Privacy Policy

1. Introduction

Horsify Pty Ltd (ACN 693 058 383, ABN 63 693 058 383) of 3711 Goodwood Road, Elliott QLD 4670, Australia ("we", "our", or "us") operates the website https://www.horsify.com.au and the Horsify mobile applications for iOS and Android (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile applications, or use our services. References to the "Service" in this Privacy Policy apply equally to the website and the mobile applications unless stated otherwise.

We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

New Zealand: a New Zealand version of this policy, prepared under the Privacy Act 2020 (NZ), is being prepared — see the draft New Zealand Privacy Policy (pending legal review; this policy applies until it is in force).

2. Information We Collect

2.1 Personal Information You Provide

We may collect the following personal information when you use our Service:

• Name and contact details (email address, phone number)
• Account credentials (your email address and password, any passkey you add, and your two-step verification settings)
• Payment and billing information (processed and stored by Stripe)
• Horse and rider information (names, registration numbers, competition history)
• Linked rider information (when you register a minor in your care, or an adult who has consented to being managed by your account): name, date of birth, relationship to you, the type of link, and any relevant medical notes or disability information you choose to provide
• Horse nomination details for event entries, including name, breed, and sex of horses you nominate (including horses not already registered on your profile)
• Horse health and movement declaration details, where you complete one for an event. This may include horse identification (name, breed, colour, sex, age, microchip number, registration number); the name, phone number, email, and address of the person responsible for the horse; origin and destination property details and Property Identification Codes (PICs); movement purpose, dates, transport details, and recent movement history; Hendra virus vaccination status; cattle tick treatment details; your responses to event-day health questions; the legal name you sign with; and a record of the date, IP address, and browser/device (user agent) used at the time of signing, kept as an audit trail of the declaration
• Organisation and venue details for event organisers
• Bank account details for event organisers who choose to accept bank transfer payments (account name, BSB, account number, bank name — stored in encrypted form)
• Communications and correspondence with us (email, SMS, support tickets)
• Verification codes for email and mobile phone verification

2.2 Information Collected Automatically

When you access our Service, we may automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, links clicked, features used)
• Authentication cookies for session management
• JWT tokens stored in secure HTTP-only cookies
• Anonymous cart session identifiers (X-Session-Id) to preserve your shopping cart before login
• Location data (with your consent) via Google Places API
• Website usage measured by Google Analytics, and whether our advertising led to a visit or sign-up measured by Google Ads, each only with your consent (see section 8)
• Session identifiers for security and fraud prevention
• Chat interactions when using our support chat widget
• Mobile device information when you use our mobile apps (device model, operating system version, app version)
• Push notification device tokens (only if you enable push notifications — see section 12)

2.3 Information from Third-Party Sources

We aggregate publicly available event information from:

• Event organiser websites and calendars
• Public event listings and notices
• Equestrian association publications
• Other publicly accessible sources

We also receive information from third-party services:

• Google: Location and address information via Google Places API
• Stripe: Payment processing status and transaction metadata, and, for an organisation that takes payments through Stripe, the status of its Stripe account
• Xero: for an organisation that connects its own Xero file, the connection and what Xero holds of the invoices and payments we sent to it
• Facebook (Meta): for an organisation that connects its Facebook Page, the Page's name and an access token to publish its events there

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and maintaining our Service
• Processing event registrations and payments via Stripe
• Sending emails through Azure Communication Services and text messages (SMS) through Infobip, including verification and sign-in codes
• Sending notifications about events, registrations, and account updates (including push notifications on mobile devices and web browsers, where you have opted in)
• Verifying your email address and mobile phone number
• Processing location searches and venue information via Google Places API
• Improving and personalising your experience
• Communicating with you about our services
• Complying with legal obligations and regulatory requirements
• Detecting and preventing fraud or security issues
• Aggregating and analyzing usage patterns to improve the Service
• Storing documents and images in Azure Blob Storage for processing
• Processing documents and extracting information using Azure Document Intelligence and Azure OpenAI, and providing the other AI features described in section 5A
• Measuring how the website is used (Google Analytics) and whether our advertising works (Google Ads), only with your consent
• Sending an organisation's invoices and payments to its own Xero file, and publishing its events to its own Facebook Page, where the organisation has connected them
• Providing real-time customer support through Microsoft Customer Connect chat widget
• Managing support tickets through Zammad knowledge base
• Generating digital wallet passes for event registrations (Apple Wallet and Google Wallet)
• Recording horse health and movement declarations, generating Horse Movement Records for your own biosecurity record-keeping, and sharing declaration details with the relevant event organiser for event administration and safety

4. Disclosure of Your Information

We may share your information with:

4.1 Event Organisers

When you register for an event, we share your registration details with the relevant event organiser.

