Privacy Policy

Last updated: 25 June 2026

This Privacy Policy explains how Insight Automate Ltd (trading as "Padoc", "we", "us", "our") collects, uses, shares and protects personal data when you use the Padoc platform, mobile/web application and related services (the "Platform"), and the choices and rights you have.

We are based in the United Kingdom and are committed to protecting your personal data in line with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Insight Automate Ltd (trading as Padoc) is the company responsible for the Platform.

Registered company number: 14707948 (England and Wales)
Registered office: Suite 5, 5th Floor, City Reach, Greenwich View Place, London, England, E14 9NN
Privacy contact: privacy@padoc.app

If you have any questions about this policy or how we handle your personal data, please contact us at privacy@padoc.app.

2. Who this policy is for, and our role

Padoc is a business-to-business service. We provide horse management and performance-analysis software to organisations such as racing yards, trainers and their teams (each an "Organisation"). This policy applies to:

Members of an Organisation who use the Platform (for example trainers, yard staff, assistants, administrators and other authorised users);
People whose details are recorded in the Platform by an Organisation (for example horse owners, contacts such as vets, physios and farriers, and riders); and
Visitors to our sign-in, sign-up and public pages.

Under data protection law there are two important roles:

A controller decides why and how personal data is processed.
A processor processes personal data on a controller's behalf and on its instructions.

Our role depends on the data:

For the content an Organisation puts into the Platform — such as horse records, owner and contact details, notes, documents, and recordings about the Organisation's operations — the Organisation is the controller and Padoc acts as a processor on its behalf. Our processing of that content is governed by our Data Processing Agreement with the Organisation and by their own privacy notices. If your data was entered by an Organisation and you want to exercise your rights over it, please contact that Organisation first; we will help them respond.
For data we decide the purposes of — including account creation and management, authentication and security, support, service communications, billing, analytics, and improving our products and services (including our algorithms and AI models) — Padoc is the controller, and this policy applies directly.

In some cases we may act as a joint controller with an Organisation; where that applies we will make the essence of the arrangement available to you.

3. The personal data we collect

We collect and process personal data in the broad categories described below. The examples given are illustrative and not exhaustive. The Platform develops over time, and as we add, change or expand features we may collect and process further information of these kinds — and occasionally new categories — for the purposes described in this policy. Where we introduce a materially different type or use of personal data, we will update this policy (see Section 15).

3.1 Account and profile data

Your first and last name, email address, telephone number, profile photo, job title or role, the Organisation(s) and team(s) you belong to, your role-based permissions, and your account and onboarding status.

3.2 Authentication and security data

Passwords (stored only as secure hashes), two-factor authentication settings and secrets, backup codes, email and phone verification status, sign-in sessions, API keys you generate, and security event information including IP address, device and browser information (user agent), and timestamps.

3.3 Content you create or upload

Any content and information you create, submit, upload, record or generate through the Platform. This includes, without limitation: text, notes and free-form entries; files, documents and images; audio, voice and other recordings, and the transcriptions, summaries, analyses or other outputs produced from them; and any other data you record about your horses, people, training, health, performance and operations. This content may incidentally contain personal data about you or others.

3.4 People records you add

Where you use the Platform to manage your operation, you may record details of other people, including horse owners and contacts (such as vets, physios, farriers, agents and other third parties) — for example their names, contact details, addresses, preferred contact method and related notes — and riders (such as name and, where relevant, attributes used for racing administration).

3.5 Communications data

Communications you exchange with us or through the Platform, including, without limitation, messages sent through our assistant or messaging integrations (such as Slack or WhatsApp), emails, support requests, and records of your interactions with us and our services (including any Performance Analyst or similar service). This includes message content, attachments, voice notes and conversation history.

3.6 Usage, technical and diagnostic data

Information about how you access and use the Platform, including, without limitation, log data, error reports and diagnostic data (which may include session replay that records interactions with the app to help us diagnose problems and improve usability), feature, analytics and performance data, and device, browser and connection information.

3.7 Billing data

Where applicable, billing and account-administration information relating to an Organisation's subscription. (We do not currently take card payments through the Platform; if that changes, we will update this policy and use a regulated payment provider.)

We do not intentionally collect special category personal data (such as health, biometric or racial/ethnic data) about individuals. Health and veterinary information held in the Platform relates to horses, not to people. Please do not enter special category personal data about individuals into free-text fields unless strictly necessary.

4. Where we get your data from

We obtain personal data:

Directly from you when you register, set up your profile, use the Platform, upload content or contact us;
From your Organisation and colleagues, who may create your account, invite you, assign your role, or record information about you (for example adding you as an owner, contact or rider);
Automatically, through your use of the Platform (technical, usage and diagnostic data); and
From third-party data sources used to deliver the service — for example official ratings from the British Horseracing Authority (BHA) and race-performance data from providers such as RaceIQ. This data principally concerns horses and races rather than identifiable individuals.

