Privacy Policy

1. Controller Identity and Contact Details

1.1 Data controller (B2C and certain B2B data)

1.2 Controller vs processor (B2B customer data)

• When a stable, riding school, or other organisation ("Customer") uses the Service to manage its operations, the Customer is typically the data controller for personal data about its staff, riders, horse owners, and other end users that the Customer inputs or otherwise provides ("Customer Data").
• In those cases, Stable acts as the Customer's data processor for Customer Data and processes it only on the Customer's documented instructions, as set out in our Terms of Service.
• Stable is an independent controller for certain data (e.g., account details, billing, security logs, and compliance).

If you are an end user invited by a Customer (e.g., a rider or horse owner) and have questions about the Customer's processing, you should contact the Customer first. You may also contact Stable at support@compact.se and we will help route your request.

2. How We Receive Personal Data

We obtain personal data:

• Directly from you (e.g., when you create an account, enter information, or contact us).
• From a Customer (e.g., when a stable adds you as a member, contact or horse owner).
• From Google, Apple or Facebook if you choose to sign in with them (your name, email address and an account identifier).
• Automatically from your device when you use the Service (e.g., IP address, device information and logs).
• From payment providers, about the status of payments (not full card details).

3. Categories of Personal Data We Process

3.1 Account data

• Name, email address and phone number (if provided)
• Profile information and preferences
• Role, permissions and organisation membership
• Sign-in details and security settings (passwords are stored only in hashed form)

3.2 Signing in with Compact Accounts

When you sign in or create an account, Stable passes your sign-in details, IP address and device information to Compact Accounts. Compact Accounts uses them to check who you are and to protect your account, for example by recognising devices you have used before. Stable receives your account identifier, name, email address and how you signed in.

3.3 Technical, usage and analytics data

• IP address, device, browser and app information, and device identifiers
• Logs of sign-ins, requests and security events
• Error reports
• Whether you are online and when you were last active, which members of your organisation can see unless the organisation turns this off
• A push notification token, if you turn on notifications in the mobile app

Product analytics. We use product analytics on stable.se, in the web app and in the mobile apps to understand how Stable is used and to improve it, for example which pages you view and which features you use. When you are signed in, analytics are linked to your account. On stable.se and in the web app, an approximate location (such as country and city) is derived from your IP address. In the EEA and UK, analytics are off until you opt in; elsewhere they are on until you turn them off. You can change your choice at any time in Settings → Privacy in the apps or with Cookie settings at the bottom of stable.se.

Advertising measurement.On stable.se and in the web app, we measure how well our own ads work with advertising partners such as Google and Meta. In the EEA and UK this is off until you opt in; elsewhere it is on until you turn it off. While it is on, we record which campaign or ad brought you to us (such as UTM tags and ad click identifiers) and store this with your account if you sign up. If advertising measurement is on for the owner of an organisation that starts a Stable subscription, we may tell Meta about the purchase using a hashed email address and account identifier. Compact Nordic AB and Meta Platforms Ireland Limited are joint controllers for collecting this data and sending it to Meta; Meta's own processing is covered by Meta's privacy policy. We do not sell personal data.

3.4 Content you or your organisation add

• Horses and their records
• Contact details of horse owners, staff and others
• Bookings, schedules, tasks and notes
• Messages, files and photos
• Events from a Google or Microsoft calendar you connect

3.5 Communication data

• Support requests and messages sent through the contact form on stable.se (your name, email address and message)
• Emails, push notifications and text messages we send you (your phone number if you turn on text messages), and their delivery status

3.6 Billing and transaction data

• Subscription plan, invoices and VAT/business information
• Payment status, amounts and limited payment details (e.g., the last four digits of a card)

Note: Payment card details are handled by our payment providers and are not stored by Stable.

3.7 Horse-related records

Horse health and veterinary records are about animals, but they may contain personal data, such as the names and contact details of owners, riders or veterinarians. Please don't enter sensitive information about people unless it is strictly necessary and you have a legal basis to do so.

4. Purposes of Processing and Legal Bases

Where Stable acts as a processor, the Customer determines the legal basis; Stable processes on the Customer's instructions.

Where we rely on legitimate interests, our interests are those described in the table: running a secure and reliable service, improving it, administering customer relationships, and measuring our marketing. You can object to this processing (Section 9).

4.2 Special category data (if processed)

Stable does not require special category personal data (e.g., human health data) to provide core functionality. If such data is nevertheless processed: for B2C, we rely on your explicit consent (Art. 9(2)(a)) where applicable; for B2B, the Customer is responsible for identifying a valid Art. 9 condition.

4.3 Do you have to provide personal data?

You need to provide your name and email address to create an account; without them we cannot provide the Service. Other information is optional unless your organisation asks for it. Some billing information is required by accounting law.