4.2 Service Providers (Subprocessors)

These are the service providers that store or process personal information for us, what each does, and where. Each provides its service to us under contract terms that protect the information.

• Microsoft (Microsoft Azure): hosting, databases, file storage, caching, secrets management and performance monitoring (Azure Application Insights); email delivery (Azure Communication Services); push notification delivery (Azure Notification Hubs); document processing and the other AI features (Azure AI Document Intelligence and Azure OpenAI, see section 5A); real-time support chat (Microsoft Customer Connect); and internal operational notifications (Microsoft Teams webhooks, which carry no personal user data). Primary storage is in Microsoft's Australia East region.
• Stripe: card and other online payments, and the Stripe accounts of organisations that take payments through Horsify (Stripe Connect), including Stripe's verification of those organisations and the people who run them. Australia and the United States.
• Infobip: sending text messages (SMS), and receiving the replies sent to our numbers. Outside Australia.
• Google: maps and address search (Google Maps and Places), website analytics (Google Analytics) and advertising measurement (Google Ads), each only with your consent; Android push notification delivery (Firebase Cloud Messaging); Google Wallet passes; and Google Play. United States.
• Apple: iOS push notification delivery (Apple Push Notification service), Apple Wallet passes and the App Store. United States.
• Xero: only for an organisation that connects its own Xero file. On the organisation's instruction we send it the organisation's tax invoices and the payments on them, including the customer's name and email address. United States.
• Meta (Facebook): only for an organisation that connects its Facebook Page. We publish the organisation's public event details to that Page; no rider or member information is sent. United States.
• Zammad: our support ticket and help article system, at kb.horsify.com.au.

Apple and Google also process app download and crash or diagnostic data under their own privacy policies when you use the App Store or Google Play.

4.3 Overseas Disclosure

Some of the providers in section 4.2 store or process personal information outside Australia. Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure it handles the information consistently with the Australian Privacy Principles, chiefly through the data protection terms in our contract with each provider. The countries involved are:

• United States: Stripe, Google, Apple, Xero and Meta as described above, and Microsoft for the generation of event flyer images (see section 5A)
• Other countries where Microsoft runs its AI models: requests to our AI features may be processed in any of them (see section 5A)
• The European Union and elsewhere: text messages sent through Infobip, and support chat through Microsoft Customer Connect
• Australia: primary data storage in Microsoft Azure's Australia East region

4.4 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Respond to a lawful request from a biosecurity, animal-health, or other regulatory authority, including the production of horse health or movement information where required under the Biosecurity Act 2015 (Cth) or applicable state or territory biosecurity legislation
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Respond to court orders or subpoenas

5. Data Security

We implement appropriate technical and organisational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS) and at rest (Azure Storage encryption)
• Encryption of sensitive organisation financial details (bank account name, BSB, and account number) using ASP.NET Core Data Protection before storage in the database
• Secure storage of secrets in Azure Key Vault
• JWT-based authentication with secure HTTP-only cookies
• Regular security assessments and updates
• Access controls and role-based permissions
• Managed Identity authentication for Azure services
• Payment data security managed by Stripe (PCI-DSS Level 1 certified)
• Secure cloud infrastructure with Microsoft Azure

However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. We are not liable for security breaches caused by third-party service providers.

5.1 Data Breach Notification

We are covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). If we suspect a data breach has occurred, we will assess it promptly. If we believe a breach is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, and tell you what happened, what information was involved, and what you should do in response.

Where the breach affects personal information we hold on behalf of a club, riding school or other organisation, we will also notify that organisation without undue delay so that it can meet its own obligations, and will give it the information it reasonably needs to do so.

