Privacy Policy

OpenStable is an online marketplace connecting horse owners with livery yards and activity providers across the UK. We are operated by Alex Crowley, a sole trader trading as OpenStable, whose principal place of business is at Silver Birches, Ox Drove, Newbury, RG20 9JS, England.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we are the data controller of your personal data.

We are registered with the Information Commissioner’s Office (ICO).

If you have any questions about how we use your personal data, please contact us at privacy@openstable.co.uk.

We collect the following categories of personal data:

Account data

• Email address (required to create an account)
• Your role on the platform (horse owner, yard owner, or service provider)
• OAuth profile information if you sign in with Google (name, email, profile picture)

Horse owner profile data

• Your first name
• Your horse’s name and type
• Livery preferences, timeline, and riding level
• A brief situation note you choose to share with yards
• Your search postcode and preferred search radius
• Horse photo (if uploaded)
• Your preference as to whether you receive proactive messages (“nudges”) from local service providers

Yard owner profile and listing data

• Yard name, postcode, county, and geographic coordinates (derived from your postcode)
• Contact name, phone number, email address, and website
• Yard description, facilities, services, and photos
• Availability information and activity slot details
• Your preference as to whether you receive proactive messages (“nudges”) from local service providers

To protect user privacy, exact addresses are not publicly displayed unless explicitly provided by the yard owner.

Service provider profile data

• Business name, slug, and service category
• Business description
• Coverage postcode, radius, and geographic coordinates (derived from your postcode)
• Contact details you choose to provide (phone, email, website, WhatsApp)
• Business photos
• Subscription status (Free or Pro)

Communication data

• Enquiry messages sent between horse owners and yard owners
• Direct messages between clients (horse owners and yard owners) and service providers, including any messages sent as part of the service request flow
• Proactive broadcast messages (“nudges”) sent by service providers to opted-in clients in their coverage area, and records of which recipients each nudge was sent to (used to enforce per-recipient cooldowns, senders’ monthly quotas, and the per-recipient monthly ceiling on approaches)
• Invitations sent by yard owners to horse owners through Find Horse Owners or from a yard’s wait list, and records of which horse owners each invitation was sent to (used to enforce the sender’s allowance and the per-recipient monthly ceiling on approaches)
• When a yard declines an enquiry: the reason it chose (“we’re full” or “not the right fit”) and any short note the yard owner adds for their own records
• Reviews and ratings you submit
• Yard owner responses to reviews

Wait list data

• The yards whose wait lists you are on, and when you joined
• What you are looking for there — livery types, timeline, and number of horses
• A private note the yard owner may add about you on their list
• When we last asked whether you are still looking, and your answer
• Spaces a yard has offered you before listing them publicly, and how you responded
• Details a yard owner enters about people who are not on OpenStable — see section 14

Payment and subscription data

• Your subscription tier (Free or Pro) — applies to yard owners and service providers
• Stripe customer ID and subscription ID
• We do not store your payment card details. All payment processing is handled directly by Stripe. Please review Stripe’s Privacy Policy for details of how they handle your payment data.

Technical and usage data

• Session tokens and authentication data (managed by Supabase)
• IP address and browser information (collected automatically by our infrastructure)
• Pages visited and features used on the platform (collected via PostHog analytics)
• Error and diagnostic information (collected via Sentry error monitoring)
• Saved yards and shortlists

We collect personal data in the following ways:

• Directly from you — when you register, complete your profile, post a listing, send an enquiry, write a review, or contact us.
• Automatically — when you use the platform, we collect technical data such as session tokens, IP addresses, usage information, and error reports through cookies and our infrastructure and analytics providers (Supabase, PostHog, and Sentry).
• From third parties — if you choose to sign in using Google, we receive basic profile information (name and email) from that provider.
• From other users — a yard owner can add you to their wait list, write a note about you on it, or record why they declined your enquiry. A yard owner can also enter the name and contact details of someone who is not on OpenStable. Section 14 explains both.

Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

• Performance of a contract (Article 6(1)(b)) — to provide you with our platform services, including creating and managing your account, enabling enquiries and messaging between horse owners and yard owners, and processing subscription payments.
• Legitimate interests (Article 6(1)(f)) — to operate and improve the platform, prevent fraud and abuse, ensure platform security, and send transactional notifications (such as new enquiry alerts and message notifications). Our legitimate interests do not override your rights and freedoms.
• Consent (Article 6(1)(a)) — for optional marketing communications and email notifications that you can control in your account settings. You may withdraw your consent at any time.
• Legal obligation (Article 6(1)(c)) — to retain payment records as required by UK tax law (currently 7 years).

