Privacy Policy

Protecting your data is very important to us. This privacy policy explains what personal data we collect when you use the "StalliQ" app and the web portal at portal.stalliq.app (together "StalliQ"), how we process it, and what rights you have.

We process your data in compliance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws.

1. Data Controller

The data controller within the meaning of Art. 4(7) GDPR is:

StalliQ Labs
Inhaber: Christian Sabel
Am Weyerbach 13
56291 Norath, Germany
Email: datenschutz@stalliq.de

2. Overview: What Data Do We Collect?

StalliQ is an equine management app. We only collect data that is necessary to provide the app's features. We do not display advertising, do not use tracking tools such as Google Analytics, and do not collect location data (GPS).

3. Registration and User Account

A user account is required to use StalliQ. During registration, we collect:

Alternatively, you may register using Apple Sign-In or Google Sign-In. In this case, we receive an identity token, your email address, and optionally your name from Apple or Google respectively. No password is stored on our servers. Authentication is handled by the respective provider.

During registration, we also store the time of registration and your consent declarations (terms of service, privacy policy, health data processing where applicable), including the document version and app version.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

4. User Profile

After registration, you may voluntarily provide additional data in your profile:

• Display name and full name - so other users can identify you, e.g., when sharing a horse
• Profile picture - for visual identification
• Phone number - for contact by stable members (optional)
• Preferred language (German, English, Dutch)
• Notification settings (push notifications, email notifications, quiet hours, reminder days)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for optional data, Art. 6(1)(a) GDPR (consent).

5. Horse Data

You can create one or more horse profiles. The following data may be recorded:

Basic information: Name, nickname, gender, date of birth, breed, color, height, country of birth, profile picture and photo gallery.

Identification data: UELN (Universal Equine Life Number), chip number, FEI ID, passport number, national ID, pedigree (sire, dam, breeder).

Additional data: Character notes, markings, purchase price and date (optional).

This data is used for managing your horse, health care, and - when the UELN is provided - unique identification.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

6. Horse Diary

You can create daily diary entries for your horse. The following data is recorded: activity type (e.g., dressage, trail ride, groundwork), horse mood, weather conditions, duration, notes, and optionally a photo. Diary photos are automatically added to the horse's photo gallery.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

7. Health Data

StalliQ offers comprehensive health management features for your horse. Processing of this data only occurs after your explicit consent during the onboarding process.

The following health data may be recorded:

• Health records: Vet visits, vaccinations, deworming, dental care, farrier visits, injuries, illnesses, surgeries, check-ups
• Weight tracking: Weight in kg, measurement method (scale, tape, estimate), timestamp
• Allergies: Allergen, type (feed, medication, environment, contact), severity, reaction description
• Chronic conditions: Diagnosis, severity, treatment plan, medication
• Symptom documentation: Category, severity (1-5), description, observation time, photos, follow-up observations
• Health timeline: Chronological view of all health data (records, symptoms, observations)
• Health documents: Medical reports, vaccination records, receipts (as photo or PDF)

Routine hints: Based on the type and date of your health records (farrier, vaccination, deworming, dental care, check-up), StalliQ automatically calculates on our servers in Frankfurt when the next routine is due and points this out to you in the app. If you have enabled push notifications for this, you also receive the hint by push; it only states the routine, the horse's name and the date of the last entry. You can switch off the hints per horse and routine.

Note: Information about your horse's health is not health data within the meaning of Art. 9 GDPR, as this provision only protects data about people. We nevertheless only process it with your explicit consent, because health documents such as medical reports or invoices may also contain information about you or other persons, and you should decide for yourself whether we process this data.

Legal basis: Art. 6(1)(a) GDPR (explicit consent). You may withdraw this consent at any time.

7a. Insurance Data

You can store your horse's insurance policies in StalliQ. The following data may be recorded:

• Insurance details: Provider, plan name, insurance type (surgery, health, comprehensive, liability, life, theft, transport, other), policy number
• Contract details: Start date, end date, monthly premium, currency, deductible, coverage limit, GOT rate
• Notes: Free-text notes about the insurance
• Policy documents: Uploaded insurance certificates (as photo or PDF)

Additionally, StalliQ offers the ability to scan insurance documents automatically using AI (see Section 8). The extracted data and a confidence level are stored.

Insurance data may be shared with other users who have access to the horse profile (see Section 13).

Legal basis: Art. 6(1)(b) GDPR (contract performance); for health insurance data (surgery, health, comprehensive) Art. 6(1)(a) GDPR (consent for health data processing).

