PRIVACY NOTICE /// LAST UPDATED 5 NOVEMBER 2026
What we collect,
and what we don’t.
The Dirt House is a guide to off-road motorcycle events. We collect as little as we can, we never sell it, and every entry you make goes to the organiser, not us. This notice explains the rest in plain English.
Who we are
The Dirt House is a working name. The site is operated by SVE Ventures Ltd, a company registered in England and Wales (company number 16822306), registered office 2 Lormay Place, Westbury, Brackley, England, NN13 5NJ. For anything about your data, email sveventuresltd@gmail.com. We are the data controller for the information described below.
What we collect and why
| When you | We store | Why (lawful basis) | For how long |
|---|---|---|---|
| Ask us to tell you when entries open for an event | Your email address, the event, the consent wording you agreed to, the date and time, a hashed (one-way) version of your IP address and your browser type | To send you that one alert. Consent — you can withdraw it at any time. | Until the alert is sent, or 12 months after the event’s expected date, whichever is sooner. Deleted immediately when you unsubscribe. |
| Ask for a rider’s results by email | Your email address, the rider, when you asked and when you confirmed, and which results we have emailed you | To email you that rider’s results when they are published. Consent, confirmed from your inbox; withdraw it with the link in any email. | Until you stop the emails or unsubscribe, then deleted. Unconfirmed requests are never emailed again. |
| Unsubscribe | Your email address on a suppression list | So we never email you again by mistake. Legitimate interest in honouring your choice. | Indefinitely, or until you ask us to remove it. |
| Save an event | If you are signed out, the event stays only in this browser’s local storage. If you are signed in, we store its ID, name, date, location and save time with your account so it appears on your other signed-in devices. Older browser saves are added to your account only when you choose to import them. | To keep the events you choose across devices. Contract for account saves; your choice for browser-only saves. Saving does not request entry or subscribe you to alerts. | Until you remove the event or delete your account. Browser-only saves stay until you remove them or clear browser data. |
| Create an account or sign in | Your email address, the name you give us, when you joined and last signed in, and a sign-in session (the dh_session cookie and a matching record, with your browser type). If you sign in with Google or Apple, we also store that account’s ID number and email address. We never see or store your Google or Apple password. | To give you your account. Contract. | Sessions expire after 90 days. The account stays until you delete it: you can download your data or delete your account yourself on the account page. |
| Buy a plan, a featured slot or a photo, or back a rider | Your email, what you bought, the amount, its status and Stripe reference numbers. Card details are handled by Stripe and never reach us. | To take payment and provide what you bought. Contract, and legal obligation for tax records. | Six years after the purchase, as UK tax law requires. |
| Claim an event as an organiser, or send a partner enquiry | Your name, organisation, email, role, website, the events and message you send, and a hashed (one-way) version of your IP address | To verify the claim and reply. Legitimate interest in running listings accurately and answering enquiries. | 24 months after we last hear from you, unless you become a customer. |
| Turn on notifications in the app | An Expo device token, platform and the rider/event alerts and preferences you chose. No name or email is joined to this push record. | To send the alerts you asked for. Consent — switch them off in the app or your phone settings. | Until the token is removed or becomes invalid. Changing phone notification permission stops delivery but does not itself delete server records; see the app section below. |
| Visit any page | An anonymous count: the page, what you tapped (such as saving a ride) and the site you came from. No IP address, no cookie, nothing that identifies you. | To see which pages are useful. Legitimate interest. | Kept as counts. |
| Visit any page | Standard server logs held by our hosting provider (IP address, pages requested, browser type) | Security, abuse prevention and keeping the site up. Legitimate interest. | Short rolling window set by the host. |
Site analytics. We count visits, page views and clicks with PostHog in cookieless mode: nothing is stored on your device to recognise you, IP addresses are anonymised, and we strip everything from page addresses except campaign tags (so sign-in links, receipts and dashboard links never reach it). Session recording is off. We use it only for aggregate numbers about how the site is used. Legitimate interests.
Ads measurement, only if you allow it. We run a few ads on Instagram and Facebook. The first time you visit we ask whether Meta’s pixel may count whether those ads bring people here. If you choose Allow, the pixel sets one cookie (_fbp, up to 90 days) and sends Meta Platforms Ireland the pages you view, when you create an account and when you buy Pro, with your IP address and browser type. Meta uses this to measure our ads and may use it for its own purposes under its privacy policy. If you choose No thanks, nothing is loaded from Meta and we do not ask again on this device. You can change your choice at any time. Consent.
