Privacy policy

1. About this policy

Stally helps you gather your horses’ information, plan training and share the work of the stable. This policy describes how Stally AB processes personal data when you use the mobile app, the websites stallyab.se and www.stallyab.se, the web console, the payment functions or our support.

The policy applies to you if you hold an account, are a paying customer, visit the website, contact us, or appear in information someone else enters — as a guest in a stable, for example. It explains where the data comes from, the purposes, the legal bases, the recipients, retention and your rights.

Personal data is information that can be linked to a living person. A horse’s health information is not in itself sensitive health data about a human being under the GDPR. Horse profiles, photographs and logs can nonetheless be personal data where they can be linked to an owner or a rider, for example.

This policy is information. Using the app or accepting the terms of service does not mean you consent to all processing. Where processing rests on consent, that choice is to be given separately for the purpose in question.

2. Who is responsible and how to contact us

Stally AB, company registration number 559600-9752, is the controller for the processing where we determine the purposes and the means — our own accounts, customer relationships, payments, support and security, for example.

Email for data protection matters: support@stallyab.se. Contact person: Linus. Postal address: Kvänum Smedjegården 5, 535 91 Kvänum, Sweden. Naming a contact person does not in itself appoint a formal data protection officer.

Where a customer uses Stally to administer their own operation, the customer may be the controller and Stally the processor. That holds for such processing even though every person has their own account. See section 6 and the data processing agreement in annex 1 to the terms of service.

3. What we process and where it comes from

Account, profile and age

We process name, email address, account identifier and authentication data. Address and customer details are given in the registration or purchase flows that ask for them. Telephone number and profile picture are optional. We also process a full date of birth — year, month and day — which you state yourself, to determine age and access to the AI functions.

With Google or Apple sign-in we receive what the provider supplies for the authentication: name, email address and a provider-specific identifier, for example. Apple may supply a relay address if you hide your email. Technical authentication data can include the sign-in provider, a profile picture link, when the account was created, the last sign-in and access tokens. We do not receive your password at Google or Apple.

Horses, training and calendar

You and the people who share a horse can enter a horse profile, ownership links, training history, goals, diary notes, the horse’s care and health information, events, photographs, video and documents. The material can identify whoever owns, rides or looks after the horse. If you choose to connect Google Calendar, the permissions, access data and calendar entries needed for the connection are processed.

Stables, groups and communication

We process memberships, roles, scheduled duties, responsible people, guest members, notices, comments, group events and chat messages. The information comes from you, from stable administrators and from other users who share information or communicate with you. An administrator can enter a guest member who has no account of their own.

AI planning

When the AI planner is used, the relevant horse profile, the horse’s logs, free-text goals, time budget, training days and the training plans produced are processed. Replanning may include further free text. Section 7 sets out what is sent to Google. A separate AI chat is switched off as at the date of this version.

Purchases, customer relationship and accounting

We process the payer’s name and contact details, billing address, organisation details where the customer is an organisation, subscription, licence scope, payment status, amounts and transaction references. The information comes from the customer and from Stripe. Customer, invoice and payment records are also transferred to Fortnox for accounting. Stally does not store full card details in the app’s own customer database.

Technology, crash reports and acceptance of the terms

Technical data can include IP address, time, app and browser information, operating system, device model and identifiers for an installation or a session. Crashlytics is used for error reporting in the iOS and Android app, as described in section 11. We do not use Google Analytics or Firebase Analytics in the app or on the website.

When you accept the terms of service, we record which account accepted, when, and the document version. Where you ask for the subscription to begin during the withdrawal period, documentation of that request and the information given is also processed. On withdrawal we process the message, the relevant subscription and timing details, and the basis for proportionate compensation and refund. Cookie choices on the website are handled separately under the cookie policy.

Support and cases

We process messages, contact details, attachments and whatever is needed to look into support, reported content, security matters or rights requests. Do not include more personal data than the matter requires. We do not collect GPS position or riding routes as part of the service described; an approximate location can nonetheless be inferred from an IP address, for example.

4. Why we use the data, and the legal bases

Processing needs a legal basis under the GDPR. The same data can serve several distinct purposes. An agreement with one person does not automatically provide a basis for processing data about another.

