Privacy policy

At Aubère, we take your data seriously. This page simply explains what information we collect via the aubere.co website and the Aubère app, why, and what your rights are. All in compliance with the UK GDPR and the EU General Data Protection Regulation (GDPR).

1. Data controller

The controller responsible for processing your data is Léo Guenoun (who operates Aubère). For any question relating to your data: contact@aubere.co.

2. What data we collect

When you fill in the contact form, we collect:

• your title (optional)
• your first name and surname
• your email address
• how you ride and how you heard about Aubère (optional)
• any message you leave us

Apart from this form, the site measures its traffic in an anonymous and cookie-free way (see the cookie policy). No data that could identify you is collected in the process.

3. Why we collect it (purposes)

• to reply to you by email
• to send you news about Aubère if you asked us to
• to talk with you about the service and gather your feedback

4. On what legal basis

Processing is based on your consent, given by ticking the box provided in the form. You can withdraw it at any time (see the "Your rights" section).

5. Who has access to your data

Your data is never sold or shared for commercial purposes. It is only:

• received by email at contact@aubere.co, read by Aubère
• routed by our email-sending provider Resend, acting as a processor
• the site itself is hosted by Vercel

As Resend and Vercel are companies established in the United States, a transfer of data outside the UK and the European Union may take place, under the appropriate safeguards (the UK International Data Transfer Agreement / Addendum and the European Commission's standard contractual clauses).

6. How long we keep it

Your contact data is kept for a maximum period of 3 years from our last exchange, before being deleted. You can request its deletion at any time.

7. Analytics

To understand how the site is used, we use two tools:

• Vercel Web Analytics — cookie-free and anonymous, always on; it collects no data that could identify you
• Google Analytics — which sets cookies and is only activated with your consent (via the banner shown on your first visit). If you accept, browsing data is processed by Google LLC, a company established in the United States, under the appropriate safeguards. You can refuse or change your choice at any time; see our cookie policy

8. Your rights

Under the UK and EU GDPR, you have the following rights over your data:

• the right of access and rectification
• the right to erasure (deletion)
• the right to object and to restriction
• the right to portability of your data
• the right to withdraw your consent at any time

To exercise these rights, email us at contact@aubere.co. You can also lodge a complaint with the ICO (the UK data protection authority) or, if you are in the EU, with the CNIL.

9. The Aubère app (iOS, Android and web)

This section describes the data processed by the Aubère app (iPhone and Android mobile app, and the web version app.aubere.co). The data controller is the same (section 1).

Data collected

• Account: email address, password (encrypted, never readable), or Apple / Google sign-in; first and last name (optional).
• Rider profile: photo, level, yard, disciplines, goals.
• Horses: name, breed, photos, care and appointments (vet, farrier…), professionals' contacts, imported documents.
• Sessions and competitions: type, duration, location, content, feelings, notes, photos, videos, results, judge's sheets.
• Budget: the expenses you enter (amount, category, date).
• Location: only while recording a hack or a live session (GPS track, speed), including with the screen locked. No collection outside a recording you started.
• Motion sensors (iPhone): accelerometer and gyroscope during a session or hack recorded live, to detect gaits (walk, trot, canter).
• Health and activity data: see below.
• Product analytics: pages viewed and features used, aggregated, via PostHog (hosted in the European Union). The content you enter is never sent to it.

Health and activity data (Apple Health / Health Connect)

Only if you allow it, the app reads from Apple Health (iPhone) or Health Connect (Android): your workouts (type, date, duration), your heart rate, your active and total calories, and your step count.

• This data is used only to complete your sessions in Aubère (duration, heart rate, calories).
• The app reads this data and never writes it. Only the values you import into a session are saved, with that session.
• It is never sold, shared with third parties, used for advertising, or sent to our analytics tool.
• Processing is based on your explicit consent (GDPR art. 6.1.a and 9.2.a). You can revoke access at any time in Apple Health or Health Connect.

Purposes, legal basis and retention

• Providing the service (account, horse tracking, sessions, competitions, care, budget): performance of the contract.
• Location, motion sensors, health data, notifications: your consent, revocable in your phone settings.
• Improving and securing the app: legitimate interest.
• Your data is kept while your account is active, then deleted within 30 days of account deletion. You can delete your content at any time in the app.

Hosting and processors

App data is hosted by Supabase (database, files, authentication) and the web app by Vercel. Some providers may process data outside the European Union, with appropriate contractual safeguards. We do not sell or rent your data, and we use no advertising trackers.

The detailed app policy is also available in the app (Settings → Privacy policy).

10. Age

Aubère is not intended for children under 13 (the age of digital consent in the UK). We do not knowingly collect data from anyone under 13; if you believe a child has given us their data, email us and we will delete it.

For users in the United Kingdom, the English version of this policy applies. For users in France, the French version applies.