AllTails Privacy Policy

Version 1 · effective from 3 November 2026

At a glance

• AllTails is operated by one individual in Bulgaria, who is the controller of your personal data within the platform.
• We only collect data necessary to provide the service: your account details, bookings, payments, information about your pets and information you choose to provide.
• We do not sell data. We do not have a newsletter, do not share your data with third parties for marketing purposes and send promotional messages only with your consent.
• The business you book with receives only the data necessary to provide its services. From that point onwards, it is responsible for processing that data in accordance with its own privacy policy.
• Your pet's history is private. A business can only see an entry if you share it with them. You can withdraw access at any time.
• Our database and files are stored in the European Union (Google Cloud data centres in the EU). Some providers also process data in the United States, subject to the safeguards described below.
• Cookies: we use only one essential cookie to keep you signed in. Google Analytics operates only if you give your consent.
• You can delete your account yourself at any time through the settings. To get a copy of your data, or for anything else, write to privacy@alltails.eu.

1. Who is the data controller?

The AllTails service (alltails.eu) is operated by:

AllTails, self-employed professional – software developer 3-ta Street, 9150 General Kantardzhievo, Bulgaria UIC / BULSTAT: 181662614 · VAT ID: BG8070040914

In this policy, "AllTails", "we", "us" and "our" refer to the data controller.

Contact for personal data matters: privacy@alltails.eu. We respond as quickly as possible and no later than one month after receiving your request.

We have not appointed a Data Protection Officer (DPO), as the law does not require one for a service of this nature. All matters concerning personal data are handled personally by the data controller.

2. Who does this policy apply to?

This policy applies to:

• people who visit alltails.eu, whether or not they have an account;
• customers – pet owners and riders with an account, as well as people making bookings as guests;
• businesses – business owners and team members offering services through AllTails;
• people whose data has been provided to us by someone else: invited team members, individuals entered by a business when creating a booking, or participants added by a customer (for example, a child registered for a riding lesson).

3. What data do we collect and where does it come from?

Data you provide to us

• Account: name, email address, password (stored solely as a secure hash by Google Firebase – we never have access to the actual password), profile picture (optional) and preferred language.
• Phone number: we require it when making a booking so that the business can contact you. We do not verify phone numbers by SMS.
• Bookings: the selected service, time and location; for home visits, the address where the business is expected to visit you; participant details; your answers to pre-booking questions; and your message to the business.
• Pets: name, species, breed, date of birth, sex, neutering status, picture, microchip and passport numbers, vaccinations, parasite prevention and medication. A pet's history may also contain events, descriptions, test results, X-ray and ultrasound images, photographs, PDF files and videos.
• Other people (riders and participants): their names and answers to questions required by the relevant service. For riding lessons, for example, this may include year of birth, riding level, as well as weight and height expressed as ranges (for example, "50–70 kg"), rather than exact values. The riding centre uses this information to select a suitable and safe horse.
• Chat, sessions and reviews: chat messages and photographs, comments, files sent during a session, personal notes, reviews and private suggestions you may leave for a business.
• Businesses: business name and description, logo, gallery, locations, service areas, services and prices, public email address and phone number. For invoicing purposes, we collect the business name or the individual's full name, registration number, address and VAT status. We also store the business's own terms and conditions and privacy policy, provided in PDF format.
• Team members: profile information, including name, picture, description, languages, specialisation, years of professional experience, achievements, their own pets, social media profiles and certificates.

We do not ask about people's health. A business may ask such a question only when it needs the answer to provide its service safely, and only with your explicit consent, given next to the question. Please do not include information about people's health in messages or notes unless the business asks for it.

Data we receive from other sources

• From Google or Apple, when you sign in using their services: name, email address (which may be a relay address when using Apple) and profile picture.
• From a business that creates a booking on your behalf, for example after a telephone conversation: name, email address and, where applicable, phone number and visit address. We send you an email about the booking that says which business provided your data, and we create an account linked to that address so that you can view the booking. You can take over the account or tell us that the booking is not yours.
• From a business owner who invites you to join their team: your email address.
• From a customer who adds you as a participant in a booking or event (for example, a parent adding their child).
• From Stripe: information on whether a payment was successful and, for businesses, information about the status of their verification for payouts. We never receive or store payment card details.

Data generated when you use the service

• Technical data: your IP address and browser information. Our server uses this information in real time to prevent abuse (by limiting the number of requests) and to produce statistics (section 11). This data is not stored in our main database, but may appear in server logs (section 8).
• Your usage history: when you registered, when you made your first booking and similar events; the months during which you used the service; the source through which you reached a particular business (for example, the AllTails search engine or Google); and the devices from which you signed in or on which you receive notifications.
• Searches: the address or town/city and the words you enter when searching. When a search returns no results, we store information about the area, with an accuracy of approximately 10 kilometres, without linking it to you, to identify areas where services are missing.

4. Why do we use your data and on what legal basis?

Where processing is based on legitimate interest, you have the right to object to it (section 9).

