Privacy Policy
How PoloPonies handles your data.
This policy explains what personal data PoloPonies collects, why we collect it, who can see it and the rights you have over it. We have kept it short and honest — if anything is unclear, email us and we will explain.
01Who we are
Codefox LLC-FZ, trading as “PoloPonies”, is the data controller for personal data processed through poloponies.co.uk. Our registered office is Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. For anything privacy-related, email hello@poloponies.co.uk.
02The personal data we collect
- Account data — your email address and password credentials, handled by Supabase Auth. Passwords are stored in hashed form; we never see them in plain text.
- Phone number — sellers verify a mobile number with a one-time SMS code before listing; we store the verified number so buyers can contact you.
- Listing content — the details, photos and videos you choose to publish about a pony.
- Contact-reveal logs — when a signed-in user reveals a listing’s contact details, we record which account revealed which listing’s contact, and when.
- Reports and moderation records — reports you make about listings, and our records of moderation decisions.
- Reviews and replies — reviews you leave about sellers, and sellers’ public replies.
- Technical and security logs — IP addresses and similar technical records generated as you use the site, kept for security and anti-abuse purposes.
We collect nothing more than the service needs, and we do not buy data about you from anyone.
03Why we use it, and our lawful bases
Under UK data protection law we need a lawful basis for each use of your data. Ours are:
| What we do | Lawful basis |
|---|---|
| Running your account, publishing your listings and showing your contact details to signed-in buyers who request them | Performance of a contract — Article 6(1)(b) |
| Verifying sellers’ phone numbers by SMS one-time code | Performance of a contract — Article 6(1)(b) |
| Logging contact reveals, applying rate limits, handling reports, moderating content and keeping security logs | Legitimate interests — Article 6(1)(f): keeping the marketplace safe and preventing abuse and fraud |
| Sending emails essential to the service, such as sign-in and account emails | Performance of a contract — Article 6(1)(b) |
| Marketing communications — we send none today | Consent — Article 6(1)(a): we would ask you first |
04Who can see what
- Published listings, photos and videos are public — visible to anyone, including search engines. Listing photos are served from public storage, so anyone with a photo’s web address can view it.
- Your phone number is not public. It is shown only to signed-in users who ask to reveal contact details for one of your specific listings, presented as a WhatsApp link. Each reveal is logged, and reveals are rate-limited per user per day.
- Reviews and seller replies are public alongside the seller’s profile.
- Reports are confidential — we do not tell a seller who reported their listing.
We never sell your personal data. Ever. We may disclose personal data where the law requires it — for example, in response to a valid request from law enforcement.
05Our processors
A small number of service providers process personal data on our behalf, on our instructions and under data-processing agreements:
- Supabase — database, authentication and file storage, hosted in the European Union.
- Vercel — web hosting and content delivery.
- Resend — transactional email, EU region (eu-west-1).
06International transfers
Your data is hosted in the EU/UK by the processors above. Because Codefox LLC-FZ is established in the United Arab Emirates, limited access from outside the UK/EEA can occur — for example, when our team administers the service. Where it does, it is safeguarded by appropriate contractual protections, including standard contractual clauses supplemented by the UK addendum where applicable.
07How long we keep your data
- Account data — for as long as your account is active, and for a reasonable period after closure so we can handle any disputes and meet our legal obligations.
- Listings, reviews and replies — until you delete them or your account is closed.
- Contact-reveal logs and moderation records — for as long as reasonably needed for anti-abuse purposes, which may extend beyond account closure where necessary to prevent repeat abuse.
- Technical and security logs — for short rolling periods.
When data is no longer needed, we delete it or anonymise it.
08Your rights
Under UK data protection law you have the right to:
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict how we use your data in certain circumstances;
- receive the data you gave us in a portable, machine-readable format; and
- object to processing based on legitimate interests, and to any direct marketing.
To exercise any of these rights, email hello@poloponies.co.uk. We may need to verify your identity first, and we will normally respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority.
09Children
PoloPonies is not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account or that we hold a child’s data, contact us and we will remove it.
10Changes to this policy
We may update this policy from time to time — for example, if we add features or change providers. We will post the updated version here with a new “last updated” date, and if a change is significant we will tell you by email or by a prominent notice on the site.
11Contact
For anything about this policy or your personal data, email hello@poloponies.co.uk. See also our Terms of Service and Cookie Policy.