This Privacy Policy explains how HorseRaceDatabase ("HRDB", "we", "us") collects, uses, and protects personal data when you visit horseracedatabase.com, create an account, or subscribe to our datasets, API, or other Services.

• Account data: name, email address, and password (stored hashed) when you register.
• Order & subscription data: billing address, purchased products/plans, and subscription status, processed through WooCommerce.
• Payment data: handled directly by our payment processors, Stripe and PayPal - we do not store your full card or bank details.
• Usage data: pages visited, IP address, browser/device information, and API usage logs (where applicable), collected via cookies and server logs.
• Communications: any information you provide via our contact or support forms.

We process personal data on the following legal bases under the UK GDPR / EU GDPR:

• Contract performance - to create your account, process orders/subscriptions, and deliver the Services.
• Legitimate interests - to maintain security, prevent fraud, and improve the Services.
• Consent - for optional marketing communications, which you can opt out of at any time.
• Legal obligation - to meet accounting, tax, and regulatory requirements.

We use cookies and similar technologies for site functionality (e.g. keeping you logged in, shopping cart contents), performance/analytics, and, where you consent, marketing. You can control cookies through your browser settings; disabling some cookies may affect site functionality. See our Cookie Policy for details.

We share personal data only with:

• Payment processors (Stripe, PayPal) to process payments and subscriptions.
• Hosting and infrastructure providers who run the website and store data on our behalf.
• Email and support tools used to communicate with you.
• Authorities, where required by law.

We do not sell your personal data to third parties.

We retain account and order data for as long as your account is active and for a reasonable period afterward to meet accounting, tax, and legal obligations. You may request earlier deletion subject to those obligations - see "Your Rights" below.

Subject to applicable law (including UK/EU GDPR), you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ("right to be forgotten"); restrict or object to certain processing; request a portable copy of your data; and withdraw consent to marketing at any time. To exercise any of these rights, contact us via our contact form. You also have the right to lodge a complaint with your local data protection authority (in the UK, the ICO).

Where personal data is transferred outside the UK/EEA (for example, to a hosting or payment provider with infrastructure abroad), we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections.

We use reasonable technical and organisational measures (encryption in transit, access controls, hashed passwords) to protect personal data. No system is completely secure, and we cannot guarantee absolute security of data transmitted to us.

Our Services are not directed at, and we do not knowingly collect personal data from, individuals under 18.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, notify active account holders by email or an in-app notice.

For any privacy-related questions or to exercise your rights, please use our contact form.