Account and requested functions: account, profile and function data are used to authenticate you and to provide the horse, calendar, training and collaboration functions. Where the processing is necessary for a valid agreement with you, Article 6(1)(b), contract, applies. For administering an organisation customer’s representatives and contacts, Article 6(1)(f), legitimate interests, applies, the interest being to administer the customer relationship. Where Stally is a processor, the customer determines the legal basis for its processing.

Age limit: the date of birth is used to calculate age and to restrict access to the AI functions. The interest is upholding the service’s age limits and protecting younger users, Article 6(1)(f). The data is not used as proof that identity or age has been verified. Children’s interests are to weigh particularly heavily in that assessment.

AI training plans: the material needed for a plan is processed when an authorised user requests the function. Contract, Article 6(1)(b), covers the necessary processing of the contracting user’s data. Personal data about other people written in free text is not automatically covered by that basis and should not be entered unless it is needed and may lawfully be processed.

Subscription and payment: customer and transaction data are used to perform the order, Article 6(1)(b) for a consumer customer. Processing needed to give effect to the statutory right of withdrawal and refund rests on Article 6(1)(c); material needed for possible legal claims is handled under the heading on legal claims below. Organisation contacts are handled under Article 6(1)(f). Accounting and the statutory retention of accounting records rest on a legal obligation, Article 6(1)(c).

Support and administration: contract-related help rests on Article 6(1)(b) where the conditions are met. Other questions, documentation of acceptance of the terms, and management of the customer relationship rest on Article 6(1)(f), the interest being to answer questions, perform the relationship and be able to show what the parties agreed.

Security and troubleshooting: relevant technical data and error reports are used to detect faults, prevent misuse and keep the service secure and stable. For the processing of personal data the intended basis is Article 6(1)(f), legitimate interests. That basis presupposes that the processing is necessary and that our interests do not weigh lighter than your rights. Separate rules on storing or reading information on your device apply in addition; accepting the terms of service is not such a consent. Crashlytics’ current collection is described in section 11.

Legal claims and obligations: necessary case and contract material may be processed under Article 6(1)(f) to establish, exercise or defend legal claims, or under Article 6(1)(c) where a specific legal requirement applies.

Optional heartbeat on the website: storing and reading take place after active consent. In so far as personal data is processed for that optional function, Article 6(1)(a) applies. Necessary storage of the sign-in and of the cookie choice serves other purposes and is handled separately in the cookie policy.

You can object to processing based on legitimate interests and ask for information about the balancing. A consent can be withdrawn. An objection or withdrawal is assessed for the processing in question and does not automatically end all other processing.

5. What other users can see

In the stable and group functions, authorised participants can see your name, your profile picture, your horses in the stable and your telephone number if you add one. The stable administrator does not gain access to your email address or your date of birth through member administration. Information can still become visible if you write it yourself in a chat, a notice or other free text.

Administrators can manage members, roles, responsibilities and shared information. Schedules, notices, comments and messages are shown according to the permissions of the function. When you share a horse, the horse’s information and earlier history travel with it, including logs, care events and uploaded material.

Leaving a stable does not automatically end membership of its group chats. A remaining group membership gives access to that chat, but not to the stable’s other protected information. The group administrator can remove a person separately. A group chat can remain for its participants even when the group or the stable itself is deleted.

Anyone who has received a message or shared material may have read or copied it. A changed permission does not recall copies already made outside Stally. Deletion within Stally is described in section 10.

6. Organisation customers and people without an account

Where a customer determines why and how personal data is used in the customer’s operation — for staff, riding school pupils or guests, for example — the customer is responsible for that processing. Stally is the processor to the extent we process the data on the customer’s behalf. Annex 1 to the terms of service governs that engagement.

The customer is then responsible for the legal basis, for informing the people concerned and for instructions to Stally. Stally at the same time has its own obligations as a processor and is independently responsible for its own processing, such as accounting and customer administration.

You have rights even if you are only recorded as a guest member and have no account of your own. Contact the responsible customer about the customer’s processing, or write to support@stallyab.se and we will help you find the right contact. We handle requests concerning our own processing.

7. How the AI planner processes information

Stally uses the Gemini Developer API through Firebase AI Logic, with the model gemini-2.5-flash in the configuration described. The app sends the request to Google’s service to generate training suggestions. It is not a separate Stally server that performs the model processing.