Where processing is based on consent, you may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

Providing data is voluntary, but without certain information we cannot provide the relevant service: without an email address, you cannot create an account, and without a phone number, you cannot make a booking.

We send promotional messages only with your consent. Today these are only updates from businesses you follow, which you switch on yourself. We do not have a newsletter.

5. Businesses on AllTails and other users

The business you make a booking with receives the following information about you: name, email address, phone number and profile picture; participant details (name, species, sex, neutering status, breed, date of birth and picture of the pet, or the rider's name); your answers to questions relating to the service; your message to the business; and your address when the service takes place at your home.

The business also has access to your chat with it and to the content you send during a session.

From the moment it receives this data, the business acts as an independent data controller and processes it in accordance with its own privacy policy. We provide you with this policy before you make a booking.

When a business keeps its own notes, visit records or progress records in AllTails, we store this data on its behalf, in accordance with the Data Processing Agreement included in our business Terms and Conditions.

Your pet's history is private. A business can only see information about its own visits and records that you have explicitly shared with it. You can withdraw sharing at any time. Information the business has already accessed remains with that business.

The following information is publicly visible:

• business profiles and the contact details provided by the businesses;
• profiles of team members;
• reviews, which are published with the author's first name, the first names of the pets or riders who took part (for example, "Anna & Burek") and the author's profile picture. Surnames are never displayed.

The private suggestion you may leave as part of a review is never public.

Other participants in an event can see your first name and profile picture in the event's group chat, but they cannot access your contact details.

If a business has made the event materials "visible to all participants", other participants can also see the content you publish there. You will be informed about this before submitting any content.

The person who referred you, if you use their referral code, can see your first name and whether you have made your first booking.

6. Who else receives access to your data?

We use several established service providers. Those processing personal data on our behalf do so solely on our instructions and under a Data Processing Agreement.

The following organisations act as independent data controllers:

• Stripe (Stripe Payments Europe Ltd, Ireland) – processes payments and verifies businesses before payouts. It acts as an independent controller for its own purposes, such as verification, fraud prevention and compliance with financial regulations, and processes payment data on our behalf under its data processing agreement. It receives your email address, the amount and the name of the service. You enter payment card details directly into Stripe's system. Its privacy policy is available at stripe.com/privacy.
• Google and Apple – when you use their services to sign in to your account.
• Your browser's push notification service (Google, Apple or Mozilla) – delivers push notifications. These contain a short text, for example the business name and the beginning of a message.

Personal data may also be disclosed to public authorities when required by law.

Transfers of data outside the European Economic Area (EEA)

Some of our providers (Google, Resend and Stripe) also process personal data in the USA. Such transfers are based on the European Commission's adequacy decision under the EU-US Data Privacy Framework and, where necessary, on the Standard Contractual Clauses approved by the European Commission.

Upon request, we will provide you with a copy of the applicable safeguards for data protection.

7. How long do we retain your data?

After the relevant retention periods expire, we delete the data or permanently anonymise it. We retain data for longer only when required by law or when necessary in connection with an ongoing dispute.

Data that a business stores in its own tools within AllTails (notes, visit records, progress information and other similar data) is retained while the business has an active account on the platform. It is deleted 30 days after the business account is closed.

The periods for which a business retains this data in its own systems are specified in its privacy policy.

8. Security

We apply the following measures to protect your personal data:

• The connection to the service is encrypted using HTTPS.
• Your browser never connects directly to our database. Every request passes through our server, which checks what information you are authorised to access.
• Files are accessible only to people who have the appropriate permissions.
• When uploaded, photographs are processed to remove their metadata, including GPS location information. MP4 and MOV videos and PDF files have their metadata removed too, including the location recorded by a phone camera and a document's author. A WebM video, and a PDF that is signed or encrypted, are stored as you send them, so before sending one, check that it does not contain information you do not want to share.
• The address from which a business travels to its customers is never publicly accessible. In addition, a business can hide the exact address of its location.
• Test results contained in PDF files are processed on our own server, without using external services or artificial intelligence.

Our server stores technical logs, which may contain your IP address, browser information, the address of the page visited and, in the event of an error, an account or booking identifier. We use these logs for security purposes and to troubleshoot technical problems.

We record every personal data breach. If a breach is likely to result in a risk to your rights and freedoms, we report it to the Commission for Personal Data Protection within 72 hours of becoming aware of it. If it is likely to result in a high risk, we also inform you without undue delay.

9. Your rights

You have the right to:

• Access your personal data and obtain a copy of it.
• Rectification of inaccurate data (you can correct most of it yourself within the platform).
• Erasure of your personal data – the right to be forgotten.
• Restriction of the processing of your personal data.
• Data portability – receiving your data in a machine-readable format.
• Object to processing based on legitimate interest, for example the collection of statistics.
• Withdraw consent at any time: for Google Analytics, through "Cookie settings" at the bottom of each page; for push notifications and updates from businesses you follow, through your notification settings.

Deleting your account

Under Profile → Settings → Delete account, you can delete your account yourself.

