Privacy Policy

1. Who we are

JumpOff is a live-experience platform for show jumping. It has three connected parts: a free spectator prediction game, a show-office and judging platform used by show organisers, judges and course designers, and the JumpOff newsletter. This policy explains what personal data we collect across the platform (jumpoff.live and related services), how we use it, who we share it with, and the rights you have.

For the purposes of data-protection law, the data controller is JumpOff, currently operated by Riley MacKillop, based in Australia. Once the business is incorporated, the controller will be JumpOff Pty Ltd, and this policy will be updated accordingly. You can reach us about privacy at privacy@jumpoff.live.

2. Who this policy covers

Because JumpOff connects several groups of people, we process personal data about:

• Players and spectators who play the prediction game;
• Account holders on the platform — show-office staff, judges, course designers and administrators;
• Competitors, riders and officials whose names and results appear in the classes we run games for (this data usually comes from a show's start list, not from the individuals directly);
• Show organisers, leagues and their commercial partners; and
• Newsletter subscribers.

3. Personal data we collect

From players and spectators:

• A display name (which you choose — it can be a nickname);
• An email address, if you provide one (to create an account, to be notified when a game goes live, or to follow a league);
• A profile photo/avatar, if you upload one (note: avatars are shown on public leaderboards and are publicly retrievable);
• Your predictions, scores, rankings and league memberships;
• Responses to optional in-game surveys (for example, your connection to the sport and feedback about the experience);
• A web-push subscription, if you enable notifications (a device push endpoint and its keys); and
• Usage and interaction data — for example page views, time-in-game/session presence, share clicks and sponsor-banner interactions — recorded in our own database to understand engagement. Guests play as anonymous sessions and have no email unless they choose to provide one.

From account holders (show office, judges, course designers, admins):

• Your name and email address, and your password, which is handled and stored by our authentication provider (we never see or store your raw password);
• Your Google account identity if you sign in with Google;
• The roles/seats you hold on an event, and pending invitation email addresses;
• Any professional qualifications you choose to add to your profile (for example a judging or course-design credential), which may be displayed on official result sheets.

From competitors, riders and officials (third-party data — see section 5):

• Names, nationality, federation/FEI identification numbers, world ranking, and competition results (faults, times and placings);
• The name of a course designer where it appears on an uploaded course plan.

From show organisers, leagues and clients:

• Show/event details (name, venue, dates);
• Contact details you provide to us; and
• Engagement analytics and reports we compile for you about the audience that played your games.

From newsletter subscribers: your email address, name (if provided), and how/when you subscribed. Payment information: we do not currently take payments through the platform and do not store any card or billing details.

4. How we collect it

• Directly from you — when you play, create an account, upload a start list, fill in a survey, subscribe, or contact us;
• Automatically — through essential session cookies and the usage events described above;
• From documents operators upload — start lists and course plans (PDFs, spreadsheets, images or photos) are processed by our AI extraction provider to read the riders, horses, results and course details they contain; and
• From third-party sign-in — if you sign in with Google, we receive your Google account identity.

5. Competitors, riders and officials (third-party data)

An important note on how our platform works: to run a prediction game or score a class, operators upload the show's start list and results. This means we process personal data about riders, athletes and officials — their names, nationality, federation IDs, rankings and results — which we obtain from those documents rather than from the individuals themselves.

We process this data on the basis of our legitimate interests in operating a companion product for a public competition, using information that is largely part of the public record of the event. This data may be displayed publicly (for example in live scoring, leaderboards and result sheets). If you are a rider or official and would like to access, correct or object to our processing of your data, please contact privacy@jumpoff.live and we will respond. To read start lists and course plans, the uploaded files are sent to our AI extraction sub-processor (see section 9).

6. How we use your data and our legal bases

We use personal data to:

• Provide and run the prediction game, leaderboards and scoring;
• Provide the show-office and judging platform to organisers, judges and course designers, and manage roles and permissions;
• Send you service messages (for example, a game going live, or your results) and, where you have opted in, our newsletter and updates;
• Compile engagement analytics and reports for show organisers and leagues;
• Improve, secure and troubleshoot the platform; and
• Comply with our legal obligations.

Where the UK/EU GDPR applies, our legal bases are: performance of a contract (providing accounts and the platform to organisers and account holders); your consent (marketing emails and any optional features that ask for it — you can withdraw consent at any time); our legitimate interests (running and improving the game, processing competition data, understanding engagement, and keeping the service secure), balanced against your rights; and compliance with legal obligations. We do not make decisions that produce legal or similarly significant effects about you using solely automated means.

7. When your data is shown publicly

Some information is public by design. Your display name, avatar and score appear on leaderboards visible to others in the same game or league, and may be shown on venue screens, live streams and broadcast overlays (for example, the current leader's name, or aggregate figures like the percentage of players predicting a clear round). Competition results, and officials' names and any qualifications they have added, may appear on public result sheets. Please choose a display name you are comfortable being shown publicly.