The active planner is sent:

• the horse’s name, breed, age, height and temperament; • the horse’s logs, including free text; • the user’s free-text goals, available time and chosen training days; • on replanning, the relevant week or day and any further instruction.

The planner does not send the user’s name or email as separate fields, and does not send photographs or video in the flow described. Free text can nonetheless contain such information. Google additionally receives technical data about the call, such as IP address and app identifier.

Do not enter sensitive personal data about people, private contact details or unnecessary information about others in the AI material. Write first and foremost about the horse and the training. A horse log may be included even if it was written on an earlier occasion.

Generated plans are stored in Stally’s Firestore database until they are deleted or covered by deletion of the account. The AI requests themselves are not stored separately by Stally as a query history for the planner; the original horse logs and other information can of course remain in their ordinary functions.

Stally uses the API project with billing enabled. Under Google’s terms for the paid Gemini Developer API service, prompts and responses are not used to improve Google’s products. That does not mean no storage occurs: Google may process and temporarily store the material to deliver the service and for abuse and security checks. Google’s published abuse-monitoring rules state 55 days’ retention of prompts, context and responses; authorised staff can review flagged material. Other legal obligations may affect the handling.

AI planning produces suggestions that the user assesses. The function described does not itself take decisions with legal or similarly significant effects for the user. AI can give incorrect suggestions and does not replace professional judgement.

8. Suppliers and other recipients

We disclose data to suppliers to the extent their engagement requires. A supplier can be a processor for one activity and an independent controller for another. We do not sell your personal data.

Google and Firebase: authentication, database, files, server functions, push, AI planning and Crashlytics. Depending on the service, account, horse and stable content, messages, files, AI material or technical diagnostics are processed.

Google and Apple for sign-in: identity and connection data when you choose their sign-in. Each provider may process data for its own purposes under its own terms.

Google Firebase Cloud Messaging and Apple APNs: delivery of push notifications. Chat notifications can contain the sender’s name and the whole message text, which then passes through these services. Notification settings on the device govern how the content is displayed to you, on the lock screen for example.

Google Calendar: if you choose to connect the calendar, the Google Calendar API is used together with the calendar data and access permissions the connection needs. You can manage granted access in your Google account.

Stripe: payment, subscriptions and the customer portal. The data covers payer, billing, subscription and transactions. Stripe may also be an independent controller for its own security and compliance purposes, for example.

Fortnox: customer, invoice and payment records for accounting and financial administration.

Vercel: operation of the website and the web console, together with technical connection data such as IP address and request information. Strato: email handling, including contact details, messages and attachments in support cases.

Authorities, courts and advisers: data may be disclosed where required by law or a binding decision, or where necessary for a legal claim. Disclosure is limited to the relevant purpose.

9. Where data is processed, and transfers

The main database is in Firestore eur3 within the EU. Photographs and video are stored in Helsinki, europe-north1, and Cloud Functions run in Belgium, europe-west1. The email service at Strato is handled in Germany according to the documentation.

Not all processing takes place within the EU. Firebase Authentication, Gemini and push delivery use global infrastructure. Crashlytics processes data in the United States. Vercel uses a global network. Other recipients and their support or sub-suppliers may also process data outside the EU/EEA. An EU region for the database does not mean that all access and further processing is confined to the EU.

Transfers outside the EU/EEA must have a valid basis under the GDPR. Applicable safeguards can be an adequacy decision or the EU standard contractual clauses together with the assessments and supplementary measures required. The EU-U.S. Data Privacy Framework can be relied on only where the particular recipient is certified and the processing falls within that certification. A general statement that a group is certified does not replace checking the specific transfer.

Contact support@stallyab.se for information on which safeguards apply to a particular recipient, and to request the relevant contractual documentation or a copy of the safeguards, with the protection necessary for other people’s data and for confidentiality.

10. Retention, closure and deletion

Data is not to be kept longer than it is needed for a stated purpose. Retention depends on the status of the account or customer relationship, what the function needs, rights requests, outstanding matters and applicable legal requirements.

Accounts, stables and missed payment

During active use we keep the account, the date of birth and the content needed for the functions you use. When a subscription ends, the paid functions concerned are locked. The account or stable can be reactivated for as long as the information remains. Account deletion settings are available even when the paid functions are locked. You can also request deletion through support.

