This policy explains what personal information YardHub collects, why, how long we keep it, and what rights you have over it. It applies to everyone who uses the YardHub platform — yard owners, administrators, grooms, work riders, horse owners, lessees, and the external care practitioners (vets, farriers, dentists, physios/chiros, saddle fitters) a yard adds as contacts.
We have written this in plain language wherever we could. Where a legal term matters, we have used the one the Protection of Personal Information Act 4 of 2013 (POPIA) uses, and — for any user based in the European Union/EEA — the equivalent term under the General Data Protection Regulation (GDPR).
1. Who is responsible for your information
YardHub is operated by YardHub (Pty) Ltd (registration number 2026/635057/07), of Aan de Weber Estate, Jamestown, Stellenbosch, Western Cape, 7600 ("YardHub", "we", "us"). YardHub's software is built and operated day-to-day by EWO Solutions (Pty) Ltd, acting on YardHub's instructions as a service provider (see Section 4).
Two different roles apply depending on whose information it is:
- Your yard is the Responsible Party (POPIA) / Data Controller (GDPR) for the information it enters about its horses, horse owners, lessees, staff, and care practitioners. Your yard decides what goes into YardHub and who on its team can see it; we process it on the yard's instructions. If you have a question about information a specific yard holds about you, your first point of contact is that yard, not us directly.
- YardHub (Pty) Ltd is the Responsible Party / Controller for account-level information about the people who sign in to YardHub (your login credentials, your own profile, and how you use the platform), and acts as the Operator (POPIA) / Processor (GDPR) for everything a yard enters about horses and the people connected to them.
2. What we collect
Account information
- Name, email address, phone number
- Role(s) within the yard (e.g. Yard Owner, Groom, Vet)
- A securely hashed password — we never store or can see your actual password
- Session data needed to keep you signed in (see our Cookie Policy)
Horse information, entered by your yard
- Name, breed, date of birth, sex, colour, height, markings
- Passport number and microchip number
- Photos (including the horse's own photo and documents such as a passport scan)
- Medical and care history: veterinary visits, farrier/dentist/physio visits, vaccinations, deworming, chronic medication, saddle fitting records, and any notes a care team member adds
- Ownership and leasing relationships (who owns or leases the horse)
Operational information
- Tasks, feeding schedules and completions, yard notes, activity/operations logs
- Billing-related activity records (what was billable, and the amount) where a yard uses that feature
Technical information
- Standard web server logs (IP address, browser/device type, pages requested) via our hosting provider
- Error and diagnostic logs, which we deliberately keep free of passwords and other sensitive values
3. Why we use it, and on what legal basis
- To provide the service — running the features a yard uses, such as care scheduling, horse records, and billing. Basis: performance of our contract with the yard.
- To keep accounts secure — authentication, session management, abuse/fraud prevention (including the rate-limiting described in our security measures below). Basis: legitimate interest in keeping the platform and its users safe.
- To communicate with you — password resets, account notifications, and onboarding emails. Basis: contract performance and legitimate interest.
- To meet legal obligations — e.g. keeping certain records for the periods the law requires. Basis: legal obligation.
- To improve YardHub — understanding how the product is used so we can fix problems and build what's needed. Basis: legitimate interest, kept to what's necessary and never used to build a profile of you for advertising.
4. Who we share it with
We do not sell personal information. We share it only with the service providers (POPIA "operators", GDPR "processors") that help us run YardHub, each bound by a data processing agreement limiting them to our instructions:
- EWO Solutions (Pty) Ltd — software development and hosting operations for YardHub
- Vercel Inc. — application hosting and edge infrastructure
- Prisma Postgres — our database
- Supabase / Amazon Web Services (S3) — storage for uploaded photos and documents
- Resend — delivery of account and notification emails
We may also disclose information where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets — in which case we'll tell affected users before information is transferred and becomes subject to a different privacy policy.
5. International transfers
Current state, stated plainly: YardHub's application and database are currently hosted in the United States (via Vercel's Washington, D.C. region). This means personal information is transferred outside South Africa and processed there. We rely on our hosting and infrastructure providers' standard contractual safeguards for this. A migration to a South African hosting region is planned specifically to remove this cross-border transfer; once complete, this section will be updated and the transfer will no longer be necessary for most processing.
6. How long we keep it
- Active accounts and horse records: for as long as your yard actively uses YardHub.
- Horse and Care/Activity records, after a yard's account closes or a horse is archived: retained for 7 years, matching standard South African record-keeping expectations for financial and veterinary-adjacent records, then permanently deleted.
- A departed Care Team member's own profile: anonymised promptly on deletion (see Section 7) — their name/email/phone are removed, but Care/Activity entries they created are kept (with their role at the time, not their identity) so the horse's history stays complete.
- Sessions: expire automatically after 30 days, or immediately on sign-out or password change.
- Password-reset and login-attempt records: kept only for the short window needed to apply rate limiting, then automatically removed.
7. Your rights
Subject to the limits the law allows, you can:
- Access the personal information we hold about you
- Correct information that's inaccurate or out of date
- Request deletion of your information, subject to what we're required to retain by law (Section 6)
- Object to certain processing, or ask us to restrict it
- Request a copy of your information in a portable, machine-readable format
You can download a copy of your own account data (profile, horses you're linked to, activity you've logged, messages, login sessions) at any time from the Download my data link in the account menu in the app.
If the information is about a horse, owner, or other record your yard entered, start with your yard — they're best placed to action it directly in YardHub, and will usually be faster than going through us. For anything about your own YardHub account, or if your yard can't help, use the Request account deletion link in the account menu in the app, or contact us using the details in Section 10.
You also have the right to complain to the Information Regulator (South Africa) — see inforegulator.org.za — or, if GDPR applies to you, your local supervisory authority.
8. Security measures
We protect personal information with layered technical measures, including:
- Passwords stored only as salted bcrypt hashes, never in plain text
- Session cookies that are HTTP-only, Secure, and SameSite-restricted, invalidated on password change
- Role-based access control, scoped per yard, enforced on every request
- Rate limiting on sign-in and password-reset to resist brute-force attempts
- Encryption in transit (HTTPS) everywhere
- An audit trail of access to sensitive records
No system is perfectly secure, but we treat this as an ongoing commitment, not a one-time project — this policy is updated as our measures improve.
9. Children's information
YardHub is a business tool for yard operators, horse owners and care practitioners. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.
10. Contact us
Our Information Officer is Jackie Lochner, owner of YardHub (Pty) Ltd. Until her registration with the Information Regulator is complete, please direct any privacy question, access/correction/deletion request, or complaint via yardhub.co.za/contact.html or info@yardhub.co.za.
11. Changes to this policy
We'll update this page when what we do changes, and update the "Last updated" date at the top. For a material change, we'll make reasonable efforts to let yards know directly.