Draft — not reviewed by a lawyer — do not rely on this page

This document is an internal draft prepared for Rein Software and has not been reviewed or approved by a qualified attorney. It is not legal advice, it is not final, and it must not be published, linked from a live product, presented to a customer, or otherwise relied upon until a lawyer licensed in the relevant jurisdiction(s) has reviewed it, filled in every placeholder marked [LIKE THIS], and signed off. Every open placeholder, and every factual claim this document makes about the product, is tracked for that review.

Privacy Policy

Draft version. Effective date: [EFFECTIVE DATE - NOT YET SET] · Last updated: [LAST UPDATED DATE]

This Privacy Policy explains what information Rein (the "Service," provided by Rein Software [LEGAL ENTITY FORM, e.g. LLC], "we," "us," or "our") collects, why, and how it is handled — both for the barns ("Organizations") that subscribe to the Service, and for the people whose information an Organization stores in it.

1. Who Controls What: the Barn and the End User

This is the single most important distinction in this policy. Rein is a multi-tenant, business-to-business product. Our direct customer is the barn (the "Organization"). The barn's own customers — boarders, riders, and their families ("End Users" or "Portal Users") — are people the barn has a direct relationship with and controls the data of. With respect to End User personal data, the Organization is the controller (it decides what is collected and why, and it is responsible for having a lawful basis to collect it, including any consents from its own customers), and we act as a processor — we process that data only to provide the Service to the Organization and on its instructions. If you are an End User with a question about your own data, the fastest path is almost always your barn directly (Section 9); we do not have an independent customer relationship with you and generally cannot act on a request without the Organization's involvement.

2. What We Collect, and Why

We collect the following, generally submitted directly by an Organization or its End Users:

Account and contact information — name, email address, phone number, role (admin, instructor, or customer), and login credentials, used to operate accounts and secure access.
Billing and financial records — charges, invoices, billing history, and security deposit ledger entries, used to run the Organization's billing operations. Note: a security deposit tracked in the Service is recorded as a liability in the Organization's own QuickBooks company file, not held by us — see Section 3.
Horse records — a horse's identifying details and, where the Organization chooses to record them, veterinary, farrier, dental, vaccination, deworming, and Coggins certificate history, including uploaded documents (e.g. a scanned certificate). These are animal health records, not human medical records, but we treat them as sensitive and store uploaded documents the same way (Section 6).
Signed agreements — liability waivers and other agreements sent for signature. We store the fact that a document was sent, its status, and its DocuSign envelope identifier; DocuSign, not us, retains the actual signed document (Section 3).
Communications — the content of SMS messages and emails sent through the Service (for example, lesson reminders, dunning/payment-reminder notices, and inbound replies), used to deliver those communications and to route inbound replies (e.g. recognizing "cancel my lesson").
Usage and device information — standard web request data (IP address, browser user agent) associated with login sessions, used for security and troubleshooting.

3. We Do Not Process Payments

Rein is not a payment processor, and no payment card or bank account number is ever transmitted to or stored by this application. When an Organization enables QuickBooks Payments, an emailed invoice includes a "Pay Now" link, but payment is handled entirely by Intuit, and funds are deposited directly into the Organization's own QuickBooks Payments account. We never receive, hold, or route the money itself — we only later learn that an invoice was paid, via a webhook and a nightly reconciliation check against QuickBooks. Similarly, a security deposit an Organization tracks in the Service is accounted for as a liability in that Organization's own QuickBooks company file; we do not hold the deposit funds ourselves.

