Privacy Policy

Last updated: 4 October 2026
Version: 2.0

This policy explains how Stashly collects, uses and protects personal data. It covers https://stashly.market (including https://stashly.market/equestrian/listings) and our related emails, alerts and services.

Contents

1. Who we are
2. Who this policy is about
3. Data we collect from you
4. Data about businesses
5. Listings from public sources
6. How we use data and our lawful bases
7. Our legitimate interests
8. Emails, SMS and marketing
9. Cookies
10. Matching, lead alerts and automated decisions
11. Who we share data with
12. International transfers
13. How long we keep data
14. Security
15. Children
16. Your rights
17. Removal, objection and takedown
18. Complaints
19. Links to other websites
20. If Stashly is transferred
21. Changes to this policy
22. How to contact us

---

1. Who we are

Stashly is operated by Burmington Software Solutions Ltd ("Stashly", "we", "us", "our"), a company registered in England and Wales with company number 15789660. Our registered office is 6 The Lane, Burmington, Shipston-on-Stour, CV36 5AN.

We are the controller of the personal data described in this policy. This means we decide how and why it is used.

We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

---

2. Who this policy is about

This policy applies to:

• visitors who browse Stashly;
• members with a Stashly account, including Buyer Pro subscribers;
• business users who claim or manage a business profile, post adverts as a business, or subscribe to Seller Pro;
• sellers and other people whose details appear in listings we collect from public sources, even if they have never used Stashly; and
• anyone who contacts us, for example with a question, complaint or removal request.

Words such as "Listing", "Source" and "Member Advert" have the same meaning as in our Terms of Service.

---

3. Data we collect from you

3.1 Account data

When you sign up, we collect your name, email address, phone number (if you give it, for example for SMS alerts) and password. We store passwords only in a securely hashed form, never in plain text.

3.2 Alerts, saved searches and location

When you save searches or set up alerts, we collect your search criteria and filters, saved and tracked listings, alert preferences (in-app, email, SMS, daily emails), and your location as a postcode or town and a search radius.

We only use your device's precise location if you tap a button such as "Use my location" and allow it on your device. We use it to show listings near you at that moment and do not keep it afterwards.

3.3 Messages

When you use our in-app chat, we collect the messages you send and receive and when they were sent. If you use a link to Facebook Messenger, SMS or a phone call, that conversation happens outside Stashly. We only record that you clicked the link.

3.4 Subscription and payment data

If you subscribe or pay for an advert, we collect the plan or option you chose, its price and renewal date, your billing name and email, and a record of payments, refunds and cancellations.

Stripe processes our payments and collects your card details directly. We do not see or store your full card number. Stripe may give us limited details, such as card type, the last four digits and expiry date, so we can show you which card is on file.

3.5 Usage and device data

When you use Stashly, we automatically collect your IP address, browser and device type, pages and listings you view, searches you make, the date and time of your visit, the website that referred you, and error and performance data. Some of this is collected using cookies (section 9).

3.6 Support correspondence

If you contact us, we keep your message, our reply and any details you give us, including removal requests, complaints and reports.

---

4. Data about businesses

Business profiles are mainly about businesses, but some details may be personal data, especially for sole traders and small yards. We may collect:

• public business details from public sources, such as business name, contact name, phone number, email, address, website, services and photos;
• claim and verification data, such as your name, role, contact details, verification codes and any evidence you give us;
• profile content you add, such as facilities, vacancies, prices and photos;
• enquiry inbox messages and leads sent to you; and
• insights data, such as profile views.

---

5. Listings from public sources

5.1 What we collect

We collect adverts that were publicly visible on public Facebook groups, other websites (for example Horsemart, HorseQuest and Whickr) and classified advert sites. These adverts may include the seller's:

• name or profile name;
• phone number or other contact details included in the advert;
• photos (which may include people);
• location (for example, town or county); and
• listing text, including the price and description.

We also record the source of each advert and a link to it. We may also collect public posts asking for services (for example, "Looking for a farrier near Hereford") to create leads for businesses (section 10).

We are not affiliated with, endorsed by or sponsored by Facebook/Meta, Horsemart, HorseQuest, Whickr or any other source.

5.2 Why we collect it

We use this data to help buyers find horses, equipment and services in one place, link buyers to the original advert and the seller, help businesses find people asking for their services, and keep listings accurate (for example, by removing sold or duplicate adverts).

5.3 Our lawful basis

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is in running a useful equestrian marketplace that helps sellers reach more buyers. This is generally in line with what sellers want when they publicly advertise a horse for sale.

We have balanced our interests against the rights of the people involved. To protect those rights, we:

• only collect adverts that were publicly visible;
• only collect what we need for the listing;
• show the source and link to the original advert;
• remove or hide listings that are sold or out of date, and rotate them off browse after about 90 days (3 months) from when we first published them on Stashly;
• do not intentionally collect special category data (such as health information about people), and remove it when we become aware of it;
• keep a do-not-list record so that removed content is not collected again; and
• make it easy to object and have data removed (section 17).

