Where your data lives, and what is never done with it
A yard's records are its clients' names, its vets' findings and its own money. This page says plainly where that data is kept, who inside your organisation can reach it, and the one thing that is never done with it: it is not used to train AI models.
In short
- Application data is hosted in the European Union.
- Each organisation's records are isolated from every other organisation's, in the query and on disk.
- Your data is never used to train AI models, and each AI capability goes to a separate provider.
- Permissions are enforced on the server, not by hiding buttons in the interface.
- Two-factor sign-in is available: an emailed code plus single-use recovery codes.
Hosted in the EU
Your application data is hosted in the European Union. Some supporting services run from data centres in the United States under the safeguards set out in the privacy policy — and that policy names them rather than describing them vaguely. If you need to know which processor sees what, it is written down rather than summarised.
One organisation cannot see another
Records belong to an organisation and are isolated at that boundary. This is not a filter applied while drawing a screen; it is how the data is queried. Files are stored per organisation too, so a photograph of a horse or a scanned lab result cannot be reached from another yard's session even if somebody guesses the address.
Roles are enforced where it counts
Owner, barn staff, instructor, vet and client each see a different slice, and the boundary is applied on the server rather than by hiding controls. The distinction is the whole point: an interface that merely hides a button still serves the data to anyone who asks the API directly. The AI assistant is bound by the same rules and hands restricted roles a read-only set of tools.
Your records are not training data
Vet records, owner names and staff notes go only to providers that do not retain them and do not train on them. Conversation, speech and search are routed separately, so there is no single vendor holding a complete picture of your yard. This is a commitment that costs something to keep, which is why it is stated as a rule rather than an aspiration.
Sign-in and second factors
Passwords are hashed with bcrypt and never stored in a readable form. Two-factor sign-in is available: a six-digit code is emailed when you log in, with single-use recovery codes to print and keep for the day that mailbox is unreachable, and devices you trust can be remembered so the prompt is not constant. There is no authenticator-app option today. A locked verification attempt does not lock the account, deliberately — an account-level lock is a denial of service anyone could trigger with a known email address.
An audit trail of who did what
Authenticated changes are logged against the user who made them, so a record that changed carries a name and a time. That is as useful for an honest mistake as for anything worse: it turns “who moved that horse” from an argument into a lookup.
Who asks these questions
- Yards holding other people's horses, whose clients' details are not theirs to be careless with.
- Operations with staff turnover, where role boundaries have to hold without being policed by hand.
- Anyone who has read enough AI terms of service to check what happens to the data before signing up.
Frequently asked questions
Where is my data stored?
Application data is hosted in the European Union. Some supporting services run from data centres in the United States under the safeguards described in the privacy policy, which names the processors rather than describing them in general terms.
Is my data used to train AI?
No. Records go only to providers that neither retain them nor train on them, and each capability — conversation, speech, search — is routed to a different provider, so no single one holds your whole yard.
Can my staff see the yard's finances?
Only if their role allows it. Owner, barn staff, instructor, vet and client see different things, and the boundary is enforced on the server rather than by hiding parts of the interface — so it holds even against a request made directly to the API.
Do you support two-factor authentication?
Yes. It emails a six-digit code when you sign in and issues single-use recovery codes for when that mailbox is unreachable. Trusted devices can be remembered so you are not asked every time. There is no authenticator-app option today.
What happens to my data if I leave?
It remains yours. The privacy policy sets out how to request an export or deletion, and which processors hold what in the meantime. Nothing about leaving is designed to be harder than joining.
Read the detail before you sign up
The privacy policy names the processors and what each one sees. Free for up to two horses, and no card to get started.