5A. Automated Processing and Artificial Intelligence

Some features of the Service use automated processing, including artificial intelligence, on information you provide:

• Document processing: documents you upload (such as entry forms, results sheets and schedules) are processed by Azure Document Intelligence and Azure OpenAI to extract text and structured details, as described in section 11.7
• Drafting and suggestions: features that draft or summarise text, design event flyers, suggest draws or schedules, or suggest feed, care or training plans, generate their output using an AI model
• Text messages you send us: an AI model reads some texted requests to understand them, for example a horse care question sent to our care assistant, or an instructor texting their availability
• Operational automation: routine, rules-based automation such as sending reminders, allocating bridle numbers, generating draws and running orders, and matching duplicate records

We do not use automated processing to make decisions that produce legal effects for you or that similarly significantly affect you. Decisions about your entries, memberships, eligibility, refunds and payments are made by people — by us, or by the organisation you are dealing with. Output from an AI feature is a suggestion that a person reviews; it is not advice and does not replace a qualified professional.

Information processed by these features is handled in accordance with this Privacy Policy and is not used to train publicly available AI models.

Where AI processing happens: our AI features use Microsoft's Azure OpenAI Service and Azure AI Document Intelligence. Our Azure OpenAI resource is in Microsoft's Australia East region, but its models are Microsoft "Global" deployments, which means a request may be processed in any Azure region where the model runs, inside or outside Australia. Images for event flyers are generated by a model in Microsoft's East US 2 region in the United States. Microsoft does not use this information to train its models. Under its Azure OpenAI terms, Microsoft may keep prompts and outputs for up to 30 days to detect and prevent abuse.

6. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account information: Retained while your account is active and for a reasonable period after closure
• Transaction records: Retained for at least 7 years for tax and financial compliance (as required by Australian law)
• Event registrations: Retained for historical records and organiser reference
• Horse health and movement declarations: Retained for at least 2 years, consistent with the horse movement record-keeping periods under the Biosecurity Act 2015 (Cth) and applicable state and territory biosecurity legislation, and may be retained longer for organiser records, dispute resolution, and legal compliance
• Children's information: as set out in section 10.7. A club's or school's records about a child, including any incident report, are the organisation's and are never destroyed by a parent's account deletion
• Communications logs: Retained for customer support and dispute resolution purposes. The body of an email we send is deleted after 10 days; the record that it was sent (recipient, subject and delivery status) is kept
• Email verification tokens: Expired and deleted after 30 minutes
• SMS verification codes: Expired and deleted after 10 minutes
• Payment events: Retained indefinitely for audit and reconciliation purposes
• Anonymized analytics data: Retained indefinitely for service improvement

When your information is no longer needed, we will securely delete or anonymize it, unless retention is required by law.

7. Your Rights Under Australian Privacy Law

Under the Australian Privacy Principles, you have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal requirements and legitimate business needs)
• Complaint: Lodge a complaint about how we handle your personal information
• Opt-out: Unsubscribe from marketing communications at any time
• Data Portability: Request a copy of your data in a structured format (where technically feasible)

A parent or guardian exercises these rights for a child on their family list, and can see and correct the child's details on their own profile. Your data export (Account → Download my data) includes the children on your family list. A request about a child's record at a club or riding school goes to that organisation (section 10.3), and we will help the organisation answer it. A child who is old enough to make their own privacy decisions may contact us directly.

To exercise these rights, please contact us at privacy@horsify.com.au.

Account Deletion: You can permanently delete your account at any time from within the app by going to Account → Delete Account, or by visiting https://www.horsify.com.au/Account/DeleteAccount. Deletion takes effect immediately. Please note that some information may be retained for legal, tax, or legitimate business purposes as outlined in our data retention policy.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyse usage, and maintain session security. The specific cookies we use include:

• Essential Cookies: Authentication cookies containing JWT tokens (HTTP-only, secure) for maintaining your logged-in session
• Session Cookies: Temporary identifiers for fraud prevention and security
• Preference Cookies: Settings and preferences you configure (e.g., saved filters, postcode preferences)
• Analytics Cookies: Azure Application Insights for monitoring application performance and usage patterns, and Google Analytics for measuring how the website is used (Google Analytics only with your Analytics consent)
• Advertising Cookies: Google Ads, to measure whether our advertisements led to a visit or sign-up, only with your Advertising consent. Our mobile apps never use advertising cookies

You can control cookies through your browser settings, but disabling essential cookies may affect your ability to use certain features of our Service, particularly authentication and session management.

Third-Party Cookies: When you interact with Google Maps, or play a video a club has embedded on its site (for example from YouTube or Vimeo), those services may set their own cookies subject to their respective privacy policies.