5.4 Phone numbers and contact details

Seller contact details from public sources are shown only where they were publicly visible at the source. We may limit them to Pro members, or hide them, at our discretion.

5.5 How we tell people

The law usually requires us to tell people when we get their data from somewhere other than them. Contacting every seller individually would often be impossible or involve disproportionate effort, because we usually only have the details in a public advert. Instead, we:

• publish this policy;
• show a notice on listings and in our website footer saying where data comes from and how to ask for removal; and
• point sellers to this policy whenever we contact them, for example when they claim a listing.

5.6 How long we keep it

We keep public-source listings on Stashly for up to about 90 days (3 months) from when we first published them on Stashly. We remove or hide them sooner if they appear sold or out of date at the source, and within 7 days of a valid removal request.

5.7 Your right to object

You can object to us using your data based on legitimate interests. For public-source listings, if you object we will remove your details, unless we have compelling legitimate grounds to keep them (for example, a record needed to deal with a fraud report). See section 17.

---

6. How we use data and our lawful bases

---

7. Our legitimate interests

Where we rely on legitimate interests, these are:

• running a useful marketplace that brings equestrian listings together;
• helping sellers and businesses reach buyers and customers;
• keeping Stashly safe and preventing fraud, scams and misuse;
• improving our service, for example by fixing bugs;
• respecting people's choices, for example through our do-not-list record; and
• establishing, exercising or defending legal claims.

We only rely on legitimate interests where our use of data is necessary and your rights do not override our interests. You can ask us for more information about how we balanced them.

---

8. Emails, SMS and marketing

8.1 Service messages

We send messages you need, such as account confirmations, password resets, the alerts you set up, receipts and renewal reminders. These are not marketing. You can turn off optional alerts, but we will still send essential messages, such as renewal reminders.

8.2 Marketing

We only send marketing emails or SMS if:

• you have given consent; or
• you have an account or bought from us, the marketing is about our own similar services, and you were given a simple way to opt out when we collected your details and in every message (the "soft opt-in").

8.3 Unsubscribing

You can stop marketing at any time by clicking unsubscribe in any email, following the opt-out instructions in any SMS, changing your account settings, or emailing hello@stashly.market. We keep a record that you unsubscribed so we do not contact you again by mistake.

---

9. Cookies

9.1 What cookies are

Cookies are small files placed on your device. We also use similar technologies, such as local storage. In this section, "cookies" covers all of these.

9.2 Our approach

• Strictly necessary cookies make Stashly work, for example keeping you signed in, protecting forms against misuse and remembering your cookie choices. These do not need consent.
• Analytics cookies (Google Analytics) help us understand how people use Stashly.
• Advertising cookies (Google AdSense) are used to show and measure adverts.

Analytics and advertising cookies are only set after you consent through our cookie banner. You can accept all, reject all or choose by category. Rejecting is as easy as accepting.

We do not currently use a Meta pixel. If we add one, we will update this policy and ask for your consent first.

9.3 Cookie table

We keep Google Analytics data for 14 months.

9.4 Google advertising

If you consent, Google may use cookies to show you personalised adverts based on your visits to Stashly and other websites. If you do not, Google may show non-personalised adverts using limited data. Learn more at https://policies.google.com/technologies/ads.

9.5 Changing your choices

You can change your choices at any time using the "Cookie settings" link in our footer. You can also block or delete cookies in your browser, but some parts of Stashly may not work if you block strictly necessary cookies.

---

10. Matching, lead alerts and automated decisions

We use automated tools to:

• match listings to your saved searches and send alerts;
• match public service requests and member enquiries to relevant businesses ("instant lead alerts");
• rank search results; and
• detect duplicate listings, spam and possible scams.

These tools use information such as listing type, keywords, location and time posted.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. A person reviews any account flagged for possible fraud before we suspend it. If you think an automated tool has treated you unfairly, contact us and a person will look at it.

---

11. Who we share data with

We do not sell your personal data.

11.1 Service providers

A current list of our service providers is available on request at hello@stashly.market.

Our contracts with these providers require them to protect your data and use it only on our instructions. Stripe and Google may also use some data as independent controllers under their own privacy policies.

11.2 Other users

• Sellers and businesses see messages and enquiries you send them.
• Buyers see the details in your advert or business profile. For public-source listings, buyers see the details from the public advert, subject to section 5.4.
• Seller Pro businesses may receive leads containing details from public posts or member enquiries. They are then responsible for how they use that data.

11.3 Others

We may share data:

• with the police, regulators (including the ICO and Ofcom), courts or other authorities where the law requires it, or to prevent fraud, protect people or animals, or deal with illegal content;
• with our professional advisers, such as lawyers and accountants; and
• with a new operator of Stashly (section 20).

---

12. International transfers

Some service providers may store or access data outside the UK, for example in the European Economic Area or the United States.

