Privacy policy | Astride

Astride is a mobile app for people who are looking for a sport horse and people who are selling one. People selling publish listings with video, photos, text, documents, price and location; people looking see horses in a feed sorted by how well they fit their preferences, on a map, save them, send requests and chat once the other person has answered. The circle is a private area for requests that are not public.

This Privacy policy explains how Astride — operated by Astride GmbH in formation (in Gründung), Im Rüeblig 2, 8117 Fällanden, Switzerland, represented by Manon Rudin — collects, uses, stores, shares and protects personal data when you use the app, the website astride.ch and related services (the “Platform”). We update it when the law or our processing changes; material changes are announced in the app or by e-mail.

1. Data controller

Astride GmbH in formation (in Gründung), Im Rüeblig 2, 8117 Fällanden, Switzerland, represented by Manon Rudin. E-mail: support@astride.ch. Until the company is entered in the commercial register, the person named is the data controller under the Swiss FADP and, where it applies, the GDPR.

2. Personal data we collect

We collect only what the Platform needs:

Account data — name, e-mail address, password (stored only as a hash), profile photo, phone number and address if you add them, Apple or Google account identifier if you sign in that way, whether you are looking, selling or both.
Preferences — what you are looking for (discipline, level, budget, age, height, sex, traits, free text) and your search location; for Pro accounts, the same for each person you look for.
Listings — videos, photos, texts, documents, competition information, price and the horse’s location, published by people selling. Documents are visible only to people you are in touch with about that horse.
Dealing Stable data — name, address, contact details and links of a stable, and which verified people belong to it.
Activity — likes, hidden horses and the reason you gave, requests, matches, circle requests and memberships, plans you activated, how you use the app (screens, taps, which features you use) and how long horses are on screen.
Messages — chat conversations, including shared listings and media.
Location — the search location from your preferences; the device position if you allow it, only to centre the map. On the map a seller’s address is shown approximately (about 1 km), never exactly, unless the listing itself has a location.
Voice input — if you dictate your free text, the audio is processed by your device’s or platform’s speech recognition (Apple or Google) and only the text reaches us.
Device data — push notification tokens, app version, device model and operating system, crash and error reports.
Technical data — IP address, user agent, timestamps and requested URLs in server logs, kept for up to 30 days for security and abuse prevention.

3. Why we use your data

To run the Platform: accounts, listings, the feed and the match percentage, the map, requests, chat, the circle, plans — performance of a contract (Art. 6(1)(b) GDPR).
To show you horses that fit what you are looking for and to notify you of new matches, requests and messages — performance of a contract; push notifications only with your consent on the device prompt.
To read your free-text description with AI and turn it into structured preferences, and to pick the best frame of a video — performance of a contract.
To verify Dealing Stables and the people who belong to them — performance of a contract and legitimate interest in a trustworthy platform.
To understand how the app is used and to fix errors (product analytics, crash reports) — legitimate interest (Art. 6(1)(f) GDPR). We do not use this data for advertising.
Security, fraud and abuse prevention, handling reports and blocks — legitimate interest.
To comply with legal obligations — Art. 6(1)(c) GDPR.
To use listings, photos and videos in Astride’s own marketing and communications — consent given through the Terms of service, which you can withdraw at any time.

Under the Swiss FADP the corresponding bases are Art. 31(2)(a) (contract), Art. 31(2)(c) (legal obligation), Art. 31(1) (overriding interest) and Art. 31(2)(b) (consent).

4. Who processes your data for us

We do not sell personal data. We rely on the following processors, each bound by a data processing agreement:

Supabase Inc. (Singapore; data stored in the EU, Frankfurt) — database, authentication, file storage, server functions. supabase.com/privacy
Cloudflare Inc. (USA; global network) — video hosting and delivery (Cloudflare Stream) and image delivery. cloudflare.com/privacypolicy
Expo Inc. (USA) — push notification routing, app builds and updates. expo.dev/privacy
Apple Inc. (USA) — push delivery on iOS (APNs), Sign in with Apple, Apple Maps, speech recognition on iOS. apple.com/legal/privacy
Google LLC (USA) — push delivery on Android (Firebase Cloud Messaging), Sign in with Google, Google Maps and address search (Maps Platform), speech recognition on Android. policies.google.com/privacy
Anthropic PBC (USA) — AI features: the Scout assistant, reading your free-text preferences, choosing video frames. Only the text or frames needed for the feature are sent; Anthropic does not use API data to train its models. anthropic.com/privacy
PostHog Inc. (data stored in the EU) — product analytics: which screens and features are used, with a pseudonymous user ID. posthog.com/privacy
Functional Software Inc., Sentry (USA) — crash and error reports with device and app data. sentry.io/privacy

Your data is also shared with other users as the Platform is designed to: your name and photo with people you send a request to or who send you one; your listing with everyone; your circle request, with your name, with people selling who are in the circle; your Dealing Stable with its verified people. We share data with authorities where the law requires it, with a successor in the context of a sale of the Platform, and with anyone else only with your explicit consent.

5. International transfers

Some processors are in the USA. Transfers outside Switzerland and the EEA rely on the EU–U.S. and Swiss–U.S. Data Privacy Framework where the recipient is certified (Apple, Google, Cloudflare, Anthropic, Sentry), otherwise on the EU Standard Contractual Clauses with the Swiss addendum, plus encryption in transit and at rest.

6. How long we keep data

Account data — for the life of the account; deleted within 30 days of deletion.
Listings, media, documents — until you remove them, or up to 30 days after account deletion.
Requests, matches, messages — up to 12 months after the last activity, then anonymised or deleted.
Circle requests and memberships, plans — for their term, then as needed for accounting.
Push tokens — until the app is uninstalled or notifications are turned off.
Analytics and crash data — up to 12 months, pseudonymous.
Server logs — up to 30 days. Backups — up to 30 days, rolling.
Records the law requires us to keep (accounting, evidence of consent) — as required by Swiss law, typically up to 10 years.

7. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing based on legitimate interest, to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. Much of this you can do in the app: delete your account in Account settings, remove listings in My Stable, change or delete your preferences, turn off notifications in your device settings, block people. For everything else write to support@astride.ch; we normally answer within 30 days.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EEA, to your national data protection authority.

8. Security

All data travels over TLS/HTTPS and is encrypted at rest. Passwords are stored as salted hashes. Database access is enforced by row-level security, so a user can only read what the Platform allows them to see. Authentication and chat endpoints are rate-limited; backups roll over 30 days; administrative access is restricted to the operator. No system is perfectly secure, but we review these measures continuously.

9. What we do not do

No advertising networks, no tracking pixels (Meta, TikTok, Google Ads), no sale of personal data.
No session recording or replay tools.
No decisions with legal or similarly significant effects made automatically about you. The match percentage sorts horses; it never blocks you from anything.
No third-party cookies on astride.ch beyond what the payment provider needs at checkout.

10. Children

The Platform is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has given us personal data, write to support@astride.ch and we will delete it.

11. Changes and contact

This policy is updated when the law or our processing changes; the current version is in the app under Legal and on astride.ch. Questions: Astride GmbH in formation (in Gründung), Im Rüeblig 2, 8117 Fällanden, Switzerland, represented by Manon Rudin, support@astride.ch.