1. Controller and contact
Srex Digital ApS (CVR 44123967), c/o Stig Rex Rørkær, Yrsavej 4, 2. th., 5200 Odense V, Denmark, is the controller for account administration, product operation, security, billing administration and BreedTrail’s own optional analytics and research activities.
Contact [email protected] or +45 42 31 13 11 for privacy questions or rights requests. This is BreedTrail’s privacy contact; no formal data protection officer has been appointed. A professional breeding organisation may be a separate controller for animal and team records it directs members to enter; contact that organisation as well where relevant.
2. Data we handle
- Identity and account data: name, email, authentication provider identifiers, verification state, preferred language and session/device details.
- Workspace and access data: workspace, selected breeding species, memberships, roles, invitations, authorised animal scope and audit entries.
- Animal and supported reproductive records: animal identifiers, species, breed, breeding and pregnancy dates where supported, checks, outcomes, tasks, observations, notes, comments and optional photos or documents. These are personal data when linked to an identifiable user or breeding organisation.
- Technical data: IP and request security data, app version, device platform, push token, sync operations, failures and security logs.
- Commerce data: selected plan, entitlement, transaction and subscription identifiers, billing status and legal acceptance records. BreedTrail does not store full payment-card details.
- Consent choices: separate histories for product analytics, research contribution, and browser cookie categories.
3. Where data comes from
Data comes from you, invited workspace members, the workspace administrator, Apple or Google when you choose social sign-in, payment and entitlement providers, your device and browser, and automated service/security events.
4. Purposes and legal bases
- Contract and requested steps: create and secure accounts, provide workspaces, synchronise records, deliver requested notifications, support collaboration, process subscriptions and provide support (GDPR Article 6(1)(b)).
- Legal obligations: accounting, tax, consumer-law records and responses to lawful authority requests (Article 6(1)(c)).
- Legitimate interests: service security, abuse prevention, reliable operations, limited audit trails, access administration and defence of legal claims, balanced against user rights (Article 6(1)(f)).
- Consent: optional analytics/marketing cookies, BreedTrail product analytics and contribution to cohort research are off until the relevant consent is given (Article 6(1)(a)). Consent can be withdrawn without affecting earlier lawful processing.
5. Required and optional data
Account, access and core animal-record data requested by a workflow are needed to provide it. Without them, the relevant feature may not work. Photos, notes, marketing cookies, product analytics and research contribution are optional.
6. Recipients and service providers
- DigitalOcean, Frankfurt region: application hosting, managed database, cache and private object storage.
- Stripe: web checkout, subscription and billing administration.
- RevenueCat, Apple and Google: mobile purchase processing and entitlement synchronisation.
- Apple and Google: optional social sign-in.
- Firebase Cloud Messaging, Apple Push Notification service and Google push infrastructure: device tokens and generic push delivery.
- Mailgun, EU region (a service of US-based Mailgun Technologies, Inc., part of Sinch): transactional email delivery through Laravel’s SMTP integration.
- Google Tag Manager and Google Analytics 4: optional web analytics or marketing tags, loaded only after the matching browser consent.
- PostHog: optional product analytics integration only if configured and the account-level analytics choice permits it.
- Sentry: application error and performance monitoring. Diagnostic events must exclude animal and person names, selected breeding species, free-text notes, media, registry identifiers and veterinary documents.
- Slack: limited operational, security and support coordination. Alerts must not contain animal records, selected breeding species, free-text notes, media, exact locations or veterinary documents.
- Professional advisers, public authorities or transaction counterparties only when necessary and legally permitted.
7. International transfers
Core hosting is designed for the Frankfurt region. Some global providers may process data outside the EEA. Where required, BreedTrail must use an adequacy decision, the European Commission’s Standard Contractual Clauses and supplementary safeguards, and document the transfer assessment. Provider location claims must be verified in the production processor register before launch.
9. Optional research contribution
Breeding-workspace administrators may separately opt an eligible, supported-species workspace into descriptive population-level reproductive statistics. The purpose is to create aggregated cohort insights for breeder planning and product improvement. It is not clinical research, veterinary advice or automated decision-making.
No research institution or external research partner is currently named, and no external or academic publication is currently planned. Aggregated statistics may be shown in BreedTrail. A new partner, materially new purpose or public research publication requires an updated notice and, where required, renewed consent.
Source records remain pseudonymised rather than anonymous while they can still be linked to a workspace. Candidate outputs suppress cohorts below 30 usable outcomes and require a disclosure-risk review before they may be treated as anonymous; the threshold alone does not guarantee anonymity. Withdrawal stops future inclusion. Genuinely anonymous aggregates cannot later be traced back and removed.
10. Retention
- Account deletion removes the account and solely controlled live workspace data from active systems after required checks. Private media deletion must succeed before account deletion completes.
- Encrypted rolling backups are retained for no more than 35 days and then expire; restored data remains subject to the deletion record.
- Accounting material, including required payment records, is retained for five years from the end of the financial year to which it relates, as required by section 12 of the Danish Bookkeeping Act. This does not mean every account or billing data field is kept for five years.
- Security and audit logs are normally retained for 12 months, and longer only for an active investigation or legal claim.
- Inactive accounts are reviewed after 24 months of inactivity and may be deleted after at least 30 days’ notice, subject to legal retention and workspace-access obligations.
- Pending invitations expire on their stated date. Optional consent records are kept as evidence while the account exists. Research contribution ends on withdrawal or account/workspace deletion, except for anonymous aggregates.
11. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, objection and data portability, and withdraw consent at any time. You may also complain to the Danish Data Protection Agency.
Use account export and consent controls where available, or email [email protected]. BreedTrail may need to verify identity and may refuse or limit a request where law permits.
12. Security
BreedTrail uses access controls, tenant scoping, encryption in transit, encrypted mobile storage, private media storage, short-lived upload authorisation, metadata stripping, generic notification payloads, audit trails, backups and retry-safe processing. No system is completely secure; report suspected misuse to [email protected].
13. Children and automated decisions
BreedTrail is for users aged 18 or older and is not directed to children. BreedTrail does not make decisions producing legal or similarly significant effects solely by automated processing. Timeline calculations and cohort outputs are informational.
14. Changes and contact
The version and effective date appear above. Material changes are highlighted in the service and renewed consent is requested where a consent purpose changes. Privacy questions and requests should be sent to [email protected].