4. Third-Party Sub-Processors

To provide the Service, we share the minimum data necessary with the following named sub-processors, each engaged on the Organization's behalf and each with its own privacy practices (linked below):

Intuit QuickBooks Online — accounting and invoicing. Connected via OAuth at the Organization's initiation; the Organization's own QuickBooks credentials are never seen by us, and its access/refresh tokens are stored encrypted (Section 6).
DocuSign — electronic signature. DocuSign is the system of record for signed documents; we store only the envelope identifier, recipient status, and timestamps, and stream the signed PDF from DocuSign on demand rather than keeping our own copy.
Twilio — SMS delivery, for reminders, dunning notices, confirmations, and inbound message handling.
Postmark (ActiveCampaign) — transactional email delivery (invoices, dunning notices, waitlist and health-due reminders, password resets).
Amazon Web Services (S3) — file storage for uploaded documents (health records/Coggins certificates, horse photos, care event attachments) in production.
Google Analytics — usage analytics for our own public website only (the home page, the pages about Rein, these legal pages, and sign-up), engaged by us rather than on an Organization's behalf. It never runs on signed-in pages, the customer portal or emails, so it receives no barn, customer, horse or billing data (Section 9).

[CONFIRM THIS LIST IS EXHAUSTIVE AND NAME OUR APPLICATION/DATABASE HOSTING PROVIDER, WHICH IS NOT SPECIFIED IN THE CODEBASE]

5. Retention

We retain Customer Data for as long as an Organization's account is active, and, after termination, per Section 9 of the Terms of Service ([DELETION TIMEFRAME - SEE TERMS]). One retention period is already fixed in the product today: our internal QuickBooks synchronization audit log is automatically and permanently deleted after 90 days on a recurring daily job. Beyond that, we do not currently have engineering-enforced retention schedules for other record types (for example, health records, messages, or dunning history) — [COUNSEL/PRODUCT TO SET RETENTION PERIODS PER DATA CATEGORY, PARTICULARLY FOR ANY JURISDICTION-SPECIFIC REQUIREMENTS].

6. Security Measures

We apply the following technical safeguards:

Encryption of connected-account credentials at rest. OAuth access and refresh tokens for QuickBooks Online and DocuSign connections are encrypted at the database column level before being written to storage.
Private file storage with short-lived access. In production, uploaded documents (health records, Coggins certificates, horse photos, care attachments) are stored in a private Amazon S3 bucket with server-side encryption and no public access; the application only ever generates time-limited signed URLs (15 minutes) to view a file, and every such download is separately authorized by the application, not just by possessing the link.
Role-based access control. Access within an Organization is scoped by role (administrator, instructor, or customer/portal user), and every database query is scoped to the requesting user's own Organization so that one barn cannot see another's data.
Signed session cookies. Sign-in sessions are tracked via a signed, HTTP-only cookie that is not readable or modifiable by page scripts. [ENGINEERING TO CONFIRM PRODUCTION ALWAYS ENFORCES HTTPS/SECURE COOKIES AT THE INFRASTRUCTURE LAYER BEFORE THIS SECTION CLAIMS IT OUTRIGHT]

No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

7. End-User Rights and How to Exercise Them

Because the Organization controls End User data (Section 1), an End User (a boarder, rider, or staff member) who wants to access, correct, export, or delete their personal data, or withdraw consent to a particular use, should contact their barn directly — the Organization's administrator can update or remove records in the Service, or ask us to do so on their behalf. Where law requires us to respond to an End User directly, we will do so, but we will typically verify the request through the relevant Organization first. [COUNSEL TO ADD JURISDICTION-SPECIFIC RIGHTS LANGUAGE, E.G. CCPA/CPRA, GDPR, OR OTHER STATE PRIVACY LAWS THAT MAY APPLY]

Every account has a notification preference — disabled, phone (SMS), or email — and the Service checks it before sending any reminder, confirmation, or overdue-payment notice: a message is simply not sent on a channel a person has not opted into. A user (or their barn administrator, on their behalf) can change this preference at any time from account settings.

Inbound text messages are matched against a small set of keywords to recognize requests like canceling or asking about a lesson.

