Privacy policy

Who we are

Stability is made by Design Box Digital Pty Ltd (ABN 51 657 551 169), 711/1 Queens Rd, Melbourne VIC 3004 ("we", "us"). This policy explains how we handle personal information on our website, stability.software, and in the Stability app at app.stability.software. We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), and we apply them to all of our handling whether or not an exemption could apply to us.

Stability is used by racing stables, agistment farms, studs and float companies ("stables") to run their business. When a stable enters information about its staff, owners, suppliers and horses, the stable decides what to collect and why, and we store and process it to provide the service. The stable's own privacy policy also applies to that information. If you are an owner or staff member of a stable, you can ask the stable or us about it.

What we collect

From the website

If you use the contact or demo form, we collect your name, email address, phone number (optional), the type of operation, the approximate number of horses, the plan you are interested in, and your message. We don't use advertising or analytics trackers on the website.

In the app

Depending on how a stable uses Stability, the app holds:

• Account details for people who log in: name, email address, a hashed password (we never store it in readable form), two-factor authentication settings (the secret is encrypted) and recovery codes (stored hashed), sign-in sessions, and records of sign-in attempts used to protect accounts.
• Google sign-in details if you choose to sign in with Google (an optional feature that a stable must switch on): your Google account ID, the email address on your Google account and, when a new account is created from an invite, your name. We use these only to recognise you when you sign in. We don't receive your Google password, and we don't collect or store your Google profile picture. You can unlink Google in My account at any time.
• Contacts such as owners, staff, suppliers and vets: names, email addresses, phone numbers, addresses, roles and tags. Where a stable uses these features, it can also include an ABN, a date of birth or a licence number (for example for racing registration forms or float drivers); these fields are encrypted.
• Horse records: identity, ownership shares and history, locations and movements, treatments and health records, temperatures, feed checks, trackwork, trials, race entries and results.
• Billing records: charges, invoices, statements, credits, payments received, disputes, expenses and supplier bills, and prize money records (prize money is shown for information only).
• Bank account details where a stable chooses to record them: the stable's own account for payment instructions on its invoices and, if the stable uses the prize money distribution or direct debit features, an owner's account name, BSB and account number. BSBs and account numbers are stored encrypted. We never collect or store payment card details.
• Documents and photos uploaded by the stable, such as horse documents, owner update photos and bill attachments.
• Client notes written by stable staff about their contacts.
• Owner updates and notices sent to owners, and whether they were delivered.
• Audit logs that record who changed what and when, used for security and to resolve disputes.
• Technical information such as IP address, browser type and request logs, collected when you use the site or app.

We don't ask for sensitive information such as health information about people. Please don't put it in free-text notes unless it is needed.

Location for staff clock-in (upcoming)

We are building an optional staff clock-in feature. It is not switched on yet. When a stable turns it on, staff will be told in writing before it starts. The app will show a notice before the phone asks for location permission.

When a staff member clocks in or out on their phone, the app will check their location against the stable's site. For a normal clock-in we will keep only the distance from the site, the accuracy of the reading and whether it passed. Exact coordinates will be kept only for clock-ins that are flagged for a manager to check, and deleted after 90 days. Location is only checked at the moment of clocking in or out. Staff who don't want to share location can clock in another way, such as a PIN or manager approval. Time records will be kept for 7 years, as employment records.

How we collect it

We collect information directly from you (for example when you fill in the contact form or use the app), from the stable you deal with (for example when a trainer adds you as an owner), and automatically from your device when you use the site or app.

Why we use it

• to provide, secure and support Stability, including sign-in (and Google sign-in, if you use it), billing features, owner portals and emails the stable asks us to send;
• to reply to demo and contact requests;
• to keep accounts safe, detect misuse and keep an audit trail;
• to back up data so it can be restored;
• to meet our legal obligations.

We don't sell personal information. We don't use it for advertising.

Stability doesn't make decisions about people automatically. The app calculates things like invoice splits by ownership share, but the stable reviews and sends them.

Who we share it with

We use these service providers to run Stability:

Provider	What it does	Where data is held
Cloudflare, Inc.	Hosting for the website and app, file storage, backups, request logs, security	Global network; app files and backups in Cloudflare's Oceania region; logs may be processed overseas
Neon (Databricks, Inc.)	App database	Sydney, Australia (AWS ap-southeast-2)
Google LLC	Optional "Continue with Google" sign-in: confirms who you are and gives us your Google account ID, email address and name	United States and other countries where Google operates
Twilio SendGrid	Sending emails, such as demo requests, sign-in and security notices, and owner updates	United States

We also share information when a stable asks us to, for example when it invites a supplier through horse.work, and when the law requires it.

Overseas disclosure

Email addresses, names and email content pass through SendGrid in the United States. If you use Google sign-in, Google handles the sign-in in the United States and other countries, and sends us your Google account ID, email address and name. Cloudflare runs a global network, so requests and logs may be processed in other countries, including the United States. The app database is in Sydney. We take reasonable steps under APP 8 so these providers handle information consistently with the APPs.

How we protect it

• All traffic uses HTTPS.
• Each stable's data is kept separate using database row-level security.
• Sensitive fields, such as BSBs and bank account numbers, dates of birth and licence numbers, are encrypted.
• Two-factor authentication is available.
• Uploaded files are stored privately and are only served to signed-in users or through signed links.
• Changes are recorded in an audit log.

How long we keep it

We keep information while a stable uses Stability and for as long as we need it afterwards:

• Invoices, charges, other financial records and the audit log are kept for 7 years, which covers the 5-year minimum for tax records.
• When you delete your account, your name, email, phone and address are removed and you are signed out everywhere. Financial records stay for the 7 years above.
• Staff time records (once clock-in is available) are kept for 7 years. Exact clock-in coordinates are deleted after 90 days.

When we no longer need information, we delete or de-identify it.

Cookies and local storage

The website doesn't set cookies. The app uses a cookie to keep you signed in; it is necessary for the app to work. The app also saves some settings on your device, such as whether the menu is open and trackwork entries waiting to upload when you are offline, and it caches app files so the app can work as an installed app. We don't use advertising or tracking cookies.

Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing privacy@stability.software. If you have a login, you can also download a copy of your data or delete your account yourself in the app under My account › Privacy. If your information was entered by a stable, we may refer you to that stable or work with them to respond. We will respond within 30 days. We may refuse in limited cases allowed by law, and will tell you why.

Complaints

If you have a concern about how we handle your personal information, please email privacy@stability.software. We will acknowledge your complaint and aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Data breaches

If we have a data breach that is likely to cause serious harm, we will notify the people affected and the OAIC as required by the Notifiable Data Breaches scheme. Where the breach involves a stable's data, we will also tell the stable.

Changes and contact

We may update this policy. The latest version is always on this page. Questions: privacy@stability.software, or write to Privacy, Design Box Digital Pty Ltd, 711/1 Queens Rd, Melbourne VIC 3004.