5. How and why we use your data, and our lawful bases

We use personal data for the purposes below. Where Padoc is the controller, the relevant UK GDPR lawful basis is shown.

Purpose	What this involves	Lawful basis
Providing the Platform	Creating and running your account, delivering features, processing the content you and your Organisation enter	Performance of a contract; legitimate interests (to provide a service requested by your Organisation)
Authentication and security	Verifying identity, two-factor authentication, preventing and detecting fraud, abuse and security incidents, keeping audit logs	Legitimate interests (securing the Platform); legal obligation
Support and service communications	Responding to requests, sending service, transactional and administrative messages, and important notices	Performance of a contract; legitimate interests
Improving our products and services	Analytics, troubleshooting, research and development, and improving our algorithms and AI models (see Section 7)	Legitimate interests (to maintain and improve our services), with a right to object
AI-powered features	Providing AI-powered and automated features, such as transcription, the assistant, summarisation, and other AI features we may offer (see Section 6)	Performance of a contract; legitimate interests
Marketing	Sending you information about Padoc features and updates you may find useful	Legitimate interests, or consent where required — you can opt out at any time
Legal and compliance	Complying with our legal obligations, responding to lawful requests, and establishing, exercising or defending legal claims	Legal obligation; legitimate interests
Billing and administration	Administering an Organisation's subscription and our business records	Performance of a contract; legitimate interests; legal obligation

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for more information about that assessment, and you have the right to object (see Section 12).

6. AI-powered features and automated processing

The Platform includes features powered by artificial intelligence and automated processing, provided by us and by trusted third-party AI providers acting as our processors. These currently include, without limitation, the examples below, and we may introduce further AI-powered features over time:

Voice notes and speech-to-text transcription. When you record a voice note, the audio is sent to a third-party AI provider to be converted into text. The audio file and the resulting transcription are then stored against the relevant record.
Assistant. Our assistant is available across messaging channels (currently including Slack and WhatsApp, and others we may add). When you message the assistant, your message, recent conversation history and relevant context (such as horse names and records you are permitted to see) are sent to a third-party AI provider to generate a helpful response. The assistant acts as you, can only access data you are permitted to see, and asks you to confirm before making any change to your records.
Other AI and automated features. We may introduce additional AI-powered or automated features (for example summarisation, content generation, classification, search, recommendations or insights). Where these involve sending your content or personal data to an AI provider, we do so under appropriate safeguards and for the purposes described in this policy.

The AI providers we currently use for these features are listed in our sub-processor list (see Section 8). We are reviewing our transcription providers and intend to consolidate audio processing with providers located in the UK, EU or other countries we are satisfied offer appropriate protection.

7. Using data to improve our products and services

We want to keep making Padoc better, and part of how we do that is by learning from how the Platform is used and from the content it processes. With the agreement of your Organisation (as set out in our service agreement and Data Processing Agreement), and as a controller for our own improvement activities, we may use data — including, without limitation, the content you and your Organisation provide (such as documents, files, recordings, transcriptions and notes) and usage data — to:

perform analytics and troubleshooting;
carry out research and development;
develop, test, evaluate, train and improve our features, products, algorithms and AI models (such as transcription, summarisation and other machine-learning models); and
produce general insights and benchmarks.

Our commitments when we do this:

Internal research, development and improvement. Internally, we may process data — including content and other personal data in identifiable form — for analytics, troubleshooting, research, development, testing, and building, training and improving our products, features, algorithms and models. We do this under appropriate safeguards and access controls.
Any external sharing is anonymised first. We do not routinely disclose data outside Padoc. If we do share or publish data or insights externally — for example for research, benchmarking, statistical or commercial purposes — we anonymise and aggregate it first, so that it does not identify you, any other individual, any Organisation, any horse or any operation. Once data is genuinely anonymised it is no longer personal data under data protection law.
What we will never disclose in identifiable form. We will never sell, or otherwise disclose other than to provide the service or as required by law, any data that identifies an individual horse, person or organisation. In particular, we will never disclose a horse's veterinary or medical history, the personal information (PII) of any user, or financial information about users, clients or their clients, except where necessary to provide the service you have asked us to provide, or where we are required to do so by law.
Your choice. You can object to your personal data being used for our product-improvement and model-development purposes. To opt out, contact privacy@padoc.app and we will honour your request. (Anonymised and aggregated data, which is not personal data, may still be retained, used and shared as described above.)

8. Who we share your data with

We share personal data only where necessary, and with appropriate safeguards in place.

