This policy explains how [TO COMPLETE: publisher legal name] collects and uses personal data for MemoRide, in accordance with the GDPR and applicable privacy laws.
1. Data Controller
Data controller:
[TO COMPLETE: legal name, legal form, registration number, postal address and contact email]
Data Protection Officer: [TO COMPLETE or state "not appointed"]
2. Data Collected
The Service may process the following categories of data:
- Account and identity: email, first name, optional last name, hashed password, preferred language, theme, account creation and login data.
- Profile: profile photo, optional birth date, computed age, optional gender, profile visibility and age-display preference.
- Horses: names, photos, videos, breed/studbook, coat, sex, birth date, height, discipline, owner display settings, public profile and sharing settings.
- Sport and care journal: training sessions, objectives, ratings, notes, positive points, areas for work, shows, classes, entries, results, rankings, times, health visits, next due dates, reminders and checklists.
- Community: member relationships, invitations, pending invitations, blocked users, activity feed, likes, shared access and search visibility.
- Media: photos, videos, technical metadata required for storage, favorite status, visibility settings, generated previews and compression or resizing data where necessary.
- Reports and moderation: reported content type, reported content identifier or URL, report reasons, optional message, report date, moderation status, moderation action and reviewer where applicable.
- Billing: Stripe customer identifier, subscription plan and status, billing period, storage option, payment method metadata, invoices and payment events.
- Notifications: push tokens, notification preferences, reminders and notification history.
- Technical and security data: authentication tokens, refresh token hashes, IP address, user agent, server logs, anti-bruteforce counters and error diagnostics.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Account creation, authentication and Service operation | Performance of the contract |
| Horse, session, show, health, reminder and checklist management | Performance of the contract |
| Community, sharing and search visibility | Performance of the contract and user choices |
| Media upload, storage and deletion | Performance of the contract |
| Reports, blocking, moderation and protection of users | Legitimate interest and compliance with legal obligations where applicable |
| Subscriptions, invoices, cards and payment incidents | Contract and legal accounting obligations |
| Push notifications and reminders | Contract and user settings |
| Security, anti-fraud and anti-bruteforce | Legitimate interest |
| Error monitoring and service reliability | Legitimate interest |
| Compliance with legal obligations | Legal obligation |
4. Visibility Rules
The user controls profile and content visibility. Private content is not shown to other users except where explicit access is granted. Community content is visible to accepted community members. Public content can be visible more broadly and may appear in search results.
Horse visibility is assessed together with the rider or owner visibility where applicable. Search results only return riders and horses accessible according to the Service rules.
When a user blocks another user, the block is used to prevent community re-addition and restrict access to the blocker’s public rider and horse profiles. Reports and moderation decisions may also temporarily or permanently hide content from search, public pages, feeds and media galleries.
5. Processors and Recipients
Data may be processed by providers used to operate the Service:
- [TO COMPLETE: hosting provider] for API, website and database hosting.
- Cloudflare, Inc. for R2 object storage of photos and videos.
- Stripe Payments Europe, Ltd. for payments, subscriptions, invoices and cards.
- Expo / 650 Industries, Inc. for push notifications.
- Sentry / Functional Software, Inc. for error monitoring when enabled.
- [TO COMPLETE: email provider if used] for transactional emails.
Data is not sold. It is only disclosed to other users according to the visibility and sharing choices made in the Service, or to authorities when required by law.
Reports and moderation data are accessible only to authorized administrators and technical staff where necessary to review content, protect users, secure the Service, manage suspensions, bans, subscription cancellation related to moderation, media retention or comply with legal requests.
6. International Transfers
Some providers may process data outside the European Economic Area. Where required, such transfers are covered by appropriate safeguards such as Standard Contractual Clauses, adequacy decisions and technical security measures.
7. Retention Periods
- Account and journal data: kept while the account is active.
- Deleted account data: deleted within a reasonable technical period, except legal retention obligations.
- Media after a return to the free plan or subscription end: retained for the grace period displayed in the Service, then deleted, except the rider profile photo and the main photo of each horse kept in the free plan.
- Reports, moderation actions, suspension or ban records and blocked-user records: kept while necessary to protect users, document moderation decisions and prevent abuse, then deleted or anonymized when no longer needed.
- Media linked to banned accounts: retained while necessary for review, evidence and legal protection, then deleted from object storage when the publisher decides to purge it or when retention is no longer justified.
- Billing records and invoices: retained for the legal accounting period, generally 10 years.
- Security logs: up to 12 months unless an incident requires longer retention.
- Login attempts and anti-bruteforce counters: short-term retention required for security.
- Refresh tokens: retained until expiry, revocation, rotation or account deletion.
- Error monitoring data: retained according to the configured Sentry retention period, to be completed by the publisher.
8. Account Deletion
The user can request account deletion from the profile settings. This deletes operational data linked to the account, including horses, sessions, shows, class entries, health visits, reminders, checklists, notifications, shared accesses, posts and media, including the profile photo and main horse photos stored in object storage. Payment records that must be retained for accounting or legal purposes may be kept. Reports, blocks and moderation logs may also be kept for the time strictly necessary to document abuse, protect other users or meet legal obligations.
9. Security
The publisher uses technical and organizational measures including:
- password hashing and password strength requirements;
- hashed refresh tokens and authenticated API access;
- HTTPS/TLS for network communications;
- login attempt limitation and CSRF protection on the website;
- role and ownership checks before access to private data;
- blocking, reporting and moderation tools to limit abuse and hide problematic content;
- environment-based management of secrets and third-party keys;
- deletion of media from object storage when content is deleted, subject to technical failures and retry mechanisms.
10. User Rights
Users may request access, rectification, erasure, restriction, portability and objection where applicable. Requests can be sent to [TO COMPLETE: privacy contact email].
Users may also lodge a complaint with the competent supervisory authority, such as the CNIL in France.
11. Cookies and Similar Technologies
The mobile application does not use browser cookies. The website uses cookies and local technical storage strictly necessary for session, authentication, language preference, CSRF protection and security. No advertising cookie is intended to be used unless this policy is updated and the required consent mechanism is implemented.
12. Minors
The Service is intended for users aged at least 15 years old. Minors must obtain any required authorization from their legal representatives.
13. Updates
The publisher may update this policy to reflect product, legal or technical changes. Users will be informed of substantial changes when required.