Polo HQ Data Retention and Account Deletion Policy

Effective date: 31 July 2026
Last updated: 8 September 2026

This Policy explains what happens to Accounts and data during card-backed Checkout Trials, legacy or manually granted Full-Access Trials, Plan changes, payment failure, cancellation, self-service account deletion, data export and Account closure.

It forms part of the Polo HQ Terms of Service and should be read with the Privacy Policy and Data Processing Addendum.

1. Core principles

Polo HQ applies the following operational principles:

• reaching a capacity limit does not delete existing records;

• selecting a smaller Subscription Configuration may restrict affected records or modules as disclosed before the change;

• payment failure locks access but does not by itself delete data;

• cancelling a Checkout Trial locks the Account immediately but does not automatically delete data;

• cancelling after paid billing starts locks the Account at the end of the paid period and does not automatically move it to Player Free;

• Player Free is reached only by an explicit selection;

• only an ended Full-Access Trial that never selects any Plan is automatically deleted after 90 days;

• a person may delete their own account at any time through the self-service deletion flow in section 12, with a 30-day recovery period before deletion becomes permanent;

• a person may download a copy of their data at any time through the self-service export described in section 12.6; and

• other verified closure and data-subject requests are handled separately.

2. Card-backed Checkout Trial

Every eligible Paid Plan starts with a 14-day Checkout Trial when selected through the standard public wizard. Stripe holds the payment method and no subscription amount is charged during the Trial.

Account and Customer Data remain available while the Checkout Trial is active. Access reflects the selected Plan and extras, rather than universal unlimited Trial access.

3. Cancelling a Checkout Trial

If an authorised Account Manager cancels while the Stripe subscription is still trialing:

• cancellation takes effect immediately;

• Stripe does not charge the payment method for conversion from that Trial;

• access ends immediately for all Users;

• the Account enters a locked or cancelled state; and

• Customer Data remains stored.

The Account does not automatically become Player Free. An authorised Account Manager may later subscribe again through the lock screen or another available billing route.

A cancelled Checkout Trial is not automatically placed into the 90-day abandoned-Trial purge described below.

4. Cancellation after paid billing starts

After the Checkout Trial converts and paid billing starts, ordinary cancellation takes effect at the end of the current paid period unless law or the confirmation screen requires otherwise.

Access continues until that date. When cancellation becomes effective, the Account locks for every User. Customer Data is retained. The Account does not automatically move to Player Free.

5. Legacy and manually granted Full-Access Trials

The public card-free Trial route is closed. Accounts created under the previous universal Trial model and Trials granted through Super Admin may continue as Full-Access Trials.

A Full-Access Trial may provide all modules and broad or unlimited capacity, has no card requirement solely because of the Trial and does not automatically charge.

When it expires or an administrator uses End trial now, normal operational access is restricted and an Account Manager is directed to choose a Plan. Data remains intact during this period.

6. Abandoned Full-Access Trial

A Full-Access Trial becomes abandoned only if it has ended and no Plan has ever been selected afterwards, including Player Free.

The current timetable is:

Choosing any Plan before deletion stops the process.

7. Scope of abandoned Full-Access Trial deletion

Permanent deletion may include:

• Organisation and Account records;

• User and authentication accounts;

• horses, players, members and staff records;

• practices, lessons, calendars and events;

• stable, maintenance, financial, analytics, timeline and breeding records;

• tasks, notes, attachments, documents and invitations;

• onboarding and Trial email logs; and

• other Customer Data associated with the abandoned Full-Access Trial.

Deletion is intended to be irreversible. Residual protected backup copies may remain until overwritten under infrastructure backup cycles and will not be used for ordinary restoration.

8. Deletion audit record

After abandoned Full-Access Trial deletion, Polo HQ retains a minimal audit record containing:

• Account or Organisation name;

• signup email address;

• Full-Access Trial start and expiry dates;

• deletion date; and

• counts of deleted records by category.

This record is retained normally for six years from deletion for accountability, dispute handling, duplicate-Trial and abuse prevention, and legal claims. It is then deleted or irreversibly anonymised unless a legal hold applies.

9. Active Player Free or Paid Accounts

An Account that deliberately selects Player Free or maintains a Paid Plan is outside the abandoned Full-Access Trial deletion process.

Customer Data is retained while the Account remains open, subject to the current Subscription Configuration, module availability, this Policy and applicable law. Retention does not guarantee that every retained record remains active, editable or immediately restorable after a Plan or module change, and it does not mean data is stored indefinitely after closure.

10. Capacity reductions and Inactive Records

A lower Plan, removal of an Add-on or Bundle, expiry of a parent entitlement, or reduction in Capacity Packs may leave current usage above the resulting entitlement.

Before a material subscription change is confirmed, the Service should disclose the known consequence for access or capacity. Depending on the relevant module and live implementation, Polo HQ may prevent new records, mark records or User access inactive, make information read-only, restrict the module, or require the Customer to restore sufficient entitlement.

Data is not guaranteed to remain actively usable solely because it is retained. The availability, visibility and restoration of retained module data depend on the confirmed Subscription Configuration and functionality then offered.

No statement in this Policy confirms a particular ordering rule for deactivation, the treatment of cancelled Practices or Lessons in usage counts, or automatic restoration after re-subscription unless the applicable interface or written product specification expressly confirms it.

11. Payment failure

A failed payment may place an Account in a billing-lock state while Stripe retries payment or the payment method is updated.

No Customer Data is deleted solely because of a billing lock. Access is restored after successful payment is processed.