When we transfer personal data outside the UK, we make sure it is protected by:

• UK adequacy regulations (for example, for the EEA, or for US organisations certified under the UK Extension to the EU-US Data Privacy Framework); or
• the UK International Data Transfer Agreement (IDTA), or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

You can ask us for more information about these safeguards at hello@stashly.market.

---

13. How long we keep data

When we no longer need data, we delete it securely or anonymise it.

---

14. Security

We protect personal data by encrypting it in transit (HTTPS) and, where available, at rest; storing passwords only in hashed form; limiting access to people who need it; using reputable providers; and keeping software up to date.

No system is completely secure. If a personal data breach is likely to put people's rights at risk, we will report it to the ICO within 72 hours where required, and tell the people affected without undue delay if the risk is high.

Please use a strong, unique password for your account.

---

15. Children

Stashly is not for anyone under 18. You must be 18 or over to use Stashly. We do not knowingly collect data from children through accounts, and will delete it if we find we have.

Public-source listings sometimes include photos of children, for example a child riding a pony. If you are a parent or guardian and want an image removed, email hello@stashly.market. We treat these requests as urgent (section 17.5).

---

16. Your rights

16.1 How to use your rights

Email hello@stashly.market. There is usually no fee. We may ask for information to confirm your identity, but only where we need it and only what is reasonable.

16.2 How long we take

We will respond within one month of receiving your request (or any information we need to confirm your identity). If your request is complex, or you have made several, we may extend this by up to two more months. If so, we will tell you within the first month and explain why.

Some rights have exceptions. If we cannot fully meet your request, we will explain why.

---

17. Removal, objection and takedown

This section explains how anyone can ask us to remove information. Our Terms of Service set out the same process, including copyright notices and counter-notices.

17.1 What you can ask for

You can ask us to remove or hide a listing, photo, your name or your phone number, correct wrong information, or stop listing your adverts in future.

17.2 How to ask

Email hello@stashly.market with "Removal request" in the subject line. Please include:

• a link to the listing (or enough detail to find it);
• what you want removed, hidden or corrected;
• your connection to it; and
• to stop future listings, the name, profile name or phone number that appears in your adverts.

17.3 Identity checks

We will not ask for identification unless we genuinely need it to verify your request. If we do, we will ask only for what is necessary and use it only for your request.

17.4 What we will do

• Acknowledge your request within 2 working days.
• Act on valid requests within 7 days: we will remove or hide the listing, photo, name or phone number.
• Add it to our do-not-list record, so the same content is not collected again. We keep only the minimum needed (such as the phone number, profile name or advert link) and use it only for this purpose.
• Treat your request as an objection and, where appropriate, an erasure request under UK GDPR, and always respond within one month.

17.5 Urgent cases

We prioritise urgent safety and privacy cases, such as content that puts someone at risk, shows a home address or a child, or relates to a stolen horse or scam. Mark your email "Urgent". We aim to deal with these within 1 working day.

17.6 Source sites and rights holders

If a source site or a rights holder asks us to stop collecting from it, we will promptly stop collecting from that source.

17.7 If you disagree

If you are unhappy with our decision, reply to our email and we will review it within 14 days. You can also use our complaints process (section 18), including complaining to the ICO.

17.8 Records

We keep a record of each request and what we did for 6 years, so we can show how we handled it.

17.9 The original advert

Removing a listing from Stashly does not remove it from the original source. Contact that website or group to remove it there.

---

18. Complaints

18.1 Complain to us first

If you are unhappy with how we have used your personal data, email hello@stashly.market. We will acknowledge your complaint within 30 days, investigate it and tell you the outcome without undue delay.

18.2 Complain to the ICO

You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

The ICO usually expects you to raise your concern with us first.

---

19. Links to other websites

Stashly links to other websites, including original source adverts, Facebook and Messenger, sellers' websites and Stripe. They have their own privacy policies, and we are not responsible for how they use your data.

---

20. If Stashly is transferred

In future, Stashly may be transferred to another company in our group or to another organisation, for example if the business is reorganised or sold. If that happens:

• your personal data may be transferred to the new operator, who will become the controller;
• we will tell you who the new operator is;
• we will give you at least 30 days' notice of any material changes to how your data is used;
• the new operator must continue to use your data in line with this policy unless and until it gives you notice of changes; and
• your privacy rights continue, including your right to object, to have your data deleted, and to close your account before any change takes effect.

---

21. Changes to this policy

We may update this policy, for example if we add features, change providers or the law changes. We will update the "Last updated" date. For material changes, we will tell you by email or a notice on Stashly at least 30 days before they take effect, unless we must act sooner for legal reasons.

---

22. How to contact us

• Email (including data protection and removal requests): hello@stashly.market
• Post: Burmington Software Solutions Ltd, 6 The Lane, Burmington, Shipston-on-Stour, CV36 5AN

---

Stashly is not affiliated with, endorsed by, or sponsored by Facebook/Meta, Horsemart, HorseQuest, Whickr or any other source. All trademarks belong to their respective owners.