This is an English translation provided for convenience; the French version is the legally binding reference.
We look after your data as carefully as your horse's. Here is, in plain language, what we collect, why, with whom, and your rights.
Data controller
The data controller is Pricillia ROLL (trade name “LUMA LAB”), 52 avenue Comtesse de Ségur, 31590 Verfeil, France. Contact: galoplan.com@gmail.com.
Data we collect
- Account: email address, first name, password (encrypted), profile photo (optional), and, if you sign in with Google, the basic information of your Google account.
- Content you create: horse profiles, schedule, log (training, care, meals), appointments, lessons, competitions, team messages, photos and videos, usage rules, health data (vaccinations, documents, weight).
- Subscription: for the paid plans, billing and payment information is processed by Stripe. We never store your bank card number.
- Technical data: connection logs, device and browser type, required for proper operation and security.
- Visit origin: how you arrived on the site (campaign parameters, referring site) to understand how you heard about us.
- Audience measurement and advertising: only with your consent (see our cookie policy).
Why and on what legal basis
- Provide the service (account, sharing, schedule, messaging, etc.), performance of the contract.
- Send useful emails and notifications (invitations, appointment reminders, summaries), performance of the contract and legitimate interest.
- Ensure security and prevent abuse: legitimate interest.
- Bill paid subscriptions: performance of the contract and legal obligation (accounting).
- Newsletter, audience measurement and advertising: your consent, which you can withdraw at any time.
Who has access to your data
We do not sell your data. Your content is only visible to the members you invite to a horse. To run the service, we rely on providers (processors) that act only on our instructions:
- Supabase : Database and authentication (account, horses, log, messages). (Union européenne (Irlande))
- Vercel : Application hosting and technical logs. (États-Unis (Data Privacy Framework / clauses types))
- Resend : Sending emails (invitations, reminders, newsletter). (États-Unis (clauses contractuelles types))
- Stripe : Payment of paid subscriptions (Cavalier, Écurie). (Irlande / États-Unis (Data Privacy Framework))
- PostHog : Product audience measurement (only with your consent). (États-Unis (clauses contractuelles types))
- Giphy : GIF search in the team messaging. (États-Unis)
- Open-Meteo : Stable weather (based on the address you enter). (Union européenne (Allemagne))
- OpenAI, Anthropic : Writing blog articles and illustrations (no user data). (États-Unis)
- Google, Meta : Advertising and campaign measurement on the marketing site (with your consent). (États-Unis (Data Privacy Framework))
Transfers outside the European Union
Your account and content data is hosted in the Union européenne, Irlande (région eu-west-1). Some providers are located outside the European Union (in particular in the United States). These transfers are governed by appropriate safeguards: Data Privacy Framework membership and/or the European Commission's standard contractual clauses.
How long we keep it
- Account and content: for as long as your account (or the horse profile) is active. On deletion, the associated data is erased from the application database.
- Billing: accounting documents are kept for 10 years, as required by law.
- Newsletter: until you unsubscribe.
- Technical logs: for a limited period, for security and diagnostics.
Your rights
In accordance with the GDPR, you have the following rights:
- Access to your data and a copy of it.
- Rectification of inaccurate data.
- Erasure (the “right to be forgotten”).
- Restriction of or objection to certain processing.
- Portability of your data.
- Withdrawal of your consent at any time (newsletter, cookies).
To exercise these rights, write to us at galoplan.com@gmail.com. You can also delete your horse or your account yourself from the settings. If you believe your rights are not being respected, you can refer the matter to the CNIL (cnil.fr).
Security
Access to data is protected at the database level (Row-Level Security rules), passwords are encrypted and exchanges are encrypted in transit. For more details, see our Trust & security page.
Minors
GaloPlan is intended for adults. A parent or guardian may add a child as a member of a horse (for example for a part-loan) under their responsibility.
Changes
This policy may change. In the event of a significant change, we will inform you through the application or by email.