We use your personal data to:

• Create and manage your account
• Display your yard listing or horse owner profile to relevant users
• Make certain information you choose to include in your profile or yard listing (such as your first name, horse details, yard description, facilities, and photos) visible to other users of the platform in order to facilitate connections between horse owners and yards
• Enable enquiries and messaging between horse owners and yard owners
• Display service provider listings to potential clients in the services directory
• Enable the service request flow — routing inbound contact requests to the relevant service provider, facilitating the accept/decline mechanic, and opening direct conversations once a request is accepted
• Send in-app and email notifications to service providers when new service requests are received
• Deliver proactive broadcast messages (“nudges”) from service providers to clients in their coverage area who have opted in to receive them, and yard invitations from yard owners to discoverable horse owners, and enforce the associated quotas, cooldowns and the per-recipient monthly ceiling on approaches
• Show search results and availability based on your preferences and location
• Run yard wait lists: tell you when a yard whose list you joined posts a space, let a yard offer you a space before it goes on search, ask you once a month whether you are still looking (and take you off a list after three months without an answer), and tell yard owners who has joined their list
• Process subscription payments and manage your billing
• Send transactional emails (such as new enquiry notifications, message alerts, and availability expiry reminders)
• Send review prompt emails following a secured livery placement (where you have not opted out)
• Display and facilitate user reviews
• Improve platform functionality, fix bugs, and develop new features
• Detect and prevent fraud, abuse, or violations of our Terms & Conditions. We may review messages and communications sent through the platform for this purpose.
• Comply with our legal obligations

Reviews represent the personal opinions of the users who submit them and are published in good faith as part of the platform service. OpenStable does not verify the accuracy of reviews. Reviews must comply with our Terms & Conditions, and we reserve the right to remove content that breaches those terms.

We share your personal data only with trusted third-party service providers who process data on our behalf. All processors are bound by data processing agreements and must handle your data securely.

• Supabase — our database and authentication infrastructure provider. Your data is stored on servers located in the EU. Supabase acts as a data processor on our behalf.
• Google — we use the Google Geocoding API to convert postcodes to geographic coordinates for search functionality. We also support Google as an OAuth sign-in provider. Google may process your data in accordance with their privacy policy.
• Stripe — our payment processor for subscription billing. Stripe processes payment card data directly and is PCI-DSS compliant.
• Resend — our transactional email delivery provider. Resend receives your email address and the content of emails sent on your behalf.
• PostHog — our product analytics provider. PostHog collects information about pages you visit and features you use in order to help us understand how the platform is used and improve it. PostHog may set cookies or use local storage to identify your session. PostHog is based in the United States; data transfers are covered by Standard Contractual Clauses. You can learn more at posthog.com/privacy.
• Sentry — our error monitoring provider. Sentry captures technical error and diagnostic information (including stack traces and browser context) to help us identify and fix bugs. Sentry does not receive your payment card details or passwords. Sentry is based in the United States; data transfers are covered by Standard Contractual Clauses. You can learn more at sentry.io/privacy.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We will disclose your data to the ICO or other law enforcement authorities if required by law.

Your data is primarily stored in the EU via Supabase. Where we use third-party processors based outside the UK or EEA (including Google, Stripe, Resend, PostHog, and Sentry), we ensure that appropriate safeguards are in place, including reliance on Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner, or the equivalent international transfer mechanism.

We retain your personal data for the following periods:

• Active accounts — for as long as your account remains active, plus 90 days following account deletion to allow for any disputes or recovery requests.
• Deleted accounts — personal data is anonymised or deleted within 30 days of account deletion. Some aggregated, anonymised data (such as review scores without personal identifiers) may be retained for platform quality purposes.
• Payment and billing records — retained for 7 years as required by UK financial regulations.
• Messages and enquiries — retained for the duration of your account and deleted or anonymised upon account deletion. A yard’s reason for declining an enquiry is kept with that enquiry, and removed if the enquiry is reopened.
• Wait lists — kept while you are on the list. Once you leave, are removed, or are taken off after three unanswered monthly check-ins, the entry is deleted within 90 days. Deleting your account deletes all of your wait list entries.
• People not on OpenStable added to a wait list — if you take yourself off using the link, your phone number and email address are deleted straight away and the rest of the entry within 90 days. An entry nobody has touched for 12 months is deleted.

You have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification — you can ask us to correct inaccurate or incomplete data. Most profile data can be updated directly in your account settings.
• Right to erasure — you can request deletion of your personal data. You can delete your account directly from the settings page. Certain data may be retained where we have a legal obligation to do so.
• Right to data portability — you can request a copy of your data in a structured, machine-readable format.
• Right to restrict processing — you can ask us to pause processing of your data in certain circumstances.
• Right to object — you can object to processing based on legitimate interests, including for direct marketing.
• Right to withdraw consent — where processing is based on your consent (e.g. marketing emails), you can withdraw it at any time via your account settings or by contacting us.

You may delete your account from your account settings at any time.

To exercise any of these rights, please contact us at privacy@openstable.co.uk. We will respond within one calendar month.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

We implement appropriate technical and organisational security measures to protect your personal data, including encrypted data transmission (HTTPS), access controls, and secure infrastructure providers. However, no method of transmission over the internet is completely secure, and we cannot guarantee the absolute security of your data.