Mobile Applications: Our iOS and Android apps use equivalent local storage technologies (such as secure cookies, local storage, and on-device caches) for the same purposes described above. See section 12 for details about data stored on your device.

9. Third-Party Links

Our Service may contain links to third-party websites, including event organiser websites and external event sources. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

Third-Party Services We Use:

• Stripe: Stripe Privacy Policy
• Google: Google Privacy Policy
• Infobip: Infobip Privacy Policy
• Xero: Xero Privacy Notice
• Meta (Facebook): Meta Privacy Policy
• Microsoft Azure: Microsoft Privacy Statement
• Apple: Apple Privacy Policy
• Google Wallet: Google Wallet Terms of Service

10. Children and Families

Many of the riders Horsify holds information about are children: a riding school's pupils, a club's junior members, and the children a parent enters in events. This section says what we hold about a child, who holds it, who may see it, how it is used and how long it is kept. It applies the Privacy Act 1988 (Cth) and the Office of the Australian Information Commissioner's guidance on children, and it will be updated when the Children's Online Privacy Code is registered (expected December 2026).

10.1 Accounts are for people aged 15 and over

A Horsify account can be created only by a person who is 15 or older, which is the age from which the OAIC's guidance presumes a person can make their own privacy decisions. The person confirms this when they create the account, and we record that confirmation with the date. A younger rider does not have an account of their own: a parent or guardian adds them to their own account (section 10.2). A club or school that invites its clients to create accounts invites the parent, not the child.

A person aged 15 to 17 who holds their own account may still be a child in the care of a parent, and a parent may still manage them from the parent's account. We do not send marketing to anyone we know to be under 18 (section 10.5).

10.2 A child on a parent's account (the family list)

A parent or guardian adds a child to their own account so they can enter, book and pay for them. For each child on the family list we hold: first name and surname; date of birth (to apply age rules, and to know when the child turns 18); the relationship to the account holder and whether they are the primary contact, may collect the child and may authorise medical treatment; and, only if the parent chooses to provide them, medical notes, disability details, an emergency contact and a contact phone number. Health information is held only once the parent has ticked that they agree to us holding it, and we record who agreed and when.

The parent sees and can correct everything on the family list from their profile, and can remove a child from it at any time. More than one parent or guardian may manage the same child, each from their own account. On the child's 18th birthday the parent's authority to consent for them ends: the link becomes a "managed adult" link (the parent can still book and pay, the rider signs their own waivers and consents), we tell the parent once by email, and the rider may claim their own login using the email address their club or school holds for them, which ends the parent's management of them.

10.3 A child's record at a club or riding school

A club or riding school keeps its own record of each child it teaches or has as a member: name, date of birth, the parent or guardian and how to reach them, lesson and entry history, waivers a parent signed, and, for a riding school, weight (for horse allocation), medical conditions, dietary requirements, special needs and any incident report. The club or school collects this information and is responsible for it; Horsify holds and processes it on the organisation's behalf under our Terms of Service, and does not use it for any purpose of its own. A request to see or correct a child's record at a club or school goes to that organisation, which can do so on the child's card; a request about the family list goes to us (section 7).

Staff record a child's health information only after confirming that the parent or guardian agreed to it, and the record keeps who confirmed it and when. Within an organisation a child's health information is shown only to staff the organisation has given access to its clients (the "Manage" level), to the coach teaching the child's lesson, and to Horsify's own administrators for support; office staff with lesser access see the child's record without it. Every reading of a child's medical notes or incident report is logged. Health information is not sent to any third party except where required for safety or by law.

10.4 Who is told what, and how

Messages about a child go to the parent or guardian, never to the child: lesson reminders and confirmations, waiver requests, results, payment requests and texts. Where a text cannot reach a parent's own mobile it is not sent, and the parent is emailed instead. A child's own address is never used for marketing (section 10.5), and an enquiry a child sends about themselves is answered but not followed up.

10.5 No marketing to children

We do not use a child's information for direct marketing, and a club's or school's campaigns through Horsify exclude anyone the organisation records as under 18, at every channel. Marketing about a child's activities (for example a school's newsletter) goes to the parent, who may opt out at any time.

