Personal data
Privacy policy
In line with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and French Law no. 78-17 of 6 January 1978 (as amended).
1. Scope
This policy covers the two services operated by Hoofbook:
- — the marketing site hoofbook.app (information about the product);
- — the platform go.hoofbook.app (application that farriers can access after creating an account).
It is structured in two parts: the first describes the data processed when you visit the marketing site; the second, more detailed, describes the data processed when you use the platform.
2. Data controller
0x Technologies LLC
- Legal form
- Limited Liability Company (LLC) under US law, registered in the State of Wyoming, United States
- Address
- Northwest Registered Agent Service, Inc.
30 N Gould St, Ste N
Sheridan, WY 82801
United States - Wyoming Secretary of State — Filing ID
- 2025-001740476
- GDPR contact
- contact@hoofbook.app
Hoofbook is a product published and operated by 0x Technologies LLC.
Representative in the European Union (Article 27 GDPR)
0x Technologies LLC is a controller established outside the European Union. The Publisher does not, at this stage, designate a representative in the European Union within the meaning of Article 27 of the GDPR: it considers that the processing remains occasional in view of the size and nature of the activity, that it does not involve special categories of data (Article 9) or data relating to criminal convictions (Article 10) on a large scale, and that it is not likely to result in a high risk to the rights and freedoms of data subjects — the conditions provided for in Article 27(2) of the GDPR.
To exercise your rights or for any data-protection question, the address contact@hoofbook.app remains the main point of contact. No Data Protection Officer (DPO) has been designated, as this designation is not mandatory given the Publisher's activity.
3. Hoofbook: a dual role with respect to data
When you use Hoofbook, two distinct processing activities coexist:
a. Hoofbook is the controller
For your own personal data as a farrier — your account, your billing, usage and security logs. This policy covers that processing.
b. Hoofbook is a processor
For the personal data of the people you record in the platform — your clients, stable owners, their contacts. You remain the controller of that data. The terms are governed by the Data Processing Agreement (DPA).
Part I
Data on the marketing site (hoofbook.app)
4. Data collected on the site
The marketing site has no newsletter sign-up and uses no tracking cookies, advertising trackers or audience-measurement trackers. Three data flows can nonetheless exist:
a. Connection data
When you visit a page, your browser automatically sends our host — Cloudflare, Inc. — certain technical information: IP address, browser type, page visited, referrer page, timestamp. This data is recorded in server logs.
Legal basis: legitimate interest — security, fraud prevention, operation and improvement of the service (Article 6.1.f GDPR).
b. Email correspondence
If you write to contact@hoofbook.app, we receive and keep your email address and the content of your message for the time needed to handle your request.
Legal basis: legitimate interest, or — if the request precedes a contract — pre-contractual measures (Article 6.1.b GDPR).
c. Booking a walkthrough on the marketing site and platform
Cal.com, Inc. provides the booking calendar on hoofbook.app and go.hoofbook.app. Your browser contacts Cal.com only when you open the calendar. Once open, your browser exchanges data with Cal.com (IP address, technical browser data). If you book, we receive your name, email address, chosen time slot, time zone and anything you enter in the form. Cal.com processes this data on our behalf (see section 7).
Legal basis: pre-contractual steps taken at your request (Article 6.1.b GDPR) or, failing that, legitimate interest (Article 6.1.f GDPR).
Retention: 3 years from our last contact.
Part II
Data on the platform (go.hoofbook.app)
5. Categories of data processed on the platform
a. Account data
Email address, password (hashed by Supabase Auth, never transmitted to Hoofbook in cleartext), display name.
b. Billing data
Handled by Creem (see section 7). Hoofbook only receives subscription metadata (status active/expired, plan chosen) and never stores card numbers.
c. Business data you enter
Information about your clients (name, phone, address), about horses (name, photos, care notes), about stables (addresses), about scheduling and hourly rates. For this data, Hoofbook acts as a processor — see the Data Processing Agreement (DPA).
d. Technical data
IP address, user agent, session timestamps, error logs.
e. Location data
GPS coordinates of stables and clients (computed via Mapbox when you drop a pin), routes (computed via HERE), local fuel prices (from the public API of the French government — see below).