If the paid entitlement is later cancelled or terminated, the Account locks when cancellation becomes effective and this Policy continues to apply.

12. Self-service account deletion and voluntary closure

12.1 How to delete an account

A person may delete their own account:

• from Settings, under Account & Security, using Delete Account, after re-entering their password and typing a confirmation phrase; or

• without signing in, from the public page at app.polohq.com/delete-account, by verifying control of the account email address through an emailed link.

Closure and deletion requests may also be sent to info@polohq.com, where identity and authority are verified before action.

Before confirming deletion, the person is offered the data export described in section 12.6.

12.2 The 30-day recovery period

When deletion is confirmed, the account is disabled immediately: every session is signed out, signing in is refused, and a confirmation email containing a cancellation link is sent to the account email address. Permanent deletion is scheduled for 30 days later.

During the 30-day recovery period nothing has yet been deleted. The emailed cancellation link is the only way to restore the account; the sign-in screen can resend it to the account email address. Cancelling restores the account as it was, because nothing was removed during the recovery period.

After the 30 days, deletion is carried out automatically and is intended to be irreversible.

12.3 Deletion by a sole Account Manager

An Account Manager who is the only manager of an Organisation with other members chooses, before confirming deletion:

• to transfer the manager role to another User first and then delete only their own account, in which case the Organisation, its records and every other account stay active; or

• to delete the entire Organisation with their account. The Organisation's clubs, horses, players, practices, lessons, financial, stable, maintenance and breeding records and uploaded files are deleted on the same date, and the accounts of its grooms, staff, coaches and players are scheduled for deletion with it. Those members are notified and cannot cancel individually; only the requesting manager's emailed cancellation link restores every account. A member who also belongs to another Organisation keeps their account and loses only the deleted membership. Veterinary accounts are not deleted and lose access to the Organisation's horses.

An Account Manager in an Organisation that has other managers deletes only their own account; the Organisation continues.

12.4 What deletion removes, and what remains

Permanent deletion of a personal account removes the sign-in identity, profile details (name, email address, phone number, photo), preferences, registered devices and push tokens, personal tasks and files, notifications, memberships and consent records. Messages the person sent in shared conversations are replaced with a deleted-message placeholder.

Records that belong to an Organisation, such as horses, practices, lessons, roster entries, finances, stable and maintenance logs and activity history, remain with that Organisation, which controls that data. The deleted person's name is removed from them.

Veterinary clinical records are immutable and must identify the treating practitioner. When a veterinary account is deleted, the sign-in identity is permanently disabled and the practitioner identity attached to retained clinical records is anonymised, rather than the records being removed.

Certain records survive deletion under the Privacy Policy: billing, tax and accounting records, legal acceptance records, and security, dispute and audit records. Residual encrypted backup copies may persist until overwritten under provider backup cycles; they are not user-accessible and are not restored to production except for disaster recovery.

12.5 Deletion and export audit record

Polo HQ keeps a pseudonymous record of deletion and export events, limited to account identifiers, timestamps and record counts, for security and compliance. It contains no names or email addresses.

12.6 Data export (Download My Data)

Any User may download a copy of their data from Settings, under Account & Security, using Download My Data, and from the first step of the deletion flow.

The export is generated as a ZIP archive of CSV files plus the uploaded media behind those records. Its scope follows data ownership rather than what a User can see on screen. The operational data of a club, team or Organisation belongs to that Organisation:

• an Account Manager of an Organisation receives their own account data together with the Horses and Players records of the clubs they manage, every club record they authored and the uploaded files behind them; and

• every other User (coach, staff, groom, player, member or veterinary account) receives their own account data only: profile, memberships, preferences, devices, notifications, legal acceptances, account events, the messages they sent with their attachments, and personal tasks. A personal export does not contain horses, roster rows, appointments, treatments, practices, lessons, financial records or Organisation documents.

The Service tells each User which scope applies before the export is generated. One export may be requested per 24-hour period. The download is available only to the requesting User through a short-lived signed link and expires 7 days after it is generated. Exports are never sent as email attachments.

12.7 Requests handled through support

For a closure or deletion request handled through support rather than the self-service flow, operational Customer Data is ordinarily scheduled for deletion within 90 days after identity and authority are verified, subject to:

• legal retention duties;

• active disputes, fraud or security investigations;

• data needed to establish or defend claims;

• billing and acceptance records retained under the Privacy Policy;

• another controller's lawful rights; and

• protected backups awaiting overwrite.

13. Individual rights requests

A person may request erasure under applicable data-protection law. The right is not absolute.

Where the data is controlled by a Polo HQ Customer, the request should normally be made to that Customer. Polo HQ will assist as required by the Data Processing Addendum.

14. Legal holds

Deletion may be paused where data is reasonably required for litigation, a regulatory enquiry, law enforcement, fraud, security response or another legal obligation. When the hold ends, the ordinary retention period resumes.

15. Notices and email responsibility

Checkout Trial reminders and cancellation confirmations are sent to the billing or Account email address. Full-Access Trial expiry and deletion notices are sent to the signup email address. Account-deletion confirmations, cancellation links, organisation-member notices and export-ready notices are sent to the relevant account email address. Customers must keep those addresses accurate, monitor them and manage spam filters.

A failed or unread email does not automatically extend a clearly disclosed Trial, charge or deletion date, although Polo HQ may extend a deadline at its discretion or where law requires.

16. Contact

Questions, export requests and closure requests should be sent to info@polohq.com.

POLO HQ LTD
Company number: 17059471
43 Diamond Ridge, Camberley, England, GU15 4LB