Privacy Policy

OnlyPolo is a free bilingual directory of polo. The public site is operated by [PLACEHOLDER: legal entity name], [PLACEHOLDER: legal entity address]. In this notice, “OnlyPolo”, “we”, and “us” mean that entity. Contact: hola@onlypolo.xyz.

The directory is published in English at /en and in Spanish at /es. The same pages exist in both languages. Spanish on this notice uses a neutral register.

This notice covers personal data we process to run the directory: accounts, listings, profiles, claims, messages, the newsletter, and the technical data needed to host the site. It does not cover a third-party site you open from a news headline, a social link, or a source URL.

You can browse places, events, horses, boarding, news, and profiles without an account. Places include clubs, fields, teams, stores, brands, hotels, estancias, schools, associations, media, and experiences. Profiles cover players, clubs, federations (including associations), ranches, and stores (including brands).

Imported place and event records keep the source URL they came from. A field the source did not provide stays empty. We do not invent people, handicaps, or contact details to fill a gap. A sample player profile, clearly marked as fictional, is shown only in development or to a signed-in admin. It is not published to anonymous visitors in production.

Visitors can submit a horse for sale or a boarding offer. The form asks for a title, description, price, location, contact name, contact email, optional phone, and up to six photos (JPG, PNG, or WebP, 4 MB each). A horse form may also include age, sex, breed, and handicap. The text is stored in the language of the page you used.

A submission is saved as pending. It is not shown on the public listing page until an admin approves it. You receive a transactional email when the listing is received, approved, or rejected, when email sending is configured. The admin notification address also receives a copy of a new submission.

Places and events are not submitted through those public forms. They are added from public sources or by an admin, and a draft is not the public page. A published place can be claimed. Horses and boarding can be rejected and then stay off the public page.

A profile can show a display name, country, bilingual bio, cover image, crest or avatar, gallery, social links, a highlights video URL, and a last-updated time. A player profile can also show a current handicap with its source federation, source URL, and as-of date, plus handicap history, position, clubs and teams by season, tournament notes, and horses linked to listings. A stat is shown only with its source. Otherwise the page says it is not yet verified.

Anyone can ask to claim a place or a profile. A profile claim asks for your name, email, and one kind of evidence: a federation listing, an official social link, or an email on the same domain as the profile or place website. An admin decides whether to grant ownership. The claim form does not itself mark a profile Verified. Verification is a separate admin decision.

A signed-in owner can edit the profile they own. Those edits are saved as a pending revision. They do not replace the public page until an admin approves them. An owner cannot change the public slug, the Verified flag, or the profile type through a revision. A slug change is a separate request that an admin approves or rejects. Owner and admin sign-in uses an account email and a session cookie.

Listing photos are stored in Supabase Storage, in the listing-photos bucket. Profile covers, crests, and gallery images are stored in the profile-media bucket. In local development, without Supabase, files stay on the server that is running the app.

An unapproved listing is not placed on the public horses or boarding page. The storage buckets are configured for public read, so a person who already has the file URL can open the image. Do not upload a photo you need to keep secret. Profile images that an admin has approved are meant to be public.

Profile email and phone are hidden. They are not selected for anonymous visitors. The public page offers a relay form. We store the sender’s name, email, and message, and we try to deliver the message to the owner by email. If no owner address is on file, or if email is not configured, the message is kept for an admin. The form does not say whether an owner address exists.

On a horse listing, the seller’s email is not printed on the page. The contact form sends your name, email, and message to that address through Resend, with your email as the reply-to, when email is configured. If email is not configured, the message is not delivered and the screen says so. Place records may show a phone or website when that value came from a source.

The newsletter is optional and uses double opt-in. The form asks for your email and a consent checkbox. We store the address as pending and send a confirmation link. The link expires after 48 hours. You are not subscribed until you open it. While a confirmation is still pending, we do not send another one more than once an hour. If email sending is not configured, the address stays pending and no confirmation is sent.

A confirmed subscription can receive occasional notes. Every message has an unsubscribe link. Unsubscribing keeps the address with an unsubscribed status so a later signup still requires a new confirmation. You can also ask us to delete the address.

• Transactional mail about a listing you submitted (received, approved, or rejected).
• The newsletter confirmation, and later newsletter messages if you confirmed.
• Admin notices for a new listing, a place claim, a profile claim, a relay message, or a removal request, sent to the address OnlyPolo configures for that purpose.
• Delivery is through Resend when an API key and a From address are set. Resend processes the recipient, subject, and body.

The news page stores headlines fetched from third-party RSS or Atom feeds, including PoloLine, Prensa Polo, Global Polo, POLO+10, FMP, and AUP. We keep the title, link, source name, and time. Opening a headline takes you to that publisher. Their privacy notice applies from then on. An admin can hide a headline.

If a horse or boarding listing has a title or description in only one language, we may send that text to MyMemory at api.mymemory.translated.net to fill the other language. We send the listing text and the language pair. We do not send the contact email, phone, or your account password. The page labels the result as an automatic translation. The wording you submitted remains the original.

The site is hosted on Vercel. Supabase provides the database, authentication when it is configured, and file storage. Resend sends email when it is configured. MyMemory translates listing text as described above.

The application does not currently include Vercel Analytics or another analytics script, and it does not set advertising cookies. Vercel may still process technical logs, such as IP address, user agent, URL, and time, to deliver and protect the site. If a non-essential analytics tool is added later, this notice will be updated before it is used.

