Privacy
Last updated: 7 November 2026. The German version of this page is authoritative.
1. Controller
Loistava Holding UG (haftungsbeschränkt), Asternring 9, 15732 Schulzendorf, Germany. Email: privacy@stallpool.com
2. Your account
We store your name, email address, a hash of your password (never the password itself), your language and when you signed up. While you are signed in, a session cookie keeps you logged in; it is strictly necessary. For security we store the IP address and browser of each session. Legal basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in securing accounts (Art. 6(1)(f) GDPR).
3. What you enter about the horse
- Horse, yard, rota, swaps, care tasks, handover notes, health dates, bills and shares, monthly contributions and payment status, the share agreement with each acceptance time, and insurance details (insurer, policy number, expiry date).
- Uploaded files (bill photos, insurance proofs, horse photo) are stored on our own server and are shown only to people who belong to that horse.
- Everyone on a horse sees the rota, notes and the people on it. Riders see their own charges and proofs plus the owner's horse liability policy; the owner sees everything on the horse.
- Stallpool only records money between owner and riders. It never holds or moves money between you.
- Legal basis: contract (Art. 6(1)(b) GDPR).
4. Emails
We send emails about your account (confirm address, reset password) and about your horse (swap requests and answers, notes marked “watch”, overdue payments, expiring insurance, upcoming health dates). Sent via Resend, Inc. (USA; EU Standard Contractual Clauses). We keep a log of which email was sent to whom and when, without its content. Legal basis: Art. 6(1)(b) GDPR.
5. Audience measurement
We count page views and visits with PostHog (servers in the EU, Frankfurt), routed through our own domain. Without your consent nothing is stored on your device: no cookies, no local storage; the count is kept in memory for the open page only. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR). Within the app we also record key steps (account created, horse added, first rider joined) linked to your account ID. Only if you agree in the notice at the bottom of the page does PostHog store an identifier on your device to recognise you across visits (Art. 6(1)(a) GDPR; you can withdraw by deleting the cookie “sp_consent”). We never record screens or sessions. Your choice itself is stored in the cookie “sp_consent” for one year.
6. Payments
Subscriptions are paid via Stripe Payments Europe, Ltd. (Ireland). We never receive card details. We store the Stripe customer and subscription ID, the plan and its status.
7. Hosting and delivery
Stallpool runs on servers of Hetzner Online GmbH in a data centre in Helsinki, Finland (EU). Cloudflare, Inc. delivers the pages and protects against attacks (EU Standard Contractual Clauses, EU-US Data Privacy Framework); connection data such as your IP address is processed briefly (Art. 6(1)(f) GDPR). For rate limiting we keep a one-way hash of the IP address for two days.
8. Emails to us and internal notices
Messages to addresses at stallpool.com are forwarded by ImprovMX (Sinosend LLC) to our mailbox at Google (Gmail, Google Ireland Ltd.). When a new account is created we receive an internal notice with name and email address in the same mailbox.
9. Retention
We delete your account and your entries when you ask us to (an email to privacy@stallpool.com is enough). Entries shared on a horse with others (rota, notes, bills) stay with that horse but are no longer linked to your name. Billing records are kept as long as tax law requires (up to 10 years).
10. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time. Just write to us. You may also complain to a supervisory authority, for example the Brandenburg data protection commissioner.