On ordinary termination the starting point is 30 days’ retention after the end of the paid period, if the subscription is not reactivated and you do not ask for earlier deletion. On missed payment, the account or stable concerned may be deleted no earlier than 30 days after the missed payment. This is handled manually per customer; there is no fixed automatic deletion day for these cases. That minimum period is not a general right to keep data indefinitely. Continued retention must be necessary and have a legal basis.

A separate active Premium subscription and private information outside the stable are not affected by a stable being deleted. When a personal account is deleted, your own horses, plans, diary and other personal content are removed under the deletion flow. If others had access to those horses through sharing, they lose that access too. Horses owned by others are not deleted merely because your account is closed.

Shared data and remaining chats

Leaving a stable removes the stable membership but does not automatically delete historical scheduled duties, notices or comments. Group membership is handled separately under section 5.

Messages to other users, and your name as the sender, can remain after the account has been deleted. When a group or a stable is deleted, the group chat can still remain and be accessible to its remaining participants. There is no fixed, general deletion period for such remaining chats in the configuration described.

Continued retention has to be assessed against the need for conversation history, the participants’ rights and any organisation customer’s responsibility. We consider a request for deletion or an objection for this data too. That others take part in the chat does not automatically mean all personal data about you may be kept. Data is to be deleted, de-identified or restricted when there is no basis for continued processing.

Other retention periods

Accounting: accounting records are kept through the seventh year after the end of the calendar year in which the financial year closed. That covers the necessary accounting material, not the whole app account. Customer and payment references at Stally, Stripe and Fortnox can therefore remain after account deletion to the extent the purpose requires.

Crashlytics: crash traces, associated identifiers and derived data are stored by Firebase for 90 days before the deletion process begins. That is not a promise that every copy is finally deleted on day 90 exactly. No export to BigQuery or another analytics store is used in the configuration described.

Gemini: security retention at Google is described in section 7. Deleting an account in Stally does not automatically delete those supplier logs immediately. Cookie choice: under the cookie policy the choice is kept for six months. Heartbeat: the local record has no automatic expiry, as stated in the cookie policy.

Support, reports and acceptance of the terms: retention is assessed against the ongoing matter, the need for documentation and relevant legal claims. Only necessary data is to be kept. A report may need to remain even if the person reported deletes their account, but that does not permit unlimited retention without assessment.

Technical deletion and recovery

When deletion is carried out in the active systems, the suppliers’ technical deletion processes can take further time. Firestore has short-lived version retention of about an hour. Deleted photographs and video can be covered by Cloud Storage’s deletion protection for seven days. The supplier’s technical deletion process applies thereafter; Google’s published process can, in the applicable services, take up to around 180 days. This is not a general retention period for all data, nor permission to continue using deleted content.

There is no separately configured Firestore backup or point-in-time recovery in the environment described. Data awaiting final technical deletion is to be protected and not used for new purposes. A rights request is handled within the time limits in section 14, even where the underlying technical deletion runs on its own course.

11. Website storage, Crashlytics and communication

The website

We do not use Google Analytics, Firebase Analytics or equivalent advertising pixels in the arrangement described. The website uses necessary session storage for signing in, and storage to remember your cookie choice. Firebase heartbeat for technical usage statistics is used only after active consent. You can decline or withdraw that choice and still sign in and buy a subscription.

See the cookie policy at stallyab.se for the entries, purposes, retention periods and how to change your choice. The website’s cookie choice does not automatically govern Crashlytics in the mobile app.

Crashlytics in the mobile app

Firebase Crashlytics is used in the iOS and Android app to detect crashes and other reported errors, including failed data loading. Collection begins when the app starts, before any separate consent choice, and cannot be switched off by the user in the current version. The website does not use Crashlytics.

Reports can contain installation and session identifiers, identifiers used to avoid duplicate reports, the time of the crash, stack traces, class and function names, error messages and technical information about the app, the device and the operating system. Examples are app version, device model, CPU architecture, memory, storage space, root or jailbreak status, screen rotation and whether the app was in the background. The exact content depends on the platform and the type of error. For applicable Android NDK crashes, raw minidump data may be processed temporarily and discarded after processing.