Texting STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message from the Service opts that phone number out of all future SMS from us, across every Organization — we reply once to confirm, and no further messages are sent to that number until it texts START (or UNSTOP, or YES) to resume. This is enforced in the application itself, in the single low-level function every one of our SMS-sending features (reminders, dunning/payment notices, confirmations, waitlist and deposit/payment notifications) already funnels through, so it applies uniformly rather than needing to be configured per feature. It does not depend on, and is in addition to, whatever opt-out handling Twilio or a carrier may separately apply at the network level. Texting HELP or INFO returns a short message identifying the sender and how to opt out. An exact-only match is used so that this only triggers when a message consists of just the keyword itself — texting, for example, "cancel my lesson" is handled as the ordinary lesson-cancellation request it is, not as an opt-out.

Because every Organization sends from the same shared number, a barn administrator with permission to do so can review the log of SMS messages sent to, and received from, their own Organization's End Users — the message content, timing, delivery outcome, and opt-out status — as part of running their own communications with their customers. This does not extend to any other Organization's messages.

9. Cookies and Session Handling

We use one essential cookie to keep you signed in: a signed, HTTP-only session cookie that identifies your session and cannot be read by page scripts. We use no advertising cookies.

On our public website pages only (the home page, the pages about Rein, these legal pages, and sign-up) we use Google Analytics 4 to count visits and sign-ups. It sets first-party _ga cookies that tell repeat visits apart, and sends Google the page address (without anything after the “?” other than campaign tags), the site you came from (its domain only), and your browser and approximate location. Google signals and ad personalisation are turned off. Google Analytics never runs once you are signed in, in the customer portal, or in our emails. You can block it with your browser's tracking protection or Google's opt-out add-on without affecting the Service. [COUNSEL: THIS PARAGRAPH IS NEW (GOOGLE ANALYTICS ADDED OCT 2026) — CONFIRM THE WORDING, WHETHER A COOKIE BANNER OR CONSENT IS NEEDED FOR ANY AUDIENCE, AND THE SUB-PROCESSOR ENTRY IN SECTION 4, BEFORE GOOGLE ANALYTICS IS SWITCHED ON]

The application does load web fonts from Google Fonts and a JavaScript grid library from a public CDN, each of which may receive your IP address as an ordinary side effect of your browser fetching that resource, independent of any cookie we set.

10. Children's Data

The Service is directed at businesses (barns) and their adult staff and customers, not at children. That said, a barn may reasonably record that a horse's rider is a minor, or a parent/guardian may be the account holder for a junior rider. We do not knowingly collect personal data directly from a child, and any information about a minor in the Service is provided and controlled by the Organization or the minor's parent/guardian, not collected by us from the child directly. [COUNSEL TO CONFIRM WHETHER COPPA OR SIMILAR OBLIGATIONS APPLY GIVEN JUNIOR RIDERS AS DATA SUBJECTS, AND SET AN AGE THRESHOLD IF NEEDED]

11. International Data Transfers

[HOSTING REGION AND ANY CROSS-BORDER TRANSFER MECHANISM (E.G. STANDARD CONTRACTUAL CLAUSES) NOT YET DETERMINED - COUNSEL TO DRAFT ONCE HOSTING LOCATION AND TARGET MARKETS ARE DECIDED]. File storage defaults to the AWS us-east-1 region unless the Organization's deployment configures a different one.

12. Breach Notification

If we become aware of a security incident that compromises the confidentiality or integrity of Customer Data, we will notify the affected Organization(s) [NOTIFICATION TIMEFRAME, E.G. "WITHOUT UNDUE DELAY" OR A SPECIFIC NUMBER OF DAYS PER APPLICABLE LAW] and provide information reasonably available to us about the incident, so the Organization can meet its own notification obligations to its End Users where applicable.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice (for example, by email to the account administrator or a notice within the Service) before the changes take effect.

14. Contact

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to [PRIVACY CONTACT EMAIL], or by mail to [NOTICE MAILING ADDRESS]. If you are an End User of one of our Organization customers, please see Section 7 first.