10.6 Results, running orders and photographs

Competition results, standings and running orders are public in equestrian sport and name each rider, children included, with their horse; on Horsify's public pages and exports a rider is named by first name and initial only. Photographs of children appear on a club's site only where the club has published them; a club should hold a parent's consent before doing so, and anyone may ask a club to take a photograph down through the request link on its gallery. Horsify does not collect or record photo consent for clubs today; this is on our roadmap.

10.7 How long a child's information is kept

A child on a parent's family list stays there until the parent removes them or deletes their account. When a parent deletes their account, a child who has no record with any club or school is deleted with it. A child a club or school has on its books stays on that organisation's books, because the organisation's records of lessons, entries, waivers and incidents are records it is obliged to keep (including records relevant to child safety, which Australian child-safe standards expect to be kept for decades); the health notes, emergency contact and phone number the parent entered on the family list are removed. A club's own records are kept for as long as the club needs them under the law that applies to it, and the club can end a client relationship on the client's card. We are documenting a retention schedule for each record type with our legal advisers.

10.8 Managed adults

An account holder may also manage an adult who has no login of their own (for example a spouse) under a "managed adult" link. The adult remains responsible for their own waivers and consents; the account holder must not provide the adult's health information unless the adult has agreed; and the adult may withdraw consent to being managed, or ask us directly for access to, correction of or deletion of the information held about them, without going through the account holder. A guardian link over an adult is available only where the account holder declares that they hold legal guardianship over that adult.

11. Specific Data Processing Activities

11.1 Payment Processing (Stripe)

When you make a payment, we use Stripe to process your payment information. Stripe collects and stores your payment card details, billing address, and transaction information. We receive only:

• Last 4 digits of your card number
• Card brand (Visa, Mastercard, etc.)
• Payment status and transaction ID
• Billing email address

Full payment card details are stored securely by Stripe and are never stored on our servers.

11.2 Email Communications (Azure Communication Services)

We use Azure Communication Services to send transactional emails, including:

• Email verification links
• Event registration confirmations
• Payment receipts
• Account notifications

Your email address and the content of these communications are processed by Microsoft Azure servers.

11.3 Text Messages (Infobip)

If you opt in to text messages, use SMS two-step verification, verify a mobile number, or an organisation you deal with sends you reminders by text, we use Infobip to send them, and to receive the replies you send to our numbers (such as STOP, or a message to our care assistant). Your phone number and the message content are processed by Infobip and telecommunications carriers. Standard SMS rates may apply to messages you send.

11.4 Location Services (Google Places API)

When you search for events or venues, we use Google Places API to:

• Geocode addresses to coordinates
• Provide address autocomplete suggestions
• Calculate distances between locations
• Display maps and venue locations

Your search queries and location data may be sent to Google servers subject to Google's Privacy Policy.

11.5 Facebook Pages (Organisations)

We no longer offer sign-in with Facebook. An organisation can connect its Facebook Page so that we publish its events there. To connect, an organisation admin signs in to Facebook on Facebook's own site and gives Horsify permission to post to the Page. We keep:

• The Page's name and identifier
• An access token that lets us post to the Page, until the organisation disconnects it or the token expires

We post the event's public details (such as its name, dates, venue and a link to it). We never receive the admin's Facebook password, and no rider or member information is posted.

11.6 Document Storage (Azure Blob Storage)

Documents and images you upload (such as entry forms or verification documents) are stored in Azure Blob Storage. These files are:

• Encrypted at rest using Azure Storage encryption
• Accessed only by authorized personnel and automated processing systems
• Retained according to our data retention policy
• Stored in Australian or Asia-Pacific Azure data centers where possible

11.7 Document Processing (Azure Document Intelligence and Azure OpenAI)

When you upload documents for processing (such as entry forms), we use Azure Document Intelligence and Azure OpenAI services to:

• Extract text and data from uploaded documents
• Automatically populate registration forms
• Process and validate document information

Microsoft processes uploaded documents to return the result to us and does not use them to train its models. See section 5A for where this processing happens and what Microsoft may keep to detect abuse.

11.8 Customer Support Chat (Microsoft Customer Connect)

When you use the chat widget for customer support, we use Microsoft Customer Connect to provide real-time assistance. Information collected includes:

• Your chat messages and conversation history
• Your name and email address (if you choose to provide them)
• Session identifiers for tracking support conversations
• Device and browser information for technical troubleshooting

Chat conversations are stored for support quality purposes and may be reviewed by our support team. Microsoft processes this data in accordance with their privacy statement.

