Legal

Data Processing Agreement

DRAFT — version 0.1-draft

⚠️ This is a draft. The legally-reviewed version will replace this at public launch.

Context

You (the user) are the data controller for your customers' personal data. HoofSpectrum acts as your data processor under GDPR Art. 28.

1. Scope of processing

HoofSpectrum processes customer data (names, addresses, contact info) and horse data (names, breeds, evaluation records, photos) on your behalf, for the purpose of providing the evaluation and booking service.

2. Sub-processors

We use the following sub-processors:

  • Supabase (EU North 1, Stockholm): hosting, database, authentication and file storage
  • Scaleway (Paris, France): email delivery for booking confirmations and reports (Transactional Email) and object storage for photos uploaded through the web app (Object Storage)
  • Stripe: payment processing for the subscription (card details are held by Stripe, never by us)
  • Sentry: crash reporting from the app, with personal data scrubbed before sending (storage region: EU, Frankfurt)

Each provider in turn engages its own sub-processors, bound by the same data protection requirements through that provider's data processing agreement. For example, all traffic to Supabase passes through Cloudflare, which is a Supabase sub-processor. The full chain is in the providers' own lists: Supabase, Scaleway, Stripe and Sentry.

We will notify you of any changes to sub-processors with 30 days' notice.

3. Security measures

  • TLS encryption in transit
  • Encrypted at-rest storage in Supabase
  • Encrypted local SQLite via SQLCipher on devices
  • Row Level Security policies isolate customer data per user

4. Data retention

Customer data is retained as long as your account is active. Upon account deletion or your request, customer data is hard-deleted within 30 days. See the account deletion page.

5. Your obligations as data controller

  • Inform your customers that you use HoofSpectrum to manage their data
  • Have a lawful basis for processing their data (typically contract or legitimate interest)
  • Respond to data subject rights requests from your customers (we provide tools for export and deletion)

Version 0.1-draft · Last updated 2026-09-29