Beyond that we do not run advertising trackers or analytics cookies. We set dh_session only when you sign in, and dh_oauth for ten minutes while you sign in with Google or Apple. Both are strictly necessary to sign you in and keep you signed in, so they do not need a consent banner.
Country and local date. Discovery can use an approximate country supplied by our host to choose a starting destination. This feature does not request GPS access or add an IP address to your account. When you apply a country or time zone, we remember that choice in the dh-country and dh-timezone browser cookies for up to 180 days. They contain only the destination and time zone, not an account identifier. Change the selector at any time, choose Worldwide, or clear these cookies in your browser. Your browser’s time zone can refine “today” within the country you selected.
Partner links
Event pages include a “Make it a weekend” section with links to campsites, accommodation, travel and kit. Some are partner links: if you book, we may earn a commission. It never changes the price you pay. Following a link sends you to that partner’s own site, where their privacy notice applies. We do not pass them your personal data — a link click carries only the page you came from. Your event entry is never a partner link; it always goes to the organiser. Full list of partners and how placement is labelled: partners page.
Who else sees your data
- Supabase stores accounts, orders, organiser claims, alert signups, rider-result follows and the suppression list in a database hosted in London, UK.
- Stripe processes payments and holds card details. Stripe is its own data controller for fraud prevention; see stripe.com/gb/privacy.
- Apple and Google deliver app notifications to your device.
- Resend delivers the emails you ask for (sign-in links, receipts, rider results and their confirmation), from servers in Ireland (EU). It sees your address and the email we send, nothing else.
- PostHog (PostHog Inc., EU Cloud in Frankfurt) receives the cookieless site analytics described above. It never receives your email, name or payment details.
- Meta Platforms Ireland receives the ads-measurement events described above only if you allowed the Meta pixel. It never receives your email, name or payment details from us.
- Vercel hosts the website and runs the small functions that save your signup. Vercel is a US company; our site is served from their edge network.
- Google Fonts serves the typefaces on this site, which means your browser requests them from Google’s servers. We plan to self-host the fonts to remove this.
- Event organisers never receive your alert signup. If we ever propose sharing aggregate interest with an organiser (“40 riders want to know when entries open”), it will be counts only, never addresses.
We do not sell personal data, and we will not add you to any other list without asking first.
Holiday groups and operator enquiries
When you use trip planning, we store your group name, destination, dates, budget, display name, commitment, optional riding experience and organiser-recorded external payment amounts and references. A payment record is not proof of a transaction through Dirt House. Do not include bank details, passports or medical information.
Group members can see display names, commitments and group totals. Only the trip leaders and the relevant member can see that member’s individual payment records and riding experience. Invite links expire and can be replaced by the organiser. Trip leaders can remove members or add them back. Removed members lose access to the group; their existing payment records are retained for the trip leaders, separately from current group totals. Removing someone does not cancel a booking or issue a refund. The primary trip leader can appoint or demote additional leaders, who can see individual payment records and riding experience. Money requests store a target, due date, reason and selected recipients; each rider sees only their own request details, while leaders can manage the requests. A money request does not collect money. Saved calculator budgets are visible to group members. Closing a group stops updates but retains its records; use the contact route below to request access, correction or deletion.
If you request a group quote, we share your account email, group plan and the note you choose to send with the selected operator. Individual members’ names, riding experience and payment records are not included in that initial enquiry. When the primary leader accepts an operator quote, selected riders’ account identifiers and display names are shared with that operator after the leader confirms their permission. We retain the agreed quote, rider list, booking status, operator reference and status history. Active group members can see the quote and booking status; operators and active trip leaders can see the full booking rider list, while other riders see their own entry. Removed riders retain access to their own booking records through My trips. Cancellation notes are visible to the primary leader and operator. Booking confirmation is reported by the operator and does not verify payment. In an enabled payment test, we also store the agreed deposit deadline and minimum, rider payment attempt identifiers, Stripe Checkout and payment references, amounts, refund amounts, dispute flags and notification identifiers. These test records are separate from manual external payment records. Operators and active trip leaders can see per-rider deposit status; each other booked rider can see their own details. Card entry happens on Stripe’s hosted checkout, not in Dirt House. Operator test-payment setup sends the operator’s business name, registered country and internal account identifier to Stripe. We retain the connected Stripe account identifier and payment-readiness status. New test deposits are processed on that operator’s connected account with a 10% test platform commission. Identity and bank information requested during onboarding is entered directly with Stripe, not in Dirt House. Operator profiles and trips become public only after review. We do not load advertising or product analytics on the private trip workspace.