8. Sharing and disclosure

We do not sell your personal data. We share it only as follows:

• Sub-processors — service providers who process data on our behalf to run the platform (see section 9);
• Show organisers, leagues and their partners — we provide them with aggregated engagement reports about the audience that played their games. Where you provided your email at a game or league (for example to be notified or to follow a league) and opted in, that email and name may be shared with that organiser or league so they can contact you, and may be added to relevant newsletters. You can opt out at any time;
• Broadcasters and sponsors — aggregate and on-screen prediction data, and leaderboard information as described in section 7;
• Legal, safety and compliance — where required by law, to protect our rights, or to prevent harm or abuse; and
• Business transfers — if JumpOff is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

9. Our sub-processors

We rely on the following providers, who process personal data on our behalf:

• Supabase — our database, authentication, file storage and realtime services (holds the platform's personal data and account identities);
• Vercel — application hosting and delivery;
• Google — Gemini AI (to extract riders, results and course details from uploaded start lists and course plans), Google Workspace / Gmail (to send our emails), Google Maps/Places (venue lookup based on text operators type), and Google Sign-In (if you use it);
• Open-Meteo — weather information based on a venue's location only (no personal data); and
• Web-push services — your browser vendor's push service, if you enable notifications.

We do not currently use a third-party payment processor, and we do not use third-party advertising or analytics/tracking services.

10. International data transfers

Your data is stored using Supabase on Amazon Web Services (AWS) infrastructure located in Singapore (Southeast Asia). Some of our providers (including Vercel and Google) may also process data in the United States and other countries. Where we transfer personal data of individuals in the UK or European Economic Area outside those regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum/IDTA) or an adequacy decision.

11. Cookies and analytics

We use only essential cookies: an authentication cookie to keep you signed in, and a short-lived cookie used to carry a newsletter opt-in through the sign-in process. Guest sessions are stored in your browser's local storage. We do not use advertising cookies or third-party tracking. Our engagement analytics (page views, session presence and interactions) are recorded in our own database and are not used to track you across other websites.

12. Data retention

We keep personal data for as long as needed to provide the platform and for legitimate business and legal purposes. Players can delete their activity at any time from their profile, and can request full account deletion (see section 14). Competition results and event records may be retained as part of the public record of the show. When an organiser deletes a league or event, its associated data is removed.

13. Security

We use industry-standard measures to protect your data, including managed authentication, encryption in transit and at rest, and database access controls (row-level security) that restrict who can see what. No system can be guaranteed 100% secure, but we work to protect your information and to respond promptly to any issues.

14. Your rights

Depending on where you live, you have rights over your personal data. Under the UK/EU GDPR these include the right to access, correct, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. In Australia, you have rights to access and correct your personal information under the Australian Privacy Principles. In California, you have rights to know, delete and correct your data and to opt out of its sale or sharing — we do not sell your personal data or share it for cross-context behavioural advertising.

How to exercise your rights — all self-service from your profile page:

• Download my data — get a copy of everything we hold about you as a JSON file (access/portability);
• Delete my data — erase your predictions, scores, saved emails, survey responses and league membership while keeping your login;
• Delete my account — erase everything and remove your login, email and profile photo entirely;
• Marketing — every game email includes an unsubscribe link (the newsletter has its own, in each edition); and
• Anything else, including corrections — email privacy@jumpoff.live and we will respond.

You also have the right to complain to a data-protection authority — for example the UK Information Commissioner's Office (ICO), your local EU supervisory authority, or the Office of the Australian Information Commissioner (OAIC).

15. Marketing and the newsletter

We only send marketing emails where you have opted in. If you provide an email as a guest, we use a double opt-in — you'll receive a confirmation email and are only added once you confirm. You can unsubscribe at any time using the link in the email or by contacting privacy@jumpoff.live. Service messages that are necessary to provide something you asked for (such as a result summary) are not marketing.

16. Children

The prediction game is intended for a general audience and is often played by spectators of all ages at shows, including with families. Guests play anonymously — no account, email or photo is needed. The moments where we do collect personal information are age-gated: creating an account requires a date of birth showing you are 16 or older, and leaving an email on a notify/follow form requires confirming you are 16+. Under-16s can keep playing as guests, ideally with a parent or guardian involved. If you are a parent or guardian and believe a child has provided us with personal data, contact privacy@jumpoff.live and we will review and delete it.

17. Changes to this policy

We may update this policy as the platform evolves. We will change the 'last updated' date above and, for material changes, take reasonable steps to let you know.

18. Contact

For any privacy question or request, contact us at privacy@jumpoff.live. Data controller: JumpOff (Riley MacKillop), Australia.