Stally does not set a particular user ID in Crashlytics and does not send its own user logs in the configuration described. Error messages can nonetheless contain, for example, a database path including an account ID. The data is therefore not guaranteed to be anonymous. The purpose and intended legal basis are described in section 4 and the retention in section 10.

Messages from Stally

We may send messages needed for the account, subscription, payment, support and security. These are not a general permission for marketing. If we offer optional newsletters or other consent-based mailings, a separate choice is to be made, with the ability to unsubscribe. You can always object to direct marketing.

12. Protecting the data

We use authentication and permission rules for private data, stables and groups. Administrative changes require the right role, and subscription data is protected by server-controlled write permissions. Stally’s privileged project accounts are protected with two-step verification.

Authorised people within Stally and relevant suppliers can have technical access to data, including files and chats, where needed for operation, support or security. Access is to be limited to the task. Stally’s administrators hold extensive technical permissions; the service is not a promise that Stally has no technical ability to read content.

We are to protect data against unauthorised access, loss and alteration with technical and organisational measures matched to the risk. In the event of an incident, the GDPR’s requirements on investigation, documentation and — where the conditions are met — notification and information to the people concerned apply.

13. Children and young people

You must be 13 or over to create and use a Stally account. The AI functions are intended only for people aged 18 or over. The user is responsible for giving their real date of birth. Anyone who states an age under 18 is not given access to the AI planner in the app’s interface. The information is self-declared and does not mean the age has been verified against an identity document.

A guardian is to make the purchase of a private subscription for a minor. The payment agreement and the young person’s personal data are separate questions. A guardian’s purchase does not amount to consent to all processing of the child’s data.

If the date of birth is wrong you can contact support for correction, even where it cannot be changed in the app yourself. If we become aware of use by a child below the permitted account age, we look into the situation and handle the account and the data according to the applicable requirements.

An organisation customer can record information about younger pupils or guests without them having their own account. The customer must then assess its legal basis, inform those concerned and pay particular attention to the protection of children. Write to us if you would like a simpler explanation of this policy.

14. Your rights

You can contact support@stallyab.se to exercise the following rights. Which conditions apply depends on the processing and its legal basis.

Access: to learn whether we process data about you, to receive information and a copy of the data. Rectification: to have inaccurate data corrected and incomplete data completed where needed. Erasure: to request that data be removed, for example where it is no longer needed or lacks a legal basis. Exceptions can apply for legal requirements or legal claims.

Restriction: in certain situations, to have the use of data restricted, for example while accuracy or an objection is being examined. Objection: to object to processing based on legitimate interests, on grounds relating to your situation. We then assess whether there are compelling legitimate grounds to continue. Direct marketing is to cease on objection.

Data portability: where the conditions in law are met, to receive data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller. Withdrawing consent: to change a consent-based choice at any time. That does not affect lawful processing before the withdrawal.

An automatic export function is not a precondition for requesting access or portability. We can produce material manually and provide it securely after the necessary identity and authorisation check. The stable schedule can also be downloaded as a PDF through the available export function. A schedule PDF does not replace a full rights request.

We respond without undue delay and normally within a month. Where the conditions in law are met, that period may be extended by at most two further months; we then inform you of the reasons within the first month. Requests are normally free of charge. Only in the exceptional cases the GDPR allows may we charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

If we have reasonable doubts about your identity we may ask for the further information needed, but no more than is necessary. If we do not accede to a request we explain the reasons and inform you of the possibility of complaint and judicial remedy. For processor activities we help by directing you to the responsible customer.

You have the right to complain to the Swedish Authority for Privacy Protection, IMY, at www.imy.se, or to another competent supervisory authority. You do not have to contact Stally first. The GDPR also gives protection against certain decisions based solely on automated processing; the AI planning described produces suggestions that you assess yourself.

15. Changes and external services

The current policy is available at stallyab.se with its version date. On material changes we inform those concerned in an appropriate way. Where new purposes or consents are needed, the required information and choices are given before that processing begins.

External sign-in, payment and calendar services may also process data under their own responsibility. Read their privacy information. This does not remove Stally’s responsibility for our own processing or for the processors we engage.

Questions and rights requests go to support@stallyab.se. State which function or which data the matter concerns, and avoid sending sensitive material or identity documents unless needed for an agreed secure check.