Privacy Policy

This Privacy Policy explains how Stonehill Labs Limited (“we”, “us”, “our”) collects, uses, and protects personal data when you or your organisation uses Alivio (the “Service”). It applies to visitors to our website at alivio.org.uk and to customers of the Alivio app and related services.

We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Stonehill Labs Limitedis a company registered in England and Wales, company number 17184769, with registered office at 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. We are the data controller for personal data collected through our website and marketing activities. For personal data processed on behalf of our customers within the Alivio app, we act as a data processor — see the section “When we are a processor, not a controller” below.

Stonehill Labs Limited is registered with the UK Information Commissioner’s Office under registration number ZC134416.

For data protection matters — including any of the rights described in this policy — email data@alivio.org.uk. General privacy queries can be sent to privacy@alivio.org.uk.

What personal data we collect

When you visit our website

• Email address if you contact us
• Basic technical information including IP address, browser type, and pages visited, collected by our hosting provider (Vercel) and CDN (Cloudflare) for security and operational purposes

When you sign up for an account

We are the data controller for the information you give us when creating an account and for your billing records. We collect:

• Your name, email address, and a password (which we store only as a cryptographic hash — we never see or keep the password itself)
• Your yard’s name and county, which identify the account and help us support you
• A record that you accepted our Terms, Privacy Policy, and Data Processing Agreement — comprising the version of each document you accepted, a timestamp, your IP address, and your browser’s user-agent string. We keep this as evidence of acceptance; see “How long we keep your data” below.

When you subscribe and pay

Payments are handled by Stripe, our payment processor. When you subscribe, Stripe collects your card details directly through its own hosted checkout — card numbers never reach our systems and we cannot see them. We receive and store your name, email address, subscription plan, billing interval, renewal dates, and Stripe’s identifiers for your customer and subscription records, so that we can manage your account and provide the plan you have paid for.

Stripe processes this data as our sub-processor and, for fraud prevention and its own regulatory obligations, as an independent controller. Stripe’s own privacy notice is at stripe.com/gb/privacy.

Cookies

We use only strictly necessary cookies. When you sign in at alivio.org.uk we set a session cookie that keeps you logged in and protects the sign-in process; without it the signed-in areas of the site cannot work. Because these cookies are strictly necessary to deliver a service you have asked for, they do not require consent and we do not show a cookie banner.

We do not use marketing or advertising cookies on our website. We do not use Google Analytics or comparable third-party analytics services, and we do not track you across other websites.

When you use the Alivio app

If you are a yard staff member, instructor, or other user of a customer’s Alivio account, we process:

• Your name and email address as provided by your yard manager when adding you as a team member
• Login records — when you sign in, what device, IP address
• Activity logs — what records you create or modify within the app
• Photographs you upload which may incidentally include images of people
• Product analytics — events about how the app is used (for example, which screens are opened or which features are used), processed via PostHog in its EU region. These events are linked to your account through a pseudonymous identifier, and we hold a usage profile recording non-sensitive attributes such as your role and subscription tier. We never include names, email addresses, notes, photographs, or other directly identifying content in analytics, and we do not use this data to track you across other companies’ apps or websites.

Within customer accounts, customers (the yards using Alivio) may also record names and contact information of horse owners, vets, farriers, and other practitioners. We process this data on behalf of our customers under the terms of our Data Processing Agreement.

Horse welfare and health records themselves are not personal data under UK GDPR.

Why we collect this data — and our lawful bases

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Contract— to provide the Alivio service to customers and their team members, and to communicate about the service
• Legitimate interests— to keep our service secure, prevent abuse, improve the product, and respond to enquiries. Our legitimate interests do not override your fundamental rights and freedoms.
• Consent— where required, such as for optional marketing emails. You can withdraw consent at any time by emailing privacy@alivio.org.uk.
• Legal obligation— to comply with tax, accounting, and other legal requirements

How long we keep your data

• Marketing list emails (from our historical early-access list): until you unsubscribe, or 24 months of inactivity, whichever is sooner
• Customer account data: for the duration of your subscription, plus 30 days after cancellation, after which it is permanently deleted. That 30-day window is a grace period before deletion, not a promise of an export — exporting your records is a Plus plan feature, so export what you need while your subscription is active. If you would rather not wait out the 30 days, deleting your account yourself in the app removes the data from our active systems straight away — see delete your account.
• Backups: encrypted backups are retained for up to 30 days after primary deletion before being overwritten
• Financial records: 7 years, as required by UK tax law
• Legal-acceptance logs: records evidencing that you accepted our legal terms (the version accepted, a timestamp, and IP address) are retained for the duration of your account and up to 6 years afterwards, in line with the limitation period for contractual claims, after which they are deleted

Who we share your data with

We do not sell personal data and do not share it for advertising purposes. We share data only with the third-party service providers (“sub-processors”) who help us deliver the service. See our full sub-processors page for the current list.

Where any sub-processor is based outside the UK, we rely on the UK Information Commissioner’s Office–approved transfer mechanisms, including the UK International Data Transfer Agreement, the EU-US Data Privacy Framework where applicable, and signed Data Processing Agreements.

When we are a processor, not a controller

When you use the Alivio app as part of a customer’s account, the customer (your yard or organisation) is the data controller for the data they enter and we act as their data processor. We process that data only according to their instructions and our Data Processing Agreement. For data protection requests relating to data held within a customer account, contact the customer (your yard or organisation) directly.

Your rights

Under UK GDPR you have the following rights:

• Access— request a copy of the personal data we hold about you
• Rectification— ask us to correct inaccurate data
• Erasure— ask us to delete your data, subject to certain exceptions. You can also delete your account at any time
• Restriction— ask us to stop using your data in certain ways
• Portability— receive your data in a portable format
• Objection— object to our processing in certain circumstances
• Withdraw consent— where we rely on consent

To exercise any of these rights, email data@alivio.org.uk. We will respond within one calendar month.

You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Security

We protect your data with appropriate technical and organisational measures. These include encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, principle of least privilege across our team, multi-factor authentication for administrative access, and regular review of our security practices.

No system is completely secure. If we ever experience a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

AI and machine learning

We do not use customer data to train artificial intelligence or machine learning models — either our own or those of any third party. We do not sell customer data to AI developers.

Children

Alivio is a tool for adults working at riding schools and livery yards. Accounts are for people aged 16 or over, and our Terms of Service require our customers not to create accounts for, or record team members who are, under 16. We do not knowingly collect personal data from anyone under 16.

If you believe a yard has added someone under 16 to its account, tell us at data@alivio.org.uk and we will remove the data.

Changes to this policy

When we update this policy, we will change the “Last updated” date at the top. For material changes, we will notify customers by email at least 30 days before the changes take effect.

Contact

For any questions about this policy or about how we handle personal data, email privacy@alivio.org.uk. Our full contact details are on our contact page.