Privacy Policy

We collect information you provide directly, information created as you use the Service, and limited technical information collected automatically.

• Account and identity information: your name, your Contact Point (email address or phone number), password or passwordless sign-in code, and profile details you add.
• Stable and horse records: horse identity and ownership details, veterinary, farrier, and vaccination records, training records, accounting and invoice records, and documents or photographs you upload, including passport/name-plate scans and bill scans.
• Marketplace content: listings you create, messages you exchange with other users about a listing, bookmarks, and reports you submit.
• Stopwatch data: session timings and, if you are a Pro subscriber or timing within a Stable, saved history.
• Planner activity: condition books you browse or export and target races you attach to a horse.
• Usage and device data: log data, approximate location inferred from IP address, browser and device type, and the single session cookie described in the Cookies section below.
• Communications: messages you send to our support or admin team, and records of actions taken on your account for account-security and audit purposes.

We use the information described above to:

• provide, maintain, and secure the Service, including authenticating you and enforcing the permissions that apply within a Stable;
• operate the products you use, such as saving Stopwatch history, generating Planner exports, and matching Marketplace conversations to the right listing;
• communicate with you about your account, security events, and changes to the Service;
• detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service;
• comply with legal obligations and respond to lawful requests from public authorities; and
• improve the reliability and usability of the Service.

Some features let you upload a document or photograph, such as a horse passport, name-plate, or accounting bill, so that we can suggest structured data using an AI model. The model's output is always an unverified draft: it carries the source document, model, and version it came from, and a human must review it before it is saved to a horse's record or used for accounting.

We do not use AI-generated extraction output to make a decision that produces legal or similarly significant effects concerning you without human review.

Where applicable data protection law requires a legal basis, we rely on one or more of the following: your consent (for example, when you choose to save Stopwatch history or upload a document); the necessity of processing to perform our contract with you (providing the Service you signed up for); our legitimate interests in operating, securing, and improving the Service; and compliance with a legal obligation.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share information only in the following circumstances:

• With other Horsemen who share access to the same Stable or the same Marketplace conversation, limited to what their role permits.
• With service providers who process data on our behalf under contract, currently limited to Amazon Web Services infrastructure: Amazon Cognito (authentication), Amazon Aurora (database), Amazon S3 (document and image storage), Amazon Bedrock (AI-assisted document extraction described above), and Amazon SES (account email delivery).
• With a future payment processor once online billing is introduced; this Policy will be updated before that happens.
• Where required to comply with a legal obligation, protect the rights and safety of Hisani or others, or respond to a valid request from a public authority.
• In connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to your information.

The Service is currently hosted on Amazon Web Services infrastructure in the United States (us-east-1), under a documented, temporary exception adopted after a regional service disruption prevented deployment to our intended United Arab Emirates region. We intend to migrate hosting to the United Arab Emirates (me-central-1) and will update this Policy when that migration completes.

Where we transfer personal information across borders, we take steps designed to ensure it continues to receive an appropriate level of protection, consistent with applicable law.

We keep your information for as long as your account is active and as needed to provide the Service. After you close your account, we retain information only as long as necessary to comply with legal obligations, resolve disputes, enforce our agreements, and maintain the integrity of Stable records that other users depend on (for example, a horse's veterinary history is not deleted merely because one contributor's account closes).

The Service uses a single first-party session cookie to keep you signed in. It is strictly necessary, set with HttpOnly and SameSite=Lax attributes, and is not used for advertising or cross-site tracking.

We also use your browser's local storage and IndexedDB to keep the Service usable offline as a Progressive Web App, and to store Stopwatch history locally for Free and anonymous users who have not upgraded to synced, Pro-tier history.

We do not currently use analytics, advertising, or third-party tracking cookies. If that changes, we will update this Policy and request your consent where required.

Subject to applicable law, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You can exercise most of these rights directly from your Account settings, or by contacting us using the details below.

Where information forms part of a shared Stable record, we may need to involve that Stable's Owner or a platform Administrator to action your request, since the record is relied on by other Horsemen.

We use encryption in transit and at rest, role-based access controls, and automatic redaction of sensitive fields (such as passwords, tokens, and identifying document numbers) from our operational logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is intended for users who are at least 18 years old, or the age of legal majority in their jurisdiction. We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, please contact us and we will take appropriate action.

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice, such as an in-product notice or an update to the effective date above, before the changes take effect.

If you have questions about this Policy or want to exercise your privacy rights, contact us at privacy@hisani.app.