Privacy Policy

Last updated: 7 March 2026

1. Who We Are

EquiAnalytix Limited (“we”, “us”, or “our”) is a company registered in England and Wales. We operate the EquiAnalytix website at equianalytix.com and associated mobile applications (collectively, the “Services”).

We are the data controller for the personal data collected through our Services. This means we are responsible for deciding how and why your personal data is used.

If you have any questions about this policy or how we handle your data, please contact us:

2. What Personal Data We Collect

2.1 Data you provide directly

When you register for an account, subscribe to our Services, submit a form, or contact us, we may collect:

• Your name and email address
• Billing address and payment method details (processed securely by third-party payment processors — we do not store full card details)
• Username and encrypted password
• Social media profile information, if you choose to register or sign in via a social media platform
• Phone number, company name, and project details (if you submit a contact or enquiry form)
• Any other information you include when contacting us directly

2.2 Data we collect automatically

When you access our Services, we may collect the following automatically:

• Usage data: pages visited, time spent on pages, features used, and navigation paths
• Device information: IP address, browser type and version, operating system, device type, and unique device identifiers
• Approximate location data, derived from your IP address
• Performance data: page load times and web vitals, collected by our hosting and analytics providers

2.3 Cookies, local storage, and tracking technologies

We use cookies, local storage, and similar tracking technologies on our website. A cookie is a small data file stored on your device. Local storage (including localStorage and IndexedDB) allows us to store data on your device for caching and preference purposes.

Types of cookies and tracking technologies we use:

• Essential cookies and local storage — necessary for the website to function, including authentication tokens, consent preferences, and cached racing data. These cannot be switched off.
• Analytical/performance cookies — help us understand how visitors use our site, including pages visited, time spent, and performance metrics. These include Google Analytics (GA4), Google Tag Manager, and Vercel Analytics.
• Targeting/advertising cookies — used for conversion tracking and to measure the effectiveness of advertising campaigns. These include the X (formerly Twitter) conversion tracking pixel.

We implement Google Consent Mode v2 to manage analytics and advertising consent. When you first visit our site, a cookie banner will appear allowing you to accept or reject non-essential cookies. You can also control cookies through your browser settings at any time. Please note that disabling certain cookies or clearing local storage may affect the functionality of our Services.

On-device storage we use:

• localStorage: consent preferences, selected race meeting, selected race ID, and saved filter strategies
• IndexedDB: cached racing data and ratings for improved performance

3. Our Lawful Basis for Processing

Under UK GDPR, we are required to have a lawful basis for each use of your personal data. We rely on the following:

• Contract performance — to provide the Services you have signed up for, process your subscription, and manage your account
• Legitimate interests — to improve our Services, ensure security, prevent fraud, and understand how users interact with our platform. We have assessed that our legitimate interests are not overridden by your data protection rights in these cases
• Consent — for non-essential cookies (including analytics and advertising tracking) and for sending you marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal
• Legal obligation — where processing is necessary to comply with a legal or regulatory requirement

4. How We Use Your Personal Data

We use the personal data we collect to:

• Create and manage your account and provide access to our Services
• Process payments and manage your subscription
• Respond to your enquiries and provide customer support
• Send you service-related communications (account confirmations, subscription updates, security notices)
• Send you marketing communications, where you have opted in
• Analyse how our Services are used and improve their performance and functionality
• Measure the effectiveness of advertising campaigns via conversion tracking
• Cache data on your device to improve performance and enable offline access
• Detect and prevent fraud, abuse, or other harmful activity
• Comply with our legal and regulatory obligations

We will not use your personal data for any purpose incompatible with those described in this policy without first informing you and, where required, obtaining your consent.

5. Marketing Communications

Where you have opted in, we may contact you by email with newsletters, product updates, and promotional content related to our Services.

You can opt out of marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email we send, or
• Contacting us directly at jake@equianalytix.com

Opting out of marketing does not affect your receipt of service-related communications.

