Privacy notice

Saddle Up is the data controller for the accounts, bookings and messages held in this service. Each riding centre is a separate controller for the records it keeps about its own riders. Contact us at privacy@saddle-up.app.

• Account details — name, email address, phone number and password (stored only as a secure hash).
• Rider profile — date of birth, riding experience and level, height and weight, riding goals and the disciplines you ride.
• Health and safety information — health notes relevant to riding safely, and an emergency contact.
• Booking activity — sessions requested and taken, references, horses and coaches allocated, waitlist places, assessments and progress records.
• Messages — conversations between you and a riding centre.
• Technical information — the pages you visit and errors the app records, used to keep the service working.

Accounts are for adults. A parent or guardian creates and manages a profile for each child they are responsible for, and only that guardian and the riding centres the child rides with can see it. We do not market to children and we do not use children's information for anything beyond arranging and running their sessions safely.

• To perform our contract with you — creating your account, taking bookings, and passing the details a centre needs to run your session.
• Legitimate interests — keeping the service secure, preventing misuse, and improving how it works.
• Vital interests and explicit consent — health notes and emergency contacts, used to keep riders and horses safe. You choose what to tell us; leaving out information may mean a centre cannot accept a booking.

A riding centre sees what it needs to run your session: your name, contact details, riding level and experience, relevant health notes, your emergency contact, and your history with that centre. Centres never see your bookings with other centres. We do not sell your information and we do not share it for advertising.

We use trusted suppliers to run the service: a hosting and database provider (Supabase), site hosting, and a weather provider for outdoor-session safety checks. They process data on our instructions only.

Account and booking records are kept while your account is open and for up to six years afterwards, because riding involves horses, people and insurance and centres may need to show what happened during a session. Messages follow the same period. You can ask us to delete your account sooner; we will keep only what we must for safety or legal reasons.

You can ask for a copy of your information, ask us to correct it, ask us to delete it, or object to how we use it. Write to privacy@saddle-up.app and we will reply within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office (ico.org.uk).

Access is controlled account by account: riders see only their own records and those of the people they are responsible for, and centre staff see only their own centre. Data is encrypted in transit and at rest, and access is logged.