Cookies

We use essential cookies to keep you logged in. You'll see a cookie consent banner on your first visit where you can choose to accept all cookies or essential-only. If you accept, we also load Google Analytics to understand overall site usage (see Section 5) — it stays off entirely if you choose essential-only. We don't use cookies for cross-site advertising tracking, so there's no "sale" or "sharing" of personal data via cookies to opt out of.

9. Your rights under GDPR (EU/UK/EEA residents)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data — edit your profile at any time from Edit Profile.
• Erase your data — delete your account at any time from your profile settings. If you own any horse profiles, you'll need to delete or transfer them first, since a horse profile can't exist without an owner.
• Data portability — request a copy of your data in a portable format.
• Object to certain processing, and withdraw consent where processing is based on consent.
• Restrict processing of your data in certain circumstances.
• Lodge a complaint with your local data protection authority, or Ireland's Data Protection Commission as our lead supervisory authority.

10. Your rights under CCPA/CPRA (California and other US state residents)

If you're a California resident, and depending on your state, similar rights under other US state privacy laws, you have the right to:

• Know what personal data we collect about you and why.
• Delete your personal data, as described above.
• Correct inaccurate personal data.
• Opt out of "sale" or "sharing" — we don't sell or share your personal data with third parties for cross-context behavioural advertising, so there's nothing to opt out of today, but you can still make this request.
• Non-discrimination — we won't deny you service, charge you differently, or provide a different level of service for exercising any of these rights.

To exercise any of these rights, contact us as described in Section 14. We may need to verify your identity before actioning a request.

11. Children's privacy

HoofTrail is not directed at young children and is not intended for anyone under 13, regardless of local law. In line with our Terms & Conditions, you must also meet the minimum age to use online services where you live (typically 16 in the EU/EEA unless your country sets a lower age, as low as 13). We don't knowingly collect personal data from children below the applicable age; if we learn we have, we'll delete it. If you believe a child has provided us with personal data, contact us via Section 14 and we'll investigate and remove it.

12. Data retention

We keep your data for as long as your account is active. When you delete your account, your personal data and posts are permanently removed, including uploaded photos and videos, other than any copies briefly retained in routine backups (which are cycled out over time) or as required by law. Contact and investor enquiries are kept only as long as needed to respond to and follow up on them.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. We'll update the "Last updated" date above when we do; if a change is significant, we'll take reasonable steps to make it noticeable, such as a notice on the site.

14. Contact

To exercise any of these rights or ask a question about this policy, contact Lucas IT Services, Ireland via /contact.

15. Related policy

See also our Terms & Conditions.