6. Sharing Your Personal Data

6.1 Service providers

We share personal data with third-party service providers who assist us in operating our Services. These providers act as data processors on our behalf and are only permitted to process your data in accordance with our instructions. Our current providers include:

Authentication and account management:

• Memberstack — account creation, authentication, and subscription management. Privacy Policy

Payment processing:

• Stripe — payment processing and billing portal. Privacy Policy
• RevenueCat — in-app purchase and subscription management (mobile app). Privacy Policy
• Apple App Store / Google Play Store — app distribution and in-app purchase processing

Analytics and advertising:

• Google Analytics (GA4) — website analytics and usage data (consent required). How Google uses data. You can opt out by installing the Google Analytics Opt-out Browser Add-on
• Google Tag Manager — tag management for analytics and conversion scripts
• Vercel Analytics — website performance monitoring and usage analytics. Privacy Policy
• X (formerly Twitter) Conversion Tracking — advertising conversion measurement (consent required)

Email marketing:

• Mailchimp (Intuit Inc.) — email marketing and newsletters. Privacy Policy

Form processing:

• Formspree — processing contact form and enquiry form submissions. Privacy Policy

Infrastructure and hosting:

• Vercel — website hosting and serverless functions. Processes HTTP requests including IP addresses and user agents. Privacy Policy
• Amazon Web Services (AWS) — data file hosting (S3). Your browser connects directly to AWS to retrieve racing data, meaning AWS may process your IP address

Data providers:

• The Racing API — horse racing odds and racecard data. We query this API on our servers; your personal data is not sent to this provider

Each provider operates under its own privacy policy. We encourage you to review those policies directly via the links above.

6.2 Legal disclosures

We may disclose your personal data where required by law, or in response to a valid request from a law enforcement authority or regulatory body. We may also disclose your data where we reasonably believe it is necessary to protect the rights, property, or safety of EquiAnalytix Limited, our users, or others.

6.3 Business transfers

If EquiAnalytix Limited is involved in a merger, acquisition, or sale of assets, your personal data may form part of the transferred assets. We will notify you before your data becomes subject to a different privacy policy.

We do not sell your personal data to third parties.

7. International Transfers

Many of our third-party service providers are based in the United States, including Memberstack, Stripe, Formspree, Vercel, Mailchimp, and Google. Amazon Web Services hosts data in the EU (Stockholm region) but is a US-based company. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR. These may include:

• Transfers to countries recognised by the UK government as providing adequate data protection
• Use of the International Data Transfer Agreement (IDTA) or equivalent standard contractual clauses approved by the ICO

You can request further information about the safeguards we apply to international transfers by contacting us at jake@equianalytix.com.

8. How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:

• Account data — retained for the duration of your account, plus up to 6 years after closure to comply with our legal and financial obligations
• Payment records — retained for 6 years in accordance with UK tax and accounting requirements
• Marketing consent records — retained until you withdraw consent, plus a reasonable period thereafter to evidence the consent
• Analytics data — retained in aggregated, anonymised form; raw data retained for up to 26 months
• Contact form submissions — retained for up to 2 years after your enquiry is resolved, unless a longer retention period is required
• On-device cached data — stored locally on your device and can be cleared by you at any time through your browser settings

When data is no longer required, we delete or anonymise it securely.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of passwords and authentication tokens
• Secure HTTPS connections for all data transmission
• Payment processing handled entirely by PCI-DSS compliant third parties (Stripe, RevenueCat)
• Access controls limiting who within our organisation can access personal data

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

11. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request that we correct any inaccurate or incomplete data
• Right to erasure — to request that we delete your personal data in certain circumstances (also known as the “right to be forgotten”)
• Right to restriction — to request that we restrict the processing of your data in certain circumstances
• Right to data portability — to receive your personal data in a structured, commonly used format and to transmit it to another controller
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes
• Rights relating to automated decision-making — to request human review of any automated decision that significantly affects you
• Right to withdraw consent — where we rely on consent as the lawful basis, you may withdraw it at any time

To exercise any of these rights, please contact us at jake@equianalytix.com. We will respond within one month of receiving your request. There is no charge for making a request, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

12. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at jake@equianalytix.com.

13. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policy of any third-party site you visit.

14. Children

Our Services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us immediately at jake@equianalytix.com and we will take steps to delete it.

EquiAnalytix is a horse racing data analytics platform. We do not accept, facilitate, or promote betting or gambling of any kind. Our Services provide statistical analysis, ratings, and publicly available odds data for informational and educational purposes only.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “last updated” date at the top of this page and, where appropriate, notify you by email or through a notice on our website.

Where changes affect the way we process your personal data or the lawful bases we rely on, we will notify you and, where required by law, obtain your consent before the changes take effect. We encourage you to review this policy periodically.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:

• By Email: jake@equianalytix.com
• By Mail:
  EquiAnalytix Limited
  Agincourt House
  14 Clytha Park Road
  Newport, UK
  NP20 4PB

This Privacy Policy is intended to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. While we have taken care to ensure this policy is comprehensive and accurate, we recommend periodic review by a qualified data protection professional, particularly as the business and its data processing activities evolve.