Last updated: 1 May 2026 Platform: ridebase.ch
This policy covers all processing of personal data in connection with the ridebase.ch website, the dashboard, the newsletter and any business communications operated by the joint controllers.
Note: We update this text on an ongoing basis. Material changes are communicated by email to registered users.
1. Joint Controllers
RideBase is operated jointly by two private individuals who act as joint controllers within the meaning of Art. 5 lit. j revFADP (Switzerland) and Art. 26 GDPR (EU):
Lawrence Stadler Heuberg 16, 4051 Basel Switzerland
Nicola Fankhauser Heuberg 16, 4051 Basel Switzerland
Joint contact point for all data-protection matters:
- Email: info@ridebase.ch
- Website: https://ridebase.ch
Because we run RideBase as private individuals, there is no commercial-register entry and no Swiss UID. Please send all inquiries about this policy or about exercising your rights to the email address above.
2. Applicable Law
We process personal data under Swiss law (the revised Federal Act on Data Protection, revFADP, in force since 1 September 2023) and, where you are located in the European Economic Area, under the EU General Data Protection Regulation (GDPR). Where the two regimes diverge, we apply the stricter one.
3. Definitions
- Personal data: any information relating to an identified or identifiable natural person (e.g. name, email, IP address, location data).
- Processing: any operation performed on personal data (collection, storage, modification, disclosure, deletion).
- Data subject: the natural person whose data is being processed.
- Processor: an external service provider that processes data on our behalf (hosting, email delivery, error monitoring, etc.).
- Profiling: automated evaluation of personal aspects. RideBase does not engage in profiling.
4. Personal Data We Collect — and Why
4.1 Account creation & profile
When you create an account, we process:
- Required at registration: email address, password (hashed; never stored in plain text).
- Profile fields (optional, can be filled in later): first name, last name, phone, address (street, postcode, city, canton), preferred language, profile picture.
- Auth provider: when you sign in with Google, your Google account email, name and optional profile picture are used for authentication only.
Purpose: providing your account, authenticating you, displaying your name next to listings, allowing applicants to reach you. Legal basis: performance of contract (Art. 31 para. 2 revFADP, Art. 6(1)(b) GDPR).
4.2 Listings
When you create a listing, we store everything you voluntarily enter (horse description, location, photos, conditions). Listings are publicly visible on ridebase.ch — that is the purpose of the platform. Do not include sensitive information about third parties (health data, unsolicited phone numbers) in your descriptions.
4.3 Applications
When you apply to a listing, you submit: first name, last name, email, optional phone, and your message. The data is sent to the listing owner and made available to us so we can operate the platform and detect abuse. Guest applications without an account are possible.
4.4 Favorites
Logged-in users can save listings as favorites. We store only your user ID and the listing ID.
4.5 Contact form
When you use the contact form at /kontakt we store your name, email and message for processing. We send a confirmation to you and an internal notification to info@ridebase.ch.
4.6 Newsletter
Sign-up uses double opt-in. We store your email address, language, source, sign-up timestamp and an unsubscribe token, which provides a one-click unsubscribe link in every newsletter email. You can unsubscribe at any time — once unsubscribed, we remove your address from the distribution list and keep only an unsubscribe marker so we don''t contact you again.
4.7 Server logs
Every request automatically generates standard technical entries in our hosting provider''s server logs:
- IP address (anonymised/truncated after processing)
- User agent (browser and version)
- Referrer (the previous page, if transmitted)
- Date and time
- Requested path and HTTP status code
Purpose: stability, abuse detection, attack mitigation, rate-limiting. Legal basis: legitimate interest in stable, secure operation (Art. 31 para. 1 revFADP, Art. 6(1)(f) GDPR). Logs are overwritten automatically after 30 days.
5. Cookies and Local Storage
RideBase only sets technical cookies necessary for the operation of the service. We do not use tracking cookies, advertising cookies or third-party profiling cookies.
Cookie / entry Purpose Lifetimesb-* (Supabase Auth)
Logged-in user session
until logout / max 7 days
__Host-rb-csrf (when set)
CSRF protection on forms
session
LocalStorage rb-recent-listings
Recently viewed listings (browser-local only)
until browser cache is cleared
_ga, _gid, fbp etc.
not set
—
You can delete cookies in your browser at any time or block them entirely; you may then no longer be signed in and will need to log in again.