Tours, bookings and your rider profile
When you book a tour through The Dirt House, the tour operator is the organiser and your contract is with them. We share your name, email, phone, booking details and message with that operator, and your card is charged by the operator through Stripe. Card details are entered on Stripe's page and never reach us. We keep the booking, the amounts, our commission and the Stripe references.
Your rider profile is optional until you book: licence and years riding, off-road experience, height, inside leg, gear sizes, dietary needs, date of birth, nationality, an emergency contact and, if you choose to add them, medical notes. We use it only to pass to operators whose tours you book, so they can check the tour suits you, size your bike and kit, and keep you safe. An operator sees your profile only for riders booked on their own departures. Medical notes are health data: we store them only because you give them to us for this purpose (your explicit consent), and we show them to the operator only once your place is confirmed. You can edit or delete any of it from your account at any time, and it's removed when you delete your account. If a tour has terms or a waiver, we record when you accepted them and a fingerprint of the exact text.
Crew bookings: the rider who holds places gets a link to share. Anyone with the link sees the tour, dates and the first names of riders who've booked, never emails or payment details.
The iOS and Android app
You can browse and follow riders on your device without an account. Fan or Rider view, hidden sellers and local saves stay on your device. With your permission, we use Expo, Apple and Google to deliver push notifications. We store the Expo device token, platform, selected riders, saved-event alerts and notification preferences so we can send the alerts you choose. A device token identifies an installation even without your name or email. Turning notifications off in phone settings stops delivery; it does not itself erase stored tokens or preferences. Unfollow or change alerts in the app, or contact us to request removal.
In app versions supporting account sync, signing in saves your app rider-follow list privately with your existing account so it can be restored on another device. Earlier guest follows are not added automatically; you choose whether to import them. The app caches your account rider list and pending changes for offline use, linked to your account identifier. Sign-out returns to the separate guest list on that device. Account follows are included in your data export and removed with account deletion. App follows do not subscribe you to website result emails.
Email-code sign-in creates or accesses your existing account. We store the email, account identifier, sign-in records and a session; the app keeps its session securely on your device. Holiday requests include your name, account email, selected trip or operator, dates, rider count, optional phone and message. You choose the recipient when you send. My Trips displays your retained requests, booking status, amount and reference, plus crew plans. A request is not a confirmed booking. Card entry for a physical holiday happens in the system browser with Stripe; the app does not receive card or bank details.
In For sale, sending a message emails your reply address and message to the selected seller. Listing reports send your email, listing and reason to our moderation team. Replies go to your email. Public listings are seller-created content; you can report a listing and hide a seller in its details. Email recipients and operators handle the data you choose to send under their own obligations.
Location is optional and used only when you request nearby tracks. Coordinates are used for local distance calculations and map display, not uploaded to Dirt House accounts or push records. iOS uses Apple Maps. Android loads map tiles from OpenFreeMap; tile requests reveal the viewed map area and network metadata. OpenFreeMap keeps anonymised access logs; error logs can include IP addresses for 7 days and security-incident logs for up to 30 days. Searching a town or postcode sends that text to Postcodes.io. Rider and classified searches send query text to our APIs; hosting request logs may retain query and network metadata. No background location is used.
Our hosts process request metadata for operation and security. Existing server-side tour-request counters use restricted anonymous analytics events; no free-text request, email or phone is sent to PostHog. The native app has no advertising identifier or tracking SDK. Labelled paid placements and affiliate links are contextual. Our website analytics and external websites are described separately in this notice.
Delete your app account or request data removal
In the app, open Tours → My Trips → Delete my account and type your account email to confirm. You can also use the website account page, or email sveventuresltd@gmail.com with the subject “Dirt House account deletion”. We verify ownership before acting on an email request and respond within 30 days. Do not send passwords or sign-in codes. You may request deletion of selected information without deleting your whole account.
Account deletion removes the account and its associated sign-ins, account follows and saved events. Cancel an active subscription first using the existing account controls so you are not charged for a deleted account. Device-only saves and device push registrations are separate: clear app data for local preferences and contact us for server push-data removal. Operators and email recipients can retain requests already sent to them; necessary booking, tax, security and legal records may also be retained as described in this notice. Deleting an account does not cancel a holiday or issue a refund.
Your rights
You can ask us to show you, correct, delete or export the personal data we hold about you, and you can object to or restrict how we use it. To stop alerts, use the unsubscribe page — it removes your address immediately, no login needed. For anything else, email sveventuresltd@gmail.com and we will reply within 30 days. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Children
The site is for adults planning to ride or spectate. We do not knowingly collect data from anyone under 16. If you think we have, email us and we will delete it.
Changes
When this notice changes we update the date at the top. If a change affects how we use alert signups, we will email everyone on the list before it takes effect.