These providers may process data outside your country, including in the United States and the European Union. Where the law requires a transfer tool, we rely on the provider’s contractual safeguards. This template does not attach those contracts. Counsel should confirm them before this notice is treated as final.

We use essential cookies only. When Supabase is configured, signing in sets the session cookies Supabase uses to keep an admin or profile owner signed in. Signing out clears that session.

When Supabase is not configured, a local development sign-in can set an httpOnly cookie named onlypolo_local (admin) or onlypolo_owner (profile owner). Each is SameSite=Lax, limited to this site, and kept for about 14 days. In production those cookies are marked Secure. They are not used for advertising.

The newsletter, listing, place-claim, and horse-contact forms can store a draft of what you type in local storage on your device, so switching language does not clear the form. That draft stays on your device until the form succeeds or you clear site data. It is not a cookie and it is not sent to us until you submit.

There is no automatic purge of every record on a fixed calendar. We keep a directory record while it is published or while we need it to review, moderate, secure the site, or show what was approved. A pending listing stays pending until an admin approves it, rejects it, or deletes it.

• Newsletter confirmation links expire after 48 hours. An unsubscribed address is kept with that status unless you ask us to delete it.
• Claim, revision, slug-change, relay, and removal requests are kept while they are pending and as a record of the decision.
• After a deletion request, we remove or anonymize the personal data we are not required to keep. We may keep a short note of the request itself.
• Server logs and email-provider logs follow the retention of Vercel, Supabase, and Resend.

You can ask to access, correct, or delete personal data we hold about you. Email hola@onlypolo.xyz from the address you used, and describe the page or record. We may write back to that address to confirm it is you. An authorized agent may write with evidence of authority.

To ask for a profile to be taken down, open that player, club, federation, ranch, or store page and use the form titled Request removal at the bottom of the page. The same pages are listed under Profiles. For a listing, a newsletter address, a place, or any other record, email hola@onlypolo.xyz. A removal request is reviewed by an admin. It is not an instant delete.

Owners correct a public profile by submitting a revision. The public page changes when an admin approves it. You can also correct a listing by writing to us. We do not charge a fee for a request unless the law allows a reasonable fee for a request that is manifestly unfounded or excessive.

OnlyPolo is not directed at children. We do not knowingly collect personal data from anyone under 16. Do not submit a listing, claim, profile, or newsletter signup for a child, and do not create an account if you are under 16. Horse sales and profile claims should be made only by someone who can enter a contract where they live, which is often 18.

If you believe we have personal data about a child, email hola@onlypolo.xyz and we will delete it. We do not run an age-verification gate on the public pages.

OnlyPolo is used in more than one country. The rights below sit on top of the access, correction, and deletion path in this notice. Mandatory rights in your country are not reduced by this template. Counsel still needs to confirm the entity, the transfer tools, and any registration.

• European Economic Area and United Kingdom (GDPR and UK GDPR). Depending on the activity, we rely on steps you request before a contract (a listing, claim, or account), consent (the newsletter checkbox and the confirmation link), legitimate interests (running, securing, and moderating a free directory, and sending a transactional note about a submission you made), or a legal duty. You can request access, rectification, erasure, restriction, objection, and portability where those rights apply, and you can withdraw newsletter consent without affecting earlier lawful processing. You can complain to your supervisory authority. This template does not name an EU or UK representative: [PLACEHOLDER: EU/UK representative, if required].
• Mexico (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP). You can exercise ARCO rights: access, rectification, cancellation, and opposition. Send the request to hola@onlypolo.xyz. This page is the privacy notice for the data described above. The authority responsible for personal data protection in Mexico can receive a complaint. Confirm the current authority name before publication: [PLACEHOLDER: Mexican privacy authority].
• Argentina (Ley 25.326). You can request access, rectification, update, and suppression of your personal data. The Agencia de Acceso a la Información Pública is the controlling authority. You may file a complaint there. The address of the data controller is [PLACEHOLDER: legal entity address].
• Uruguay (Ley 18.331). You can request access, rectification, update, inclusion, and deletion. The Unidad Reguladora y de Control de Datos Personales (URCDP) is the supervisory authority. The database purpose is operating this directory.
• Paraguay. Private information is regulated in particular by Ley N.º 1682/2001, as amended by Ley N.º 1969/2002. You can ask us what personal data we hold, and you can ask us to correct or delete it, by emailing hola@onlypolo.xyz. This template should be checked against any newer Paraguayan statute before it is relied on.
• United States, including the California Consumer Privacy Act (CCPA) as amended by the CPRA. We do not sell personal information. We do not share it for cross-context behavioral advertising. California residents can ask to know, correct, and delete personal information, and can opt out of sale or sharing. Because we do not sell or share in that sense, we do not change the service based on a browser opt-out signal. We will not discriminate against you for exercising these rights. Categories we may hold are identifiers (name, email, phone), commercial details you put in a listing, polo-related details you choose to publish, and technical logs held by the host. Write to hola@onlypolo.xyz. We will verify the request by replying to the email we have.

We will post changes on this page and change the Last updated date. A material change to the newsletter does not turn a pending address into a confirmed subscription. Confirmation is still required.

Email hola@onlypolo.xyz. Postal address: [PLACEHOLDER: legal entity address]. Please write in English or Spanish.