We use cookies and similar technologies to operate the platform. The cookies we use are:

• Essential / session cookies — used by Supabase to manage your authenticated session. These are strictly necessary for the platform to function and cannot be disabled.
• Analytics cookies / local storage — used by PostHog to track page views and feature usage so we can understand how the platform is used and improve it. PostHog uses cookies and/or local storage to maintain an anonymous session identifier. These are analytics cookies, not advertising cookies.

We do not use third-party advertising or behavioural targeting cookies. If this changes, we will update this policy and request your consent where required.

OpenStable is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us at privacy@openstable.co.uk and we will delete it promptly.

Service providers using OpenStable (for example farriers, vets, equine dentists, physiotherapists) can record details of their own clients on the platform — including clients who may not yet have an OpenStable account. The categories of personal data entered are typically the client’s name, contact details (email and/or phone), the names of horses they are responsible for, and free-text notes about visits.

Lawful basis

Where a service provider enters a third party’s contact details in this way, our lawful basis for processing is legitimate interest (UK GDPR Article 6(1)(f)) — specifically, the legitimate interest of the service provider in maintaining accurate records of their pre-existing service relationship with you, and our interest in providing the tooling that supports that relationship. The service provider confirms when adding you that they have a working relationship with you and that you would expect to receive an invite from them via OpenStable. OpenStable does not independently verify this confirmation.

Silent linking to existing OpenStable accounts

If a service provider adds you as a client using an email address tied to your existing OpenStable account, we will silently link that record to your account so you can see your visit history. No invite email is sent in that case — the link will simply appear in your account and you will receive an in-app notification that the service provider has added you.

Data retention

We retain client records entered by a service provider for as long as the service provider maintains an active relationship with you, or until either party requests deletion. If you object to the processing or ask to be removed, we will delete the record within 30 days. Section 8 (Data retention) describes our broader retention practices.

Your rights and how to object

You can object to this processing at any time, ask for the record to be deleted, or request a copy of what has been entered about you. To do so, contact us at privacy@openstable.co.uk or via our contact page. Section 9 (Your rights under UK GDPR) sets out your full rights, including the right to lodge a complaint with the Information Commissioner’s Office.

A livery yard that is full can keep a wait list on OpenStable of people who would like a space. There are three ways onto a yard’s list.

You join it yourself

When you join a wait list, the yard owner sees your first name, the type of horse you have, and what you are looking for (livery types, timeline, and number of horses). They may be told in the app and in a daily email. We tell you when that yard posts a space, and the yard may offer you a space before it is listed publicly. Once a month we ask whether you are still looking; if three months go by without an answer we take you off the list without telling the yard why. You can leave any list at any time from Saved.

A yard adds you after you have enquired

A yard owner can add someone who has already sent them an enquiry to their wait list. We do not notify you when this happens, and it is not shown anywhere in your account: nobody hears from OpenStable because a yard added them. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — the yard’s interest in remembering people who have already asked it about a space, using information you gave that yard when you enquired.

If a space later comes up, the yard may invite you to enquire about it. That invitation is treated like any other yard invitation: it counts toward the monthly limit on approaches you can receive, and if you have turned off “Yard discoveries” emails it reaches you in the app only.

A yard adds someone who is not on OpenStable

A yard owner can type in the name, and a mobile number or email address if they have one, of someone from their own records who is not on OpenStable, together with the kind of livery that person is after. Our lawful basis is legitimate interests (Article 6(1)(f)) — the yard’s interest in keeping its existing wait list in one place. Our Terms allow a yard owner to add only people they already have a relationship with who would expect to hear from the yard. OpenStable does not independently verify this.

• OpenStable never contacts that person. The yard owner may send them a link from the yard’s own phone or email. We do not use their contact details for anything else, and we never match them to an OpenStable account.
• The link shows their first name, the yard, and what the yard noted they are after — never their contact details or the yard’s note.
• From the link they can keep their place, which creates an OpenStable account and deletes the contact details the yard typed, or take themselves off without an account, which deletes their phone number and email address straight away.

Notes and decline reasons

A yard owner can keep a short private note about someone on their wait list, and record why they declined an enquiry. These are not shown to you in the app, but they are personal data about you: you can ask for a copy under section 9, and yard owners are required by our Terms to keep them factual.

Your rights and how to object

You can object to being on a yard’s wait list, ask to be removed, or request a copy of what a yard has recorded about you — whether or not you have an account. Contact us at privacy@openstable.co.uk or via our contact page. Section 8 sets out how long this data is kept and section 9 your full rights.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email before the changes take effect. The date at the top of this page reflects when the policy was last updated. Continued use of the platform after changes take effect constitutes your acceptance of the updated policy.

For any questions or concerns about this Privacy Policy or how we handle your data, please contact our privacy team at:

Email: privacy@openstable.co.uk
Post: Alex Crowley t/a OpenStable, Silver Birches, Ox Drove, Newbury, RG20 9JS, England