If you book a walkthrough from the platform, see the section on booking with Cal.com.
Public data source — fuel prices: the platform queries the public API data.economie.gouv.fr (Etalab programme) to suggest the cheapest fuel stops on a route. Only geographic coordinates are sent; no user identifier is transmitted. This public data source does not constitute a processor relationship.
6. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide the service (account, business data) | Performance of the contract (Art. 6.1.b GDPR) |
| Billing and subscription tracking | Performance of the contract (Art. 6.1.b GDPR) |
| Transactional emails (trial reminders, password reset) | Performance of the contract (Art. 6.1.b GDPR) |
| Error tracking (Sentry) | Legitimate interest — security and reliability (Art. 6.1.f GDPR) |
| Protecting accounts from bots (Cloudflare Turnstile) | Legitimate interest — security (Art. 6.1.f GDPR) |
| Non-essential cookies and mapping telemetry | Consent (Art. 6.1.a GDPR) |
7. Sub-processors and recipients
No data is sold or rented to any third party. Platform data may be processed by the sub-processors below, acting on Hoofbook's instructions and under GDPR-compliant agreements meeting Article 28.
Sub-processor no. 1
Supabase, Inc.
- Role
- Database, authentication, file storage, edge functions
- Region
- EU-West (Ireland)
- Data received
- All account and business data — farrier's account, client list, horses, stables, schedule, addresses, photos
- Transfer mechanism
- No transfer outside the EU
- Privacy policy
- supabase.com/privacy
Sub-processor no. 2
Vercel Inc.
- Role
- Frontend hosting for go.hoofbook.app
- Region
- United States (HQ), global edge
- Data received
- IP address, user agent, request logs (no personal payload — application rendered client-side)
- Transfer mechanism
- SCCs + Data Privacy Framework
- Privacy policy
- vercel.com/legal/privacy-policy
Sub-processor no. 3
Mapbox, Inc.
- Role
- Mapping, geocoding, point picker for client and stable addresses
- Region
- United States
- Data received
- GPS coordinates of viewed points, public API token. Anonymous telemetry via events.mapbox.com
- Transfer mechanism
- SCCs + Data Privacy Framework
- Privacy policy
- www.mapbox.com/legal/privacy
Sub-processor no. 4
HERE Technologies
- Role
- Route calculation and toll matrix for the 'Cheapest route' mode
- Region
- EU (Netherlands)
- Data received
- Coordinates of every stop on a route and any departure time
- Transfer mechanism
- No transfer outside the EU
- Privacy policy
- legal.here.com/privacy
Sub-processor no. 5
Functional Software, Inc. (Sentry)
- Role
- Frontend error tracking
- Region
- EU (Germany — ingest.de.sentry.io)
- Data received
- Stack traces, browser version, URL where the error occurred. May incidentally include personal data if present in strings
- Transfer mechanism
- No transfer outside the EU
- Privacy policy
- sentry.io/privacy
Sub-processor no. 6
Armitage Labs OÜ
- Role
- Payment collection — Merchant of Record (Creem is the official seller, not Hoofbook)
- Region
- EU (Estonia)
- Data received
- Name, email, billing address, VAT number, payment data
- Transfer mechanism
- No transfer outside the EU
- Privacy policy
- www.creem.io/privacy
Sub-processor no. 7
Resend, Inc.
