Last updated: 13 October 2026
This policy covers 9horsemen.com, the Gallop builder at gallop.9horsemen.com, the websites Gallop creates for businesses, and the Gallop Admin app on the web, iOS and Android (together, the "services"). We handle personal information in line with New Zealand's Privacy Act 2020 and other privacy laws that apply to us.
Who we are
The services are run by 9horsemen Limited, a New Zealand company. You can reach us, including our privacy officer, at hello@9horsemen.com.
What we collect
- Account details: the email address you sign in with, and the team members you invite.
- Business content: what you tell Gallop about your business and what you add to your site, such as services, prices, hours, photos and team members.
- Builder conversations: what you type into the Gallop builder and its replies.
- Billing details: your plan, add-ons and payment history. Stripe handles card details, and we never see or store your full card number.
- Customer records: when a customer books or buys from a business on Gallop, their name, email or phone number, bookings and purchases are stored for that business.
- Technical data: basic request logs, such as IP address, browser and error details, created when you use the services or when visitors browse a site on Gallop. We use them only to keep the services secure and working.
- Usage data: records of how Gallop is used, so we can find what's hard to use and which features matter most. In the Gallop builder they're anonymous: the steps people take, such as picking a trade, answering a question or opening a preview, plus your country, whether you're on a phone or computer, and how you arrived (for example the 9horsemen.com page, search engine or website that linked to Gallop, or a campaign name in the link), not linked from one visit to the next. In Gallop Admin they're linked to your account ID and your business: which screens and features you use and when, plus counts about the business, such as how many bookings and sales it records, its plan and which add-ons are on. Usage data never includes what you type, your name, email or IP address, or any details of a business's customers.
How we use it
- To build, host and run your site and business app.
- To sign you in, and to send the codes, booking confirmations, reminders and receipts the services provide.
- To bill you for paid plans and add-ons.
- To provide support, fix problems and improve the services.
- To detect fraud and abuse, and to enforce our terms. This includes automated and manual review of sites and content.
We never sell personal information and never use it for advertising.
If 9horsemen is involved in a merger, acquisition, sale of assets or insolvency, information may be transferred as part of that transaction. We'll tell you about any change in ownership or to this policy.
AI and your information
The Gallop builder sends what you type, and relevant details of your business, to our AI providers (Anthropic or Google) so they can build and edit your site.
- Voice typing: if you use the mic button in the builder, your browser or phone turns your speech into text with its own speech service (for example Google in Chrome, or Apple in Safari), under that company's privacy terms. We only receive the text, never the recording.
- No model training: we don't use your business content or your customers' information to train AI models, and our AI providers' terms don't allow them to train their models on what we send them.
- What we keep: we keep your builder conversations for 30 days after the last message, so you can carry on editing and so we can give support and fix problems. Our team may read them for those reasons. When we turn on detailed logging to investigate a problem, we delete those logs within 7 days.
- What AI providers keep: our AI providers keep inputs and outputs only to detect abuse, fraud or breaches of their safety policies, then delete them: Anthropic within 30 days, and Google after 55 days. Either may keep something longer if it's flagged as breaking their policies or the law requires it.
Businesses and their customers
Each business on Gallop controls the information about its own customers. We hold and process it for the business, as its agent (or "processor"), and only as needed to provide the services. Emails to customers are sent in the business's name.
If you're a customer of a business on Gallop, send requests to access, correct or delete your information to that business. If you contact us instead, we'll pass your request to the business, act on its instructions and help it respond.
Service providers
We rely on a small number of providers to run the services, and they process data only to provide their service to us:
- Cloudflare, for hosting, content delivery, file storage and bot protection (Turnstile).
- Supabase, for sign-in and our database.
- Resend, for sending emails.
- PostHog, for the usage data described above. It never receives message text, names, emails, IP addresses or details of a business's customers.
- Stripe, for billing paid plans and add-ons.
- Anthropic and Google, whose AI models process what you type into the Gallop builder so they can build your site.
- Unsplash and Google Maps. Sites on Gallop load photos from Unsplash and, where a business shows its location, a map from Google Maps, so visitors' browsers connect to them directly and share their IP address.
- Google Fonts. Gallop Admin on the web loads fonts from Google, so your browser connects to Google directly and shares its IP address. 9horsemen.com and sites on Gallop host their own fonts.
- Google Search Console, only for businesses that turn on the Get found on Google add-on.
For the full, current list of providers that process data for us, see our subprocessors list. We'll tell account holders at least 15 days before a new subprocessor starts processing personal data.
Storage outside New Zealand
Our database and uploaded files are stored in Sydney, Australia. Some providers, such as our AI, email and billing providers, process information in the United States, our usage data is stored in the European Union, and Cloudflare handles requests at the data centre nearest each visitor. We use providers that protect personal information in ways comparable to the Privacy Act 2020. Transfers of customer data we process for businesses are covered by our Data Processing Addendum.
Cookies
We don't use advertising or tracking