8.1 Service providers (sub-processors)

We use trusted third parties to help us run the Platform. They process personal data on our instructions, under contract, and only for the purposes we specify. Our current sub-processors include:

Provider	Purpose	Location
Vercel	Application hosting	USA
Neon	Database hosting	USA / EU
Cloudflare (R2)	File and object storage	Global / EU
Resend	Transactional and service emails	USA
Sentry	Error monitoring and diagnostics (incl. session replay)	EU (Germany)
Trigger.dev	Background job processing	USA
Anthropic	AI assistant (chatbot reasoning)	USA
Google	AI speech-to-text transcription; Google Sheets export (where enabled)	USA / Global
Alibaba Cloud (DashScope)	AI speech-to-text transcription	Outside UK/EEA
OpenAI	AI processing (where used)	USA
Slack (Salesforce)	Chatbot messaging channel	USA
Meta (WhatsApp)	Chatbot messaging channel	USA / Global
Nango	Secure third-party integration and token management	USA / EU
Microlink	Link preview generation	USA

We keep this list under review and will update it as our providers change. If you would like the most current list, contact privacy@padoc.app.

8.2 Other recipients

We may also share personal data with:

Your Organisation and its authorised users, according to the roles and permissions configured in the Platform;
Professional advisers (such as lawyers, accountants and insurers) where necessary;
Authorities, regulators or other parties where required to comply with the law, a court order or a lawful request, or to protect our rights, users or the public; and
A buyer or successor if Padoc, the Platform or our business is sold, merged, reorganised, financed or otherwise transferred. In that event your account, this policy and the data we hold (including personal data and the content in your workspace) may transfer to the new owner as part of the transaction, and they may continue to use it in accordance with this policy or a materially similar one. We will take reasonable steps to keep your data protected.

We do not share your personal data with third parties for their own direct marketing.

9. International data transfers

Some of our providers are located outside the United Kingdom, including in the United States and other countries. Where we transfer personal data outside the UK, we put in place appropriate safeguards required by law, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or reliance on a country the UK has deemed adequate.

One of our current transcription providers processes audio outside the UK and EEA. We are actively reviewing this arrangement and intend to move audio processing to providers in the UK, EU or other adequately protected locations. In the meantime, we apply appropriate contractual safeguards. If you would like more detail about a specific transfer or to obtain a copy of the relevant safeguards, contact privacy@padoc.app.

10. How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy.

We retain account and content data for as long as your Organisation uses the Platform.
Following the end of an Organisation's agreement with us, we retain its data for 90 days to allow for export, after which we delete or anonymise it, unless we are required to keep it for longer by law. This reflects our service agreement with the Organisation.
We delete personal data and personally identifiable information in accordance with data protection law and on valid request.
Anonymised and aggregated data, which does not identify any individual, may be retained indefinitely and used for analytics, research and product improvement.
Publicly available data (such as official racing results and ratings) may be retained as part of the historical record.
Diagnostic logs, backups and security records are kept for shorter, rolling periods appropriate to their purpose.

11. How we protect your data

We take the security of your data seriously and use appropriate technical and organisational measures, including: encryption of data in transit and at rest; access controls and role-based permissions; private storage buckets for files; encryption of sensitive secrets and tokens; two-factor authentication; and monitoring and logging. No system can be guaranteed completely secure, but we work to protect your data and to detect and respond to incidents promptly.

12. Your rights

Under UK data protection law you have the right to:

Be informed about how we use your data (this policy);
Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten") in certain circumstances;
Restrict processing in certain circumstances;
Data portability — receive certain data in a structured, commonly used, machine-readable format;
Object to processing based on legitimate interests, including processing for product improvement and model development, and to direct marketing at any time;
Withdraw consent where we rely on it; and
Rights in relation to automated decision-making and profiling.

To exercise any of these rights, contact privacy@padoc.app. We may need to verify your identity. We will respond within one month, which we may extend for complex requests. Exercising your rights is normally free of charge.

Where the data was entered into the Platform by an Organisation (so that the Organisation is the controller), please direct your request to that Organisation; we will assist them in responding.

13. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to provide the Platform — for example to keep you signed in, remember your session and active organisation, and keep the service secure. These do not require consent.

We also use Sentry to monitor errors and, on a sampled basis, to record session replays that help us diagnose problems and improve the Platform. Where these technologies are not strictly necessary, we rely on legitimate interests and, where required, will ask for your consent. We do not use advertising or third-party marketing cookies.

You can control cookies through your browser settings, although disabling strictly necessary cookies may stop parts of the Platform from working.

14. Children

The Platform is intended for use by businesses and their staff and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Platform or by email and ask you to review and accept the updated policy. Your continued use of the Platform after an update means you accept the revised policy, except where we are required to obtain your consent.

16. Complaints

If you have a concern about how we handle your personal data, please contact us first at privacy@padoc.app so we can try to resolve it.

You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):

Website: https://ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Contact us

Insight Automate Ltd (trading as Padoc) Suite 5, 5th Floor, City Reach, Greenwich View Place, London, England, E14 9NN Email: privacy@padoc.app