4.4 Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

5. Cookies and Similar Technologies

We use strictly necessary cookies and local storage to:

• Keep you signed in and your session secure
• Remember your settings and cookie choices
• Protect forms and sign-ins from abuse

On stable.se and in the web app, we also use consent-based cookies and similar technologies for two separate purposes you can accept independently:

• Analytics — product analytics (Section 3.3).
• Marketing — measuring our ads with advertising partners such as Google and Meta, including campaign and ad click identifiers. These partners may read the cookies they set.

Non-essential cookies last no longer than one year, and your cookie choices are remembered for 180 days.

In the EEA and UK these non-essential cookies are off by default and load only after you opt in. We show a cookie consent banner to visitors in those regions. You can change or withdraw your choices at any time: on stable.se with Cookie settings at the bottom of every page, and in the web app in Settings → Privacy.

The mobile apps do not use cookies for analytics or advertising. When the region in your device's language settings is in the EEA or UK, they ask for your permission before sending product analytics, and you can turn analytics off in Settings at any time.

6. Sharing and Disclosure of Personal Data

We share personal data only when necessary to provide the Service, comply with law, or protect rights and security.

Categories of recipients:

• Other members of your organisation, according to the roles and permissions the organisation sets
• Service providers that help us run the Service: hosting and infrastructure, security, message delivery (email, push notifications and text messages), error monitoring and product analytics, customer support and communication tools, and map, address and weather lookups
• Payment providers, which process payments for us and may process payment data as independent controllers
• Advertising partners such as Google and Meta, while advertising measurement is on (Section 3.3)
• Google, Apple or Facebook when you choose to sign in with them, and Google or Microsoft when you connect a calendar
• Services your organisation chooses to connect, such as its own webhooks
• Professional advisers (lawyers, auditors) under confidentiality
• Authorities or law enforcement when legally required
• Potential acquirers/investors in a business transaction (subject to confidentiality)

If you ask, we will tell you which recipients your personal data has been shared with (Section 9). We do not sell personal data.

7. International Transfers

Some of our service providers process personal data outside the EU/EEA, for example in the United States. When they do, we rely on a European Commission adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses (Art. 46).

You can ask for information about these safeguards, or a copy of them, by contacting support@compact.se.

8. Retention Periods

We keep personal data only as long as necessary for the purposes described above, then delete or anonymise it, unless longer retention is required by law.

When your account is permanently deleted, logs and records that mention you are removed when their own retention period ends.

9. Your Rights (GDPR) and How to Exercise Them

Depending on context (controller/processor) you have the right to:

• Access: obtain confirmation and a copy of your personal data (Art. 15)
• Rectification: correct inaccurate or incomplete data (Art. 16)
• Erasure: request deletion in certain cases (Art. 17)
• Restriction: restrict processing in certain cases (Art. 18)
• Portability: receive data you provided in a structured, commonly used format (Art. 20)
• Object: object to processing based on legitimate interests (Art. 21)
• Withdraw consent: where processing is based on consent, at any time (Art. 7(3))

How to exercise:

• Email support@compact.se with your request and the email tied to your account.
• We may ask you to verify identity before fulfilling the request.
• We respond without undue delay and normally within one month.

9.1 Right to lodge a complaint

You have the right to lodge a complaint with a data protection authority, in particular in the EU/EEA country where you live or work or where you believe your rights were infringed. Our lead authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY"):

• Website: imy.se
• Address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden

10. Security Measures

We use technical and organisational measures appropriate to the risk to protect personal data, such as encryption in transit, access controls and logging. No method of transmission or storage is completely secure.

11. Children and Minors (Junior Riders)

• Age thresholds: Users must be at least 13 (or older where local law requires) to create a standalone account, and users under 18 should have permission from a parent/guardian.
• B2B context: If a Customer creates accounts for minors (e.g., junior riders), the Customer is responsible as controller for ensuring a valid legal basis, providing notices, and obtaining any required parental consent.

12. Data Return, Export, and Deletion

• B2B Customers:For 30 days after a Customer's agreement ends, the Customer can ask us for a copy of its Customer Data in a commonly used, machine-readable format. After that we delete or anonymise Customer Data, except where we must keep it for legal obligations, security, or dispute resolution.
• B2C users: You can request a copy of your data by contacting support@compact.se. You can delete your account in the in-app account settings or request deletion through the public account-deletion page. An in-app deletion request deactivates the account immediately and signs out active sessions. Permanent deletion follows after a 30-day recovery period; signing in during that period restores the account. Deleting a user account does not cancel an organisation's subscription. Records that must be kept for legal, accounting, security, or dispute-resolution purposes are kept for the periods in Section 8. The Compact account you sign in with can also be used with other Compact apps, so it is not necessarily deleted with your Stable account; you can ask us to delete it at support@compact.se.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service, legal requirements, or our practices. We will post the updated version on stable.se and update the date below. If changes are material, we will provide additional notice where appropriate.

14. Contact

For privacy questions or to exercise your rights:

support@compact.se