Privacy Policy

01 Data Controller

Note: OneStride is not yet a registered company. The data controller within the meaning of the GDPR and the revised Swiss Federal Act on Data Protection (revFADP) is the private individual named above.

02 Personal Data We Collect

We collect only the data necessary for the operation of the Platform:

• Account data – name, email address, password (hashed), profile photo
• Location data – used to display nearby horses on the Explore map
• Listings – photos, videos, descriptions, pricing, competition results, and documents (e.g. veterinary records) uploaded by sellers
• Matches & interactions – likes, declines, matches, saved favourites
• Messages – chat conversations between matched buyers and sellers
• Push notification tokens – device identifiers used to deliver notifications via APNs (iOS) and FCM (Android)
• Technical data / server logs – IP address, user-agent, timestamp, requested URL (retained for up to 30 days for security and abuse prevention)

Note on data access: Veterinary documents are visible only to matched buyers and sellers. Other users have no access to these records.

03 How We Use Your Data

We process your personal data for the following purposes, each tied to a legal basis under the GDPR / revFADP:

• Providing and operating the Platform – contract performance (Art. 6(1)(b) GDPR)
• Displaying horse listings near you on the Explore map – contract performance / consent for precise location
• Enabling swipe-based matching and in-app chat – contract performance
• Delivering push notifications (matches, messages, service updates) – legitimate interest / consent on first device prompt
• Security, fraud prevention, abuse detection – legitimate interest (Art. 6(1)(f))
• Compliance with legal obligations – Art. 6(1)(c)
• Using listings, photos, and videos for OneStride's own marketing and communications – consent granted via the Terms of Use upon registration

04 Legal Basis for Processing

Processing is carried out on the following legal bases under the GDPR and the revFADP (in force since 1 September 2023):

• Performance of a contract – Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP
• Legal obligations – Art. 6(1)(c) GDPR / Art. 31(2)(c) revFADP
• Legitimate interests – Art. 6(1)(f) GDPR / Art. 31(1) revFADP
• Consent – Art. 6(1)(a) GDPR / Art. 31(2)(b) revFADP (Terms of Use, push prompts, location prompts)

05 Data Processors & Sub-Processors

We do not sell your personal data. We rely on the following carefully selected processors, each bound by a data processing agreement (DPA):

Beyond these processors, data may be shared with other users of the Platform in the context of listings and matches, with competent authorities where required by law, with potential buyers of the Platform in the context of a business transaction, and with any other third party only with your explicit consent.

06 International Data Transfers

Some processors listed above are located in the USA. Transfers outside Switzerland and the European Economic Area (EEA) are based on appropriate safeguards:

• EU–U.S. Data Privacy Framework (DPF) certification, where the recipient is certified (e.g. Google, Apple, Cloudflare)
• EU Standard Contractual Clauses (SCC) together with the Swiss addendum where DPF does not apply
• Additional technical measures (encryption in transit and at rest)

07 Retention Periods

08 Your Rights

Where applicable, you have the following rights (GDPR Chapter III; revFADP Art. 25–27):

• Right of access – obtain a copy of your personal data
• Right to rectification – correct inaccurate or incomplete data
• Right to erasure – request deletion under certain conditions
• Right to restriction – limit processing in certain circumstances
• Right to object – object to processing based on legitimate interest
• Right to data portability – receive your data in a structured, machine-readable format
• Right to withdraw consent – at any time, without affecting prior processing

You can exercise most of these rights directly inside the app: delete your account from Settings, disable push notifications from your device settings, or remove any listing from your profile. For all other requests, contact: support@onestride.ch. A response is normally provided within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). For users in the EEA, please contact your national data protection authority.

09 Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest on Supabase storage
• Passwords stored as salted bcrypt hashes – never in plain text
• Row-Level Security (RLS) policies on the database to enforce access rules
• Rate-limiting and abuse detection on authentication and chat endpoints
• Automated rolling backups (up to 30 days)
• Strict access control: only Manon Rudin has administrative access

No system can guarantee absolute security, but we continuously review and improve these measures.

10 What We Do Not Use

For transparency, we want to be explicit about what we deliberately avoid:

• No Google Analytics, Meta Pixel, TikTok Pixel, or similar tracking pixels
• No Hotjar, FullStory, or session-replay tools
• No advertising networks and no sale of personal data
• No automated decision-making or profiling within the meaning of Art. 22 GDPR
• No third-party cookies on the website

11 Children

The Platform is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12 Disclaimer of Liability

We are not liable for any losses, damages, or fraud arising from use of the Platform – including transactions initiated or completed inside or outside the Platform. Use of the Platform is at your own risk.

13 Changes to This Policy

We update this Privacy Policy when legal requirements or our processing activities change. The current version is always available at onestride.ch/privacy-policy. Material changes are communicated by email to registered users.

14 Contact