11.9 Support Ticket Management (Zammad)

When you submit a support request through our support form, we use Zammad knowledge base to manage support tickets. Information collected includes:

• Your name and email address
• Subject and description of your support request
• Any attachments or files you provide
• Support ticket history and responses

Support tickets are stored on our Zammad instance hosted at kb.horsify.com.au and are retained for customer service and dispute resolution purposes.

11.10 Digital Wallet Passes (Apple Wallet and Google Wallet)

If you choose to add your event registration to Apple Wallet or Google Wallet, we generate digital passes containing:

• Event name, date, and venue information
• Your registration details and QR code
• Event organiser information

Wallet passes are generated on-demand and transmitted directly to your device. We do not store copies of wallet passes, and Apple/Google handle the storage and management of passes according to their respective privacy policies.

11.11 Linked Rider Profiles (Dependants and Managed Adults)

When you use the linked rider management feature to create a profile for a minor in your care or for an adult who has consented to being managed by your account, the following information is stored in our database:

• First name, surname, and date of birth of the linked rider
• The type of link (guardian or managed adult), any declaration of legal guardianship over an adult, and — for a managed adult — the date and time you confirmed that they consented to being managed
• Your relationship to the linked rider (e.g., Parent, Guardian, Carer, Spouse)
• Any medical notes or disability information you voluntarily provide for riding safety and inclusive participation purposes
• Organisation membership details where applicable (membership number, status, expiry)

This information is used solely to facilitate event registrations, manage memberships, and administer riding activities on behalf of the linked rider. Medical notes and disability information, if provided, are health information and are treated as sensitive information: we hold them only once you have agreed to it, record who agreed and when, and show them only to you, to staff the relevant organisation has given access to its clients and to the coach teaching the rider (section 10.3). Where the linked rider is a managed adult, you must not provide their health information unless they have agreed, and they may contact us directly to access, correct, or delete the information held about them.

11.12 Horse Nominations for Events

When you enter a horse for an event and the horse is not already registered on your profile (nominated as "Other"), we collect the following horse details:

• Horse name
• Breed
• Sex

This information is used solely to identify the horse for the specific event entry and to provide event organisers with accurate participant records. It is shared with the relevant event organiser as part of your registration details.

11.13 Organisation Bank Account Details

Event organisers who choose to accept bank transfer payments may provide their organisation's bank account details through the platform. Information collected includes:

• Bank account name
• BSB (Bank-State-Branch) number
• Bank account number
• Bank name
• Suggested payment reference text

Bank account details are encrypted using ASP.NET Core Data Protection before being stored in our database. This information is used to display payment instructions to event participants who select bank transfer as their payment method. Bank account details are only visible to participants of the relevant event and to authorised organisation administrators. We do not use this information to initiate or process any financial transactions.

11.14 Horse Health and Movement Declarations

If you complete a horse health and movement declaration for an event, we collect and store information to support event administration and biosecurity record-keeping, including:

• Horse identification details (name, breed, colour, sex, age, microchip number, registration number)
• Details of the person responsible for the horse (name, phone number, email address, and address)
• Origin and destination property details, Property Identification Codes (PICs), movement purpose, dates, transport details, and recent movement history
• Hendra virus vaccination status and cattle tick treatment details
• Your responses to event-day health questions and any health concern notes you provide
• The legal name you sign with and an audit record of the date, IP address, and browser/device (user agent) used at the time of signing

This information is used to record the declaration, to generate a Horse Movement Record that you can download for your own biosecurity record-keeping, and to share declaration details with the relevant event organiser and their authorised administrators for event administration, safety, and welfare purposes. The IP address and user agent are retained only as an audit trail evidencing who completed the declaration and when.

We provide these tools as a convenience for record-keeping. We do not verify, certify, or lodge declarations or movement records with any authority on your behalf. You remain responsible for the accuracy of the information you provide and for meeting your own obligations under the Biosecurity Act 2015 (Cth) and applicable state and territory biosecurity legislation, including any requirement to keep and produce horse movement records on request. We may disclose this information to a biosecurity or other regulatory authority where required by law (see section 4.4) and retain it in accordance with our data retention policy (see section 6).