8. AI-Powered Document Analysis

StalliQ offers the option to automatically scan health documents as well as insurance policy documents using AI. The process works as follows:

1. The document (image or PDF) is sent to the Claude API (Anthropic, Inc.)
2. The extracted text and structured data are stored in your account
3. The AI request is routed exclusively through our servers (Supabase Edge Function). We do not transmit any account data, user ID, or other profile master data to Anthropic. However, the document you upload may contain personal information printed on the document itself (e.g. name, address, policy or invoice number); this is transmitted for the purpose of extraction.

For each AI interaction, we store: the type of request, the model used, token usage, and status - not the content of the request itself.

Anthropic processes the transmitted content exclusively on our behalf and on our instructions (Anthropic acts as processor; we remain the controller). The transmitted content is not used to train the AI models. It is treated as confidential and is deleted or returned upon termination of the processing relationship.

Notice pursuant to Art. 50 of the EU AI Act (Regulation (EU) 2024/1689): The AI-powered document analysis uses an AI system (Claude, Anthropic). Results are clearly marked as AI-generated within the app. The extracted data serves informational purposes only and does not constitute a veterinary diagnosis or recommendation.

Legal basis: Art. 6(1)(a) GDPR (consent for health data processing).

9. Appointments and Contacts

You can create appointments (vet, farrier, riding lessons, etc.) with title, description, location, time, reminders, and recurrence rules. You can also store service providers with name, company, phone, email, address, and notes. This data is used exclusively for appointment management within the app.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

9a. Tasks

You can create tasks (to-dos) - personal, or assigned to a horse or a stable (e.g., feeding, mucking out, turnout). The following are recorded: title, description, due date, recurrence rules, completion status (per occurrence, including the person who completed it), and the assigned people in charge.

If you assign a task to other users, the task data and your display name are visible to those assignees. For overdue tasks, the assignees may receive a push reminder (see Section 15).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

10. Costs and Expenses

You can record expenses for your horse (category, amount, date, receipts, recurring costs). This data is used exclusively for your personal cost overview.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

10a. Equipment and Lending

You can record and manage your equipment (e.g., saddle, bridle, blanket). The following is stored: name, category, optional notes, and an optional photo. Equipment can be assigned to one or more horses.

Using the lending feature, you can lend an item of equipment to other StalliQ users. The borrower, the time of lending, an optional return date, and the lending history are stored. The borrower as well as users with access to the assigned horse can view the relevant equipment data; the borrower is informed of a loan via notification (see Section 15).

For lending, StalliQ provides only the technical platform for documentation; any loan agreement is made directly between the users involved (see also Section 6a of the Terms of Service).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

11. Stable Management

When you join or manage a stable, the following data is processed:

• Stable profile: Name, address, contact details, logo, opening hours, rules
• Membership: Your affiliation with the stable, your role (owner, manager, instructor, member), skill level
• Riding lessons: Bookings, series bookings, waitlist positions, attendance, cancellations
• Lesson cards: Quotas, transactions (deductions, credits)
• Arena occupancy: Resource bookings, capacities, weekly schedule view
• Announcements: Notices published by the stable operator
• Statistics and finances: Reports for the stable, e.g. bookings, utilization, hours per instructor, revenue, outstanding payments and receipts. They may contain names of members and instructors and are visible only to people in the stable with the corresponding permission.
• Payments and receipts: Cash payments and lesson-card purchases in the stable are recorded with a consecutive receipt number, amount, date and the name of the paying person (the stable's cash book).
• Managed persons: You can create a managed person for people without their own account - usually your children - and book lessons and keep lesson cards for them. We store the name and, optionally, date of birth and notes; the stable sees the name in bookings, participant lists and its reports.
• Guests: For trial lessons or holiday riders without an account, the stable can add a guest by name to a lesson, where applicable with an outstanding amount.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for processing by stable operators, Art. 6(1)(f) GDPR (legitimate interest in stable management) may also apply. For receipts additionally Art. 6(1)(c) GDPR (the stable's retention obligations under tax and commercial law).

Who is responsible? For the data that a stable processes in the stable management about its members, riding students, guests and managed persons (e.g. bookings, attendance, lesson cards, payments and receipts, statistics), the respective stable is the controller. We process this data on its behalf on the basis of a Data Processing Agreement (Art. 28 GDPR). It is best to direct questions about this data to your stable; we forward any requests that reach us to the stable. For your user account and your other data in StalliQ, we remain the controller.