6. Processors
We use the following providers to operate the platform. Appropriate data-processing agreements are in place with all of them.
6.1 Supabase (database, authentication, storage)
Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 — region EU (Frankfurt). Data: account data, listing texts, images, applications, newsletter addresses. Storage: EU. More: https://supabase.com/privacy
6.2 Vercel (hosting & edge network)
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Data: server logs, IP addresses, request metadata at the delivery edge. Storage: edge PoPs worldwide, primary origin in the EU. Third-country transfer (USA): safeguarded via the EU-US Data Privacy Framework and EU Standard Contractual Clauses. More: https://vercel.com/legal/privacy-policy
6.3 Google Maps Platform (maps & address search)
Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Data: when displaying the map (/karte, listing detail) and during address autocomplete in the wizard / profile, your IP address, user agent and entered address fragments are transmitted to Google.
Third-country transfer: Google also processes data in the USA; safeguarded via the EU-US Data Privacy Framework.
More: https://policies.google.com/privacy
6.4 Google Identity Services (Sign in with Google)
When you click "Sign in with Google", a Google popup transmits your email address and profile name directly to ridebase.ch — without going through Supabase subdomains. No additional permissions are requested. Legal basis: consent by clicking the button.
6.5 Google reCAPTCHA v3
To protect our forms from automated abuse we use Google reCAPTCHA v3. Your interaction with the form is analysed in the background; Google receives your IP, browser data and mouse movements. More: https://policies.google.com/privacy and https://www.google.com/recaptcha/about/
6.6 Resend (transactional email)
Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Data: recipient email, mail content (welcome, application confirmation, listing reminders, newsletter confirmations, account actions). Third-country transfer (USA): EU Standard Contractual Clauses. More: https://resend.com/legal/privacy-policy
6.7 Sentry (error monitoring)
Provider: Functional Software, Inc. (Sentry), 132 Hawthorne St, San Francisco, CA 94107, USA — we use the EU region (Frankfurt). Data: on application errors, a stack trace, the path, user agent and optionally a pseudonymous user ID are transmitted. PII is scrubbed server-side before transmission (email, address, tokens). More: https://sentry.io/privacy/
6.8 Plausible Analytics (privacy-friendly analytics)
Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Data: anonymised aggregate page-view statistics — no cookies, no cross-site tracking, no personal identification. More: https://plausible.io/data-policy
7. Embedded Content and Third-Party Services We Do NOT Use
RideBase explicitly does not embed any of the following third-party components:
- No Facebook plugins (Like button, Pixel, Conversion API)
- No Instagram embeds, YouTube player or TikTok pixel
- No LinkedIn Insight Tag, Twitter/X pixel or Pinterest tag
- No Google Analytics
- No Google Ads / DoubleClick / Conversion Tracking
- No Hotjar, Mixpanel, Segment, Heap or Amplitude
- No affiliate trackers
Should we activate any of these in the future, we will update this policy before activation and obtain consent through a cookie banner where required.
8. Digital Marketing
8.1 Newsletter
- Sign-up via the newsletter form in the footer or on campaign pages.
- Double opt-in: confirmation email with a link; sending begins only after you click.
- Content: hand-picked new listings from your region, filter tips, occasional platform news.
- Frequency: typically once per week.
- Unsubscribe: one-click link in every newsletter, or send a short note to info@ridebase.ch.
- Legal basis: your consent (Art. 31 para. 1 revFADP; Art. 6(1)(a) GDPR; Art. 7 Swiss UWG).
8.2 Social Media Presence
We operate profiles on:
- Instagram — Meta Platforms Ireland Ltd.
- Facebook — Meta Platforms Ireland Ltd.
When you visit our profiles, interact with posts or send us a direct message, the respective platform processes your data under its own privacy policy — we have no control over that. The data we can see on our side (profile name, reactions, comments, DMs) we process exclusively to communicate with you and to maintain our account.
For Insights statistics on our pages, we are joint controllers (Art. 26 GDPR) with Meta (Instagram + Facebook). The terms are at https://www.facebook.com/legal/terms/page_controller_addendum
8.3 Online Advertising
We reserve the right to run targeted ads on platforms like Google Ads or Meta Ads (Instagram/Facebook) in the future. Currently no ad pixels or conversion trackers are installed on ridebase.ch. If we activate any, this policy will be updated to list the recipients, the data transmitted and the legal bases, and consent will be obtained via a consent banner where required.
