Privacy Policy

The data controller for personal data collected through the Horsora platform is:

• Entity: Antoine Chiris, Sole Trader (EI)
• SIRET: 84180558300033
• VAT Number: FR33841805583
• Address: Not disclosed for privacy reasons
• Contact: [email protected]

In connection with your use of the Horsora platform, we collect the following data:

• Account data: name, email address, encrypted password (bcrypt), role within the equestrian center.
• Equestrian data: information about horses (health, scheduling, events), voluntarily entered by the user.
• Navigation data: pages visited, session duration, visit source, collected anonymously by default via PostHog and, with your consent, via Google Analytics (see section 4).
• Anonymous error data: anonymized technical error traces collected via Sentry (see section 5).
• Subscription and payment data: subscription status, chosen plan, purchase history, and transaction identifiers. Card numbers are never processed or stored by Horsora: they are handled directly by our payment providers (see section 6).

• Provision and improvement of the Horsora service
• User account and session management
• Subscription, payment, and billing management
• Performance monitoring and technical error detection
• User experience improvement
• Measurement of site traffic and of our ad campaigns' performance

Processing is based on the performance of the contract (Terms of Use accepted at registration) and the legitimate interest of the publisher in improving the service. Non-essential trackers (cookie-based analytics, advertising) rely on your consent (Article 82 of the French Data Protection Act), which you can withdraw at any time.

Horsora keeps tracker usage to a strict minimum. A consent banner lets you accept or reject non-essential trackers by category. Your choice is kept for about 6 months and can be changed at any time via the "Manage cookies" link in the footer or in your account Settings.

Analytics (PostHog). By default, PostHog runs in cookieless mode: measurement is anonymous, with no persistent identifier, and does not require consent under the ePrivacy Directive. If you accept the "Analytics" category, PostHog switches to a persistent mode (cookies / localStorage) to recognize your repeat visits. Data is hosted within the European Union.

Analytics (Google Analytics). Only with your consent to the "Analytics" category do we load Google Analytics, provided by Google Ireland Limited, on the website and web app. It sets cookies whose names start with "_ga" (13 months maximum) and measures page views, visit duration, visit source (including our Google Ads campaigns) and device type. Google Analytics does not store your IP address. Before anything is sent, identifiers in page addresses are masked, and sharing, invitation and password-reset link pages are not measured. Related advertising signals are only enabled with your consent to the "Advertising" category. Without consent, Google Analytics is not loaded.

Advertising (Meta, Google). Only with your consent to the "Advertising" category do we load the Meta Pixel (Facebook/Instagram) and Google Ads tags. These trackers measure the performance of our campaigns and let us show you relevant ads. Without consent, none of these trackers are loaded.

Horsora uses Sentry for error detection and technical performance monitoring. This service is configured in cookieless mode:

• No tracking cookies are placed
• Data transmitted consists of anonymized technical traces (error type, source file, line number)
• No personally identifiable data (name, email, full IP address) is transmitted to Sentry

When you purchase a paid subscription, certain data is processed by specialized providers acting as processors or controllers, as applicable:

• Stripe (website payments): name, email address, billing address, and card data. Stripe may process this data in the United States.
• Apple App Store and Google Play (purchases from the mobile app): payment and receipts are handled by Apple or Google under their own privacy policies.
• RevenueCat (mobile subscription management): subscriber identifier, purchase events, and technical device information, used to synchronize your subscription status. RevenueCat may process this data in the United States.

Horsora never stores full card numbers. This processing is necessary for the performance of the contract (provision of the subscription you purchased).

• Account data: retained for the lifetime of the account, then deleted within 30 days of a deletion request.
• Equestrian data: retained in accordance with applicable regulatory obligations (breeding registers in particular), then deleted upon request.
• Subscription and billing data: retained for the duration of the contractual relationship, then in accordance with accounting and tax obligations (up to 10 years for invoices).
• Analytics: a rolling 24 months in PostHog, 14 months in Google Analytics.
• Cookie consent choice: kept for about 6 months, after which the banner reappears.
• Error traces: retained for 90 days in Sentry.

In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restriction of processing

To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

Application data is hosted in Europe (Hetzner, Germany) and files (photos, documents) with Scaleway (France). PostHog is configured to store data within the European Union.

Some providers may process data in the United States: Google (Google Analytics and Google Ads) and Meta (Pixel), only with your consent, as well as payment and subscription-management providers (Stripe, RevenueCat, Apple and Google for mobile purchases). These transfers are governed by appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

This policy may be updated at any time. Any material change will be notified to logged-in users. The update date is indicated at the top of this page.