Information provided when creating a stable

When you create a stable in the StalliQ portal, you provide two kinds of information about yourself:

• Mandatory: your role at the time of creation (e.g. owner, stable management, riding instructor, club board member). It is stored with the stable and is not shown anywhere in the interface.
• Optional: after the stable has been created, we ask you once how you heard about StalliQ, how you have organised your stable so far, what you would like to tackle first, and what kind of operation you run. You can skip these questions; skipping has no disadvantages whatsoever.

We use this information solely internally, to understand who we are building StalliQ for and which features to prioritise. It is not used for advertising and is not passed on to third parties.

We also use the kind of operation you indicated to tailor the setup guide (checklist) in the portal to your business; the information itself remains visible only to you as the creator of the stable.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in developing our service in line with actual needs).

11a. Subscriptions and Payments

PLUS and PRO are purchased through the App Store (Apple) or Google Play. Payment is handled by the respective store; we do not receive payment data. RevenueCat manages the subscription status using your user ID (see Section 17).

Stable subscriptions are concluded in the web portal. Payment is handled by Stripe Payments Europe, Ltd. (Ireland); Stripe processes your name or company name, billing address, email address, your VAT ID where applicable, and the payment data. Stripe calculates VAT based on country and VAT ID (Stripe Tax). We do not receive payment data such as card numbers; for the stable we store the subscription tier, status, term and the customer and subscription identifiers at Stripe.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for invoice and accounting data Art. 6(1)(c) GDPR (retention obligations under tax and commercial law).

12. Public Events and Clinics

You can create or participate in public events (clinics, courses, competitions). The following data is processed:

• Event data: Title, description, date, location, slots, disciplines, skill levels
• Booking data: Your booking, slot assignment, booking status
• Participant lists: Visible to organizers after assignment publication

Depending on the visibility setting, published events are also visible to other users of the App. An event can be shared via a link (stalliq.app/event/...); this page itself does not show any event content but opens the App, and it is not indexed by search engines.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

13. Horse Sharing and Permissions

You can invite other users to co-manage your horse (e.g., co-rider, vet, trainer). The invitation, assigned role, and individual permissions are stored. Invited users can only see data for which they have been granted permission.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

13a. Data of Other Persons

When using StalliQ, you sometimes enter data of other persons, for example contact details of your vet, farrier or trainer (Section 9), names on uploaded documents and invoices (Sections 7, 7a, 8 and 10), information about your children as managed persons or - as a stable - names of guests (Section 11). We therefore do not receive this data from the data subjects themselves but from you. We only process it to provide the respective feature, and it is only visible within that feature (e.g. to you, to persons with whom you share a horse, or to the stable for bookings). Please only enter data of other persons if you are entitled to do so. Data subjects can exercise their rights with us in accordance with Section 22.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the feature you use). Data that a stable records in the stable management is processed by us on behalf of the stable (Section 11).

14. Private Messages, Group Chat and System Messages

StalliQ provides an internal messaging feature with one-on-one and group chats. Message content, timestamps, read status, and any sent images are stored. In a group chat, your messages and your display name are visible to all members of that group. You can block other users. Messages can be deleted by you (soft delete). You can clear or leave conversations.

Additionally, the system sends automated notifications (e.g., lesson cancellations) via a dedicated system account. These system messages cannot be replied to and serve to transparently inform you about relevant events.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

14a. Reporting and Blocking

If you report content (message, conversation, public event, announcement) or a user profile, we store: you as the reporting person, the reported content or profile, the person it originates from, the reason, your optional note, the time as well as the status and outcome of the review. We are notified of every new report by email (sent via Resend, see Section 17). We do not disclose your name as the reporting person to the reported person.

If you block a user, we store this block.

We store reports for as long as necessary for processing them, for documenting our decisions and for preventing abuse; when you delete your account, your reports are deleted.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 Digital Services Act; otherwise Art. 6(1)(f) GDPR (legitimate interest in a safe App).

15. Push Notifications

With your consent, we send you push notifications (e.g., appointment, task and riding lesson reminders, routine hints, new messages, booking confirmations, cancellation and lending notices). For this purpose, we store a device-specific push token, which is deleted upon logout. Delivery is handled by Expo (650 Industries, Inc., USA), which passes the notifications on to the operating system's delivery service: the Apple Push Notification service (Apple Inc., USA) on iOS and Firebase Cloud Messaging (Google LLC, USA) on Android. The push token and the content of the notification are transmitted in the process - see Sections 17 and 18. Depending on your device settings, notifications may also be displayed on the lock screen; you can change this in the system settings.