8.4 Direct Email Communication
Emails to info@ridebase.ch are processed via our mail provider (Resend for outgoing transactional mail; the host''s IMAP mailbox for incoming mail). We reply directly and routinely delete conversations no longer needed after 24 months, unless a longer statutory retention period applies.
9. International Data Transfers
Transfers to countries outside Switzerland and the EEA (in particular to the USA) occur exclusively through the processors listed in Section 6. They are safeguarded through:
- the EU-US Data Privacy Framework (for certified providers such as Google, Vercel),
- EU Standard Contractual Clauses (SCC) under Commission Decision 2021/914,
- technical safeguards (encryption in transit and at rest, access controls).
Switzerland''s federal data-protection authority (FDPIC) recognises the EU-US Data Privacy Framework in parallel as the "Swiss-US DPF".
10. Retention Periods
We keep personal data only for as long as necessary for the relevant purpose or as legally required.
Data category Retention Account & profile Until deletion by you, or until inactivity suspension (≥ 24 months without login) Listings (published) 60 days from publication; renewable; automatically offline after expiry Applications Until the listing is closed, max 12 months; on account deletion, anonymised Favorites Until you remove them or delete your account Contact-form messages 24 months, then deletion Newsletter Until unsubscribe; thereafter only an unsubscribe marker Server logs 30 days Sentry error reports 90 days Audit logs (admin actions) 24 months Email correspondence 24 months11. Your Rights
As a data subject under revFADP and GDPR, you have in particular the following rights:
- Right of access (Art. 25 revFADP / Art. 15 GDPR): you can ask which data we process about you.
- Rectification (Art. 32 para. 1 revFADP / Art. 16 GDPR): we correct inaccurate data without delay.
- Erasure / right to be forgotten (Art. 32 para. 2 revFADP / Art. 17 GDPR): you can request deletion of your data.
- Restriction of processing (Art. 18 GDPR): in certain cases you can request that we keep but not further process the data.
- Data portability (Art. 20 GDPR): you receive your data in a structured, machine-readable format.
- Objection (Art. 21 GDPR): you can object to processing at any time, particularly for direct marketing.
- Withdrawal of consent: any consent given can be withdrawn for the future at any time.
- Complaint: to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (https://www.edoeb.admin.ch), or, if you reside in the EU, to your competent supervisory authority.
Self-service in your account
Many requests can be handled directly in your dashboard:
- Update profile: Dashboard → Profile
- Delete or archive listings: Dashboard → Listings
- Delete account permanently: Dashboard → Profile → "Delete account". This irreversibly removes your profile, listings, favorites and login. Applications you have sent to other listings remain with the recipient, anonymised.
- Unsubscribe newsletter: one-click link in every newsletter email.
For all other matters please write to info@ridebase.ch. We typically respond within 30 days.
12. Data Security
We take appropriate technical and organisational measures to protect your data:
- Transport encryption: TLS 1.2+ with HSTS preload on all connections.
- Database encryption at rest: AES-256 (Supabase standard).
- Passwords: bcrypt hashes only, never stored in plain text.
- Authentication: token-based with short lifetimes; brute-force protection rate-limited per IP and per account.
- Access control: service-role keys used only on the server; row-level security (RLS) on the database.
- Bot protection: Google reCAPTCHA v3 plus server-side honeypot fields.
- Backups with restore tests.
- Audit logs for administrative actions.
Despite these measures, internet data transmissions can never be made 100 % secure. Please report security issues immediately to info@ridebase.ch.
13. Profiling and Automated Decision-Making
RideBase fully refrains from automated profiling and from automated individual decisions with legal effect. There is no behavioural scoring, no creditworthiness assessment, no algorithmic ranking based on personal data.
14. Children and Minors
RideBase is intended for persons aged 16 and older. Persons under 16 require the consent of a legal guardian to open an account or publish a listing.
15. Changes to this Policy
We update this privacy policy when legal requirements or our processing activities change. The current version is always available at https://ridebase.ch/en/datenschutz. Material changes are communicated by email to registered users.
16. Contact
For questions about data protection or to exercise your rights:
- Email: info@ridebase.ch
- Mail: Heuberg 16, 4051 Basel, Switzerland
We typically respond within 30 days.