- Role
- Sending transactional emails (trial reminders, password reset)
- Region
- United States
- Data received
- Email address, name, email content
- Transfer mechanism
- SCCs + Data Privacy Framework
- Privacy policy
- resend.com/legal/privacy
Sub-processor no. 8
Cloudflare, Inc. (Turnstile)
- Role
- Protecting forms from bots: login, signup, password reset and change, resending verification emails, and email change. Cloudflare acts as a sub-processor for this detection, and as a controller when it uses this data to improve its bot detection
- Region
- United States (headquarters), global network
- Data received
- IP address, technical details of the browser and device (user agent, TLS fingerprint), the site requesting the check
- Transfer mechanism
- Data Privacy Framework; otherwise SCCs
- Privacy policy
- www.cloudflare.com/turnstile-privacy-policy/
Hoofbook uses Cal.com for walkthroughs booked from the marketing site or the platform. Cal.com is involved only when you open the calendar.
Walkthrough booking processor
Cal.com, Inc.
- Role
- Demo booking: the booking calendar available on hoofbook.app and go.hoofbook.app, when you open it
- Region
- United States (Cal.com processes data in the United States; some of its own sub-processors may process it elsewhere)
- Data received
- If you book: name, email address, chosen time slot, time zone and anything entered in the form. As soon as you open the calendar: IP address and technical browser data
- Transfer mechanism
- EU–US Data Privacy Framework (certification stated by Cal.com); otherwise Standard Contractual Clauses
- Privacy policy
- cal.com/privacy
Cal.com itself uses sub-processors; its list is published at trust.cal.com.
8. Transfers outside the European Union
Several sub-processors involve transferring data outside the European Union. For each of them, the transfer is framed by a mechanism provided for in Chapter V of the GDPR:
- — Vercel (United States) — Standard Contractual Clauses (SCCs) + EU–US Data Privacy Framework membership;
- — Mapbox (United States) — SCCs + Data Privacy Framework;
- — Resend (United States) — SCCs + Data Privacy Framework;
- — Cal.com (United States) — EU–US Data Privacy Framework (certification stated by Cal.com); otherwise Standard Contractual Clauses;
- — Cloudflare (United States) — EU–US Data Privacy Framework; otherwise Standard Contractual Clauses;
- — Creem (Estonia) — No transfer outside the EU.
The other sub-processors (Supabase, HERE, Sentry) process data within the European Union and involve no transfer outside the EU.
9. Retention periods
| Category | Duration |
|---|---|
| Active account | Duration of the subscription |
| After termination | 30 days (export available), then permanent deletion |
| Subscription metadata (status, plan) | Duration of the contract + 30 days |
| Sentry error logs | 90 days |
| Resend email logs | 30 days |
| Essential cookies and sessions | See the cookie policy |
10. Security
The technical and organisational measures in place include in particular:
- — TLS 1.2 or higher on all connections;
- — encryption at rest on Supabase databases;
- — Postgres Row Level Security: multi-tenant isolation at the database level — one user cannot technically access another's data;
- — mandatory email verification on sign-up;
- — automatic daily backups via Supabase.
Common part
Your rights and other provisions
11. Cookies
The marketing site sets no cookies of its own and uses no tracking, advertising or audience-measurement cookies. If you open the demo booking calendar from either site, Cal.com may set a security cookie and store a booking identifier in your browser for the service you requested. The platform also uses essential cookies for authentication and, after your consent, some measurement and mapping cookies. The full breakdown is in the cookie policy .
12. Your rights
Regarding data about you, you have the following rights:
- — right of access;
- — right to rectification;
- — right to erasure;
- — right to restriction of processing;
- — right to object;
- — right to portability — a full CSV export of your data is available at any time from your account settings, including in read-only mode.
To exercise these rights, write to contact@hoofbook.app . A reply is sent within one month, in line with Article 12.3 GDPR.
You also have the right to lodge a complaint with the French data-protection authority, the Commission nationale de l'informatique et des libertés (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris cedex 07 — cnil.fr.
13. Changes to this policy
Any substantial change will be announced 30 days in advance by email and via a banner in the platform. Continued use after that date constitutes acceptance of the new terms. The last-updated date is shown below.