Legal basis: Art. 6(1)(a) GDPR (consent).

16. Offline Functionality

StalliQ is prepared for offline use. However, data processing currently takes place online via our database service (Supabase, Frankfurt); a local offline synchronization via PowerSync is set up but not currently activated. Once we activate offline synchronization, your data will additionally be cached locally on your device and synchronized when a connection is available; the local database is then completely deleted upon logout.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); Art. 6(1)(f) GDPR (legitimate interest in offline usability).

17. Sub-Processors and Third-Party Services

We use the following service providers as sub-processors:

When signing in via Apple Sign-In or Google Sign-In, identity data is transmitted by the respective provider (Apple Inc. / Google LLC). These providers are independent data controllers for their authentication services, not sub-processors.

To deliver push notifications, Expo passes them on to the Apple Push Notification service (Apple Inc., USA; iOS) or to Firebase Cloud Messaging (Google LLC, USA; Android). The push token and the content of the notification are transmitted in the process. We do not use any Firebase analytics services.

Data processing agreements pursuant to Art. 28 GDPR are in place with all sub-processors.

Important: We do not use any analytics or tracking tools (no Google Analytics, no Firebase Analytics, no Facebook SDK). We do not display advertising and do not share your data with advertisers.

17a. Server Log Files of the Website and Web Portal

When you visit our website stalliq.app or the web portal portal.stalliq.app, the web server (hosted by Hetzner Online GmbH, servers in Germany) automatically collects server log files transmitted by your browser. These include: the page/URL requested, date and time, HTTP status code, amount of data transferred, the referring page (referer), the browser identifier (user agent) and the IP address. The same applies to images and videos that we provide at assets.stalliq.app.

We process this data solely to ensure stable and secure operation of the website and for anonymized reach measurement (how many visitors use the website). The data is not merged with other sources and is not used to identify individuals; for reach analysis the data is aggregated and IP addresses are anonymized. Reach measurement takes place only for the website.

The legal basis is our legitimate interest in operational security and reach analysis (Art. 6(1)(f) GDPR). Log files are automatically deleted after 14 days. We use no cookies and no third-party tracking tools for this - the analysis is performed exclusively server-side on our own server in Germany.

Attack detection (CrowdSec): To protect our server against attacks (e.g. brute-force attacks, vulnerability scans, denial-of-service attempts), we additionally analyze the server log files automatically using the open-source software CrowdSec, which runs locally on our own server. If an attack pattern is detected, we report the IP address from which the attack originates, together with the detected attack type and a timestamp, to the community network operated by CrowdSecurity SAS (Paris, France), which uses these reports to compile shared blocklists for attack prevention. Only data on IP addresses from which attacks originate is transmitted - data of regular visitors to our website is not shared with third parties. The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).

17b. Contact Form (Website)

When you write to us via the contact form on our website, we process the data you provide: name, email address and your message. Purpose: processing and responding to your inquiry. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future, as well as our legitimate interest in responding to your inquiry (Art. 6(1)(f) GDPR). Email delivery is handled by our processor Resend (see Section 17); an internal notification is also sent to kontakt@stalliq.de. We store the data only as long as necessary to process your inquiry and delete it afterwards, unless statutory retention obligations apply.

17c. Website Language Preference

The website is multilingual (German, English, Dutch). On your first visit, the preferred language is determined from your browser's language setting (the "Accept-Language" HTTP header) and the matching language version is shown automatically. No cookie is set for this; the evaluation takes place server-side on each request.

If you actively select a language via the language switcher, we store this choice in a strictly necessary cookie (NEXT_LOCALE) so that your language preference is retained on future visits. The cookie contains only the language code (e.g. "de", "en", "nl"), no personal data, and is not used for analytics or advertising purposes. Legal basis: Section 25(2) no. 2 TDDDG (technically necessary storage) in conjunction with Art. 6(1)(f) GDPR (legitimate interest in a functioning, user-friendly language selection). You can delete the cookie at any time in your browser settings.

17d. Signing In to the Web Portal

When you sign in to the web portal, your browser stores the sign-in session in local storage so that you stay signed in. This storage is technically necessary (Section 25(2) no. 2 TDDDG) and is removed when you sign out. We do not set cookies for analytics or advertising.