11.15 Accounting (Xero, Organisations)

An organisation can connect its own Xero file. We then send that file the organisation's tax invoices and the payments on them, including the customer's name and email address, what was bought, the amounts and GST. The organisation decides to do this, and Xero processes the information for the organisation under Xero's own terms. We keep the connection's access tokens in encrypted form, and a record of what we sent, so that nothing is sent twice.

11.16 Analytics and Advertising Measurement (Google)

With your consent through our cookie banner, we use Google Analytics to measure how the website is used, and, with your separate Advertising consent, Google Ads to measure whether our advertisements led to a visit or sign-up. Without Advertising consent, advertising storage is denied and ad personalisation is off. Our mobile apps use Google Analytics only, and only with your consent. We remove private link tokens from page addresses before they are sent to Google. You can change your choices at any time through the cookie settings.

12. Mobile Applications (iOS and Android)

The Horsify mobile app is available for iOS via the Apple App Store and for Android via Google Play. The app provides access to the same Service described in this Privacy Policy, and all sections of this policy apply equally when you use the app. This section describes the additional data practices specific to the mobile app.

12.1 Device Permissions

The app may request the following device permissions. All permissions are optional, are requested only when you use the relevant feature, and can be granted or revoked at any time through your device settings (Settings > Horsify on iOS, or Settings > Apps > Horsify on Android). Declining a permission only affects the feature that needs it — the rest of the app continues to work.

• Camera: Used so you can take photos and videos of your horses for profiles and records, and capture documents (such as paper score sheets) for processing. Images are captured only when you initiate them.
• Microphone: Used only to record audio when you capture videos within the app.
• Photo library: Used so you can choose existing photos to upload, and to save photos or videos to your library when you request it.
• Location (approximate, while using the app): Used to show horse events near you. We request only approximate, foreground location — the app never accesses your location in the background, and we do not store a history of your movements.
• Notifications: Used to deliver push notifications you have opted in to (see section 12.2).

12.2 Push Notifications

If you enable push notifications, we collect a push notification device token issued by your device's operating system and store it against your account so we can send you notifications about events, registrations, payments, and account activity. Notifications are delivered through Azure Notification Hubs using the Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. The device token identifies your device for delivery purposes only — it does not give us access to any other data on your device.

You can stop push notifications at any time by disabling them in your device settings or in your Horsify notification preferences. Device tokens are removed when you disable notifications in your Horsify notification preferences or delete your account, and expired or invalid tokens are removed automatically. Disabling notifications in your device settings stops delivery immediately, although the token may remain stored until it expires or you disable notifications in your Horsify preferences.

12.3 App Tracking Transparency (iOS)

On iOS, in accordance with Apple's App Tracking Transparency framework, the app will ask for your permission before any activity that Apple defines as tracking. We use this only to measure how the app is used so we can improve it. We do not sell your personal information, and we do not share it with third parties for their own advertising purposes. If you decline, the app remains fully functional.

12.4 Data Stored on Your Device

The app stores limited data locally on your device, including authentication session data, cached content, and your preferences, so that the app loads quickly and certain features can work with an unreliable connection. Locally stored data is removed when you uninstall the app. The app also monitors your device's network connectivity status (online/offline) to manage this behaviour; connectivity status is used on-device only and is not collected by us.

12.5 Account Deletion from the App

You can permanently delete your Horsify account and associated personal information at any time, whether or not you still have the app installed, from within the app at Account → Delete Account or by visiting https://www.horsify.com.au/Account/DeleteAccount. Deletion is self-service and takes effect immediately; you may also contact privacy@horsify.com.au for assistance. See sections 6 and 7 for details of retention and your rights.

12.6 App Store Data

When you download the app, Apple or Google may collect data such as download statistics and crash or diagnostic reports under their own privacy policies. We do not receive personal information from the app stores beyond aggregated statistics.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

14. Complaints and Disputes

If you have a complaint about how we handle your personal information, please contact us first at privacy@horsify.com.au. We will investigate and respond to your complaint within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au

15. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

• Company Name: Horsify Pty Ltd
• ACN: 693 058 383
• ABN: 63 693 058 383
• Registered address: 3711 Goodwood Road, Elliott QLD 4670, Australia
• Email: privacy@horsify.com.au
• General inquiries: hello@horsify.com.au
• Website: https://www.horsify.com.au

The Horsify logo is a registered trade mark of Horsify Pty Ltd (Australian trade mark no. 2604905). The Horsify name and other Horsify marks are trade marks of Horsify Pty Ltd.