You will be signed out immediately. Within 30 days, we will delete your account, your pets and their histories, people you have added, files, chat messages, your own notes, followed businesses and notifications, as well as your sign-in connection through Google or Apple.

We will also let the businesses you have booked with know that you have deleted your account. Data they keep themselves, as independent controllers, is theirs to delete - you can contact them directly.

Your reviews will remain on the platform without your name, picture or any link to your account, signed "AllTails Customer". If you want an individual review removed, write to us.

Data that we are legally required to retain – such as accounting records relating to payments – will be kept only for the applicable mandatory retention period, without any additional information about you that is not necessary for this purpose.

Before deleting your account, all ongoing bookings must be completed or cancelled.

Downloading your data

Write to privacy@alltails.eu from the email address associated with your account. We will send a link to that address - valid for 7 days - to a ZIP file with your personal data in JSON format, together with your photographs and documents. The file is prepared each time you open the link and is not stored by us.

For all other matters, contact us at privacy@alltails.eu from the email address associated with your account. If you contact us from a different address, we will ask you to confirm that you are the account owner.

We respond within one month. In complex cases, we may extend this period by a further two months, and we will inform you of the reasons for the extension.

Exercising your rights is free of charge.

Complaints

If you believe that we are violating data protection legislation, you have the right to lodge a complaint with a supervisory authority:

• In Bulgaria: Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.
• Or in the country where you live or work. For example, in Poland, you can contact the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

We will be happy to answer your questions and clarify any concerns before you need to lodge a complaint. Simply contact us.

10. Children and other people's personal data

People aged 16 or over may create an AllTails account. When creating an account, you confirm that you are at least 16.

Data about a child – for example, a participant in a riding lesson – may only be added by their parent or legal guardian.

When adding data about another person, make sure you have the right to do so and inform them where they can find this Privacy Policy.

11. Cookies and browser storage

We use one essential cookie, as well as Google Analytics cookies, only if you have given your consent. We also store a few settings in your browser storage.

You can clear information stored in your browser through its settings.

You can change your Google Analytics preferences through "Cookie settings" at the bottom of each page. After you withdraw your consent, we delete the _ga cookies.

Google Analytics

Google Analytics receives only information about the type of page you visit (for example, "business profile", without the name of the specific business), campaign parameters and the domain from which you reached us.

We never provide Google with your identifier, email address or URLs containing identifiers that could be used to identify you.

Advertising features and Google Signals are disabled.

Our own statistics

Our own statistics do not use cookies or browser storage.

On each visit, the server calculates a fingerprint from your IP address, browser information and a random value that changes every day.

This lets us count each visit only once per day. The fingerprint is pseudonymous: it cannot be linked across days, and we do not use it to identify you.

The random value and the fingerprints are deleted after 2 days. After that, only aggregated figures remain, for example "20 visits to a profile from Google", which do not identify anyone.

You can object to this processing by contacting us.

Until you open the sign-in window, enable push notifications or consent to Google Analytics, your browser does not connect to any servers other than ours.

12. Search ranking and automated decisions

We do not make decisions based solely on automated processing of personal data that produce legal effects concerning you or similarly significantly affect you.

• Search result ranking depends on the criteria of the particular search, not on your profile. The factors taken into account include relevance to the search, distance, available appointment slots and ratings. Businesses that have paid for promotion on a given day are displayed first and marked as "Promoted".
• When the system suggests a horse to a rider based on their answers, it provides only a recommendation. The final decision is made by the riding centre.

13. If you operate a business or are a team member

• We process invoicing and payment data to fulfil our contractual obligations and our obligations under tax legislation. Identity and bank account verification for payouts is carried out by Stripe, which acts as an independent data controller. To start the verification, we pass Stripe the business owner's email address, the business name and its legal form; we only receive the result of the verification.
• Business profiles and team member profiles become public once published. Each team member decides what information to include in their own profile. The rating based on reviews follows the relevant team member across all businesses they work with.
• We send team invitations to the email address provided by the business owner.
• Customer data that a business stores in its own tools within AllTails (customers, notes, visit records, progress information and bookings created by the business itself) is processed on behalf of the business, in accordance with the Data Processing Agreement included in our business Terms and Conditions. In these cases, the business is the data controller and is responsible for responding to its customers' requests. We provide the business with the necessary assistance and notify it without undue delay of any personal data breach affecting this data.
• When a business account is closed, the data it has stored in its own tools is deleted after 30 days, except for accounting records relating to payments, which are retained for the legally required period.

14. Changes to this policy

Whenever a significant change occurs, including if the service is transferred to a different operator, such as a company, we will publish a new version of this policy with an updated date and notify you by email or through the application before the changes take effect.

Previous versions of this policy, with a description of what changed, are in "Change history", under Documents at the bottom of each page.

This policy is published in the languages of the service: Polish, Bulgarian and English. All language versions have the same content.

AllTails · UIC / BULSTAT 181662614 · VAT ID BG8070040914 privacy@alltails.eu