18. Data Transfers to Third Countries

Some of our service providers are based in the USA (Supabase, Expo, Anthropic, RevenueCat, Sentry, Resend; for delivering push notifications also Apple and Google). Supabase stores our data in a data center in Frankfurt; however, as Supabase, Inc. is a US company, access from the USA, for example in the course of maintenance and support, cannot be ruled out. For payment processing via Stripe Payments Europe, Ltd. (Ireland), data may additionally be transferred to the US parent company Stripe, Inc. Data transfers are based on:

• Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or
• the EU-US Data Privacy Framework (Art. 45 GDPR), where the respective provider is certified

Your core data (profile, horses, health data, messages, appointments) is stored exclusively on servers in Frankfurt, Germany.

19. Data Retention

• Account data: Stored as long as your account is active. Deleted or anonymized immediately upon account deletion - except for receipts and the deletion record (see below).
• Receipts: Receipts for payments in a stable (receipt number, amount, date, name of the paying person) are kept after your account is deleted for the statutory retention periods, because the stable must retain them for tax and commercial-law reasons.
• Deletion record: After an account is deleted, we keep a record that and when it was deleted (internal identifier, time, number of deleted files) - without name or email address.
• Health data: Stored until you delete it or delete your account.
• Insurance data: Stored until you delete it or delete your account. Scan raw data (AI extraction) is stored with the insurance entry and removed upon deletion.
• Messages: Deleted messages are marked as deleted and permanently removed upon account deletion.
• Log data and error reports: Automatically deleted by Sentry after 90 days.
• Consent records: Stored as long as your account exists - also after a withdrawal, as proof; deleted together with your account.
• Backups: Our database service (Supabase) backs up the database daily and overwrites the backups after 7 days. Deleted data may therefore remain in a backup for up to 7 days.

20. Account Deletion and Data Export

Account Deletion

You can delete your account at any time in the app settings or in the web portal. Upon deletion:

1. Your horse ownership rights are transferred to a co-owner, or the horse profile is deleted
2. Your insurance entries are transferred to the horse owner or deleted
3. All your files (profile pictures, horse photos, equipment photos, documents) are irrevocably deleted
4. Your profile is anonymized (name becomes "Deleted User", email is anonymized)
5. Your authentication account is deleted
6. All locally stored data on your device is deleted
7. Receipts for payments in stables are not deleted but kept for the statutory retention periods (see Section 19)

Data Export

You have the right to receive a copy of all data stored about you in a machine-readable format (JSON) at any time. This feature is available in the app settings.

21. Data Security

• Encryption: All data transmissions use HTTPS/TLS
• Access control: Row-Level Security (RLS) at the database level ensures each user can only access their own data
• Input validation: All inputs are validated server-side
• Passwords: Stored exclusively as cryptographic hashes (bcrypt)
• Files: Health documents are only accessible via time-limited, signed URLs (15 minutes)
• Error monitoring: Sentry only receives your user ID - no names, email addresses, or health data
• Offline security: All locally stored data is deleted upon logout

21a. Obligation to Provide Data

You are under no statutory or contractual obligation to provide us with personal data. However, for a user account we need an email address or sign-in via Apple or Google; without it, you cannot use StalliQ. All other information (e.g. profile, horses, health data, appointments) is voluntary; without it, only the respective features are not available to you. For a stable subscription, our payment service provider Stripe needs the billing and payment data.

21b. No Automated Decision-Making

We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not carry out profiling. The results of the AI-powered document analysis serve only to prepare information (Section 8).

22. Your Rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent - at any time with effect for the future

To exercise your rights, simply send an informal message by email to datenschutz@stalliq.de.

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR), in particular in the EU Member State in which you live or work. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34, 55116 Mainz, Germany
Email: poststelle@datenschutz.rlp.de

22a. Right to Object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR, e.g. server log files and attack detection in Section 17a, the information provided when creating a stable in Section 11 or reports in Section 14a), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

An informal message to datenschutz@stalliq.de is sufficient to object.

23. Children and Young People

StalliQ is also used by children and young people, for example as riding students. For children and young people under 16:

• They may only give consents (e.g. for health data of the horse or push notifications) with the approval of their parents or legal guardians (Art. 8 GDPR).
• Parents can also create a managed person for their child without its own account and book lessons through it (see Section 11).

If we learn that a child under 16 has created an account without this approval, we will delete it upon notice from the parents.

24. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or new app features. For material changes, we will notify you in advance by email or in-app notification.

25. Contact

If you have questions about the collection, processing, or use of your personal data, please contact:

StalliQ Labs
Inhaber: Christian Sabel
Email: datenschutz@stalliq.de
Am Weyerbach 13, 56291 Norath, Germany