Pilot. Commercial launch 1 January 2027.
Privacy notice
In force from 5 November 2026. This notice explains how Pirou processes personal data under the EU General Data Protection Regulation (GDPR). The Finnish version prevails if the two differ.
Controller
Yakumama Holding Oy, business id 3667677-4, Rauduntie 11 D, 02130 Espoo, Finland. Data protection questions: [email protected].
Yakumama Holding Oy is the controller for user accounts and a rider’s own data. When a club manages its members, lessons, bookings and competitions in Pirou, the club is the controller of that data and we process it on the club’s behalf under section 13 of the terms of service. A club member can ask about this data either from the club or from us.
What data we process
| Data | What it contains | Where it comes from |
|---|---|---|
| Account | Name, email, language, roles, hashes of the password and the judge PIN | You |
| Rider profile | Name, birth year, home club, guardian, permission for lesson media | You or a guardian |
| Horses | Horse name and details | You or the club |
| Competitions | Entries, start lists, marks, judges’ comments, results | The organiser, the judge and you |
| Lessons and bookings | Booked lessons, participants, school horse, coach | You, the club and the coach |
| Journal | Rides, the horse’s condition, notes, tack | You |
| Lesson notes | The coach’s notes and the rider’s own notes, as text | The coach and you |
| Lesson media | Lesson videos and photos, comments, gait and position analysis results | You, a guardian and the coach |
| Messages and notifications | In-app messages and email notifications | Users and the service |
| Billing (from 1 January 2027) | Billing address, business id, e-invoice address, subscriptions and payment status | You, Stripe and NoCFO |
| Technical data | Login session, server logs, IP address | Your device |
Card details never reach Pirou. Stripe processes them.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the account, profiles, lessons, competitions and journal | Contract with you |
| Publishing the results of a closed class | Legitimate interest of the organiser and Pirou: competition results are public in the sport |
| A child’s lesson videos and photos | The guardian’s consent, which can be withdrawn on the child’s Media tab |
| Speech recognition through the browser’s cloud service | Your consent, asked before any audio leaves the device |
| Invoicing and bookkeeping | Contract and legal obligation (Finnish Accounting Act) |
| Security, preventing misuse and investigating faults | Legitimate interest |
| Developing the service based on usage figures | Legitimate interest. We do not profile users for marketing |
| Emails about the service | Contract. Message notifications can be turned off in your profile |
Who can see what
- The result of a closed class (name, horse, club, percentage) is public on the results page.
- A club’s public calendar and school horse page show lessons and horses, not the names of riders who booked.
- A coach’s booking page shows the coach’s name and free times.
- The journal is visible only to the rider and a child’s guardian. A coach sees an entry only when it is shared with them. A school horse’s page shows only that a ride happened and how long it lasted.
- Lesson videos and photos are visible to the rider, the guardian and that lesson’s coach. There is no public link, and a playback link expires after six hours.
- Notes published by the coach are visible to the rider and the guardian. The coach cannot see the rider’s own lesson notes.
- A club admin sees the club’s members and their roles, lessons and bookings.
AI and speech recognition
When a coach structures lesson notes or tidies a video comment, the text is sent to Anthropic, which structures it with its Claude AI model. The text may include riders’ first names and horses’ names. No audio is sent. The coach checks the result before publishing it. A rider’s own notes and journal are not sent to AI.
Speech is turned into text on your device where possible. If the device cannot recognise speech itself, the browser may use its maker’s cloud service. We ask for your permission before audio leaves the device. Pirou stores only the text, never the audio.
Gait detection and position analysis run on Pirou’s own server. Video is not sent elsewhere for them.
Pirou makes no automated decisions that have legal effects on you.
Service providers who process the data
| Provider | Task | Location |
|---|---|---|
| Neon | Database | AWS, Frankfurt (EU) |
| Railway | Application servers | EU |
| Cloudflare | Domain, website, file storage (R2), spam protection | Global network |
| Bunny.net | Storing and streaming lesson videos | EU, with copies in the United States and Singapore |
| Resend | Sending email | United States |
| Anthropic | Structuring lesson notes and comments | United States |
| Stripe (from 1 January 2027) | Card payments for Rider Pro | EU and United States |
| NoCFO (from 1 January 2027) | Invoicing and bookkeeping | Finland |
In addition, our accountant sees billing data, and we disclose data to authorities when the law requires it. We do not sell data or share it for marketing.
Transfers outside the EU
Some providers are US companies, so data may be transferred to the United States. Bunny.net also keeps copies of lesson videos in the United States and Singapore. Transfers to the United States rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses, and transfers to Singapore on standard contractual clauses.
How long data is kept
| Data | Retention |
|---|---|
| Account and profiles | Until you delete your account |
| Journal and own lesson notes | Until you delete the entry. A deleted entry is removed for good within 30 days |
| Lesson videos and photos | Until they are deleted or the rider’s account is deleted |
| Result of a closed class | Permanently, as part of the competition results |
| Invoices and accounting records | 6 years from the end of the financial year, under the Accounting Act |
| Server logs | As long as the provider keeps them |
| Club-managed data after the agreement ends | Deleted within 90 days |
When you delete your account
The login is removed, and your name and email address are replaced with data that does not identify you. The following are also removed:
- your journal entries and your own lesson notes
- your horses’ names and details
- your own movement notes on tests
- judges’ comments on your score sheets
- your lesson videos and photos and the video comments you wrote
The public result of a closed class (name, horse, club, percentage) stays, because it is part of the competition results. Invoices are kept for the period the Accounting Act requires.
Before deleting, you can download your data as a JSON file from your profile.
Cookies and browser storage
Pirou uses only storage that the service needs to work:
- The pirou_session cookie keeps you signed in.
- Browser storage remembers your language and keeps marks and notes made offline until they reach the server.
We do not use analytics or advertising cookies.
Children
A guardian creates the profile of a rider under 13 on the guardian’s own account, and the child has no login. The guardian can see, edit and delete the child’s data. Lesson videos and photos of a rider under 18 cannot be added until a guardian has given permission.
Your rights
You have the right to:
- know what data we hold about you and get a copy
- correct inaccurate data
- ask us to erase data or restrict its processing
- object to processing based on legitimate interest
- receive your data in a machine-readable format (the JSON download in your profile)
- withdraw a consent at any time
Send your request to [email protected]. We reply within one month and may ask you to confirm your identity.
If you believe your data is processed unlawfully, you can complain to the Office of the Data Protection Ombudsman.
Security
Connections are encrypted. Passwords and PINs are stored as hashes. Lesson videos play through signed links that expire. Access is based on roles: a judge, for example, sees only the sheet at their own position. We report a personal data breach to the Data Protection Ombudsman and, where needed, to you, as the law requires.
Changes
We update this notice when the processing changes. We tell you about material changes by email or in the app.
Contact
Yakumama Holding Oy, business id 3667677-4, Rauduntie 11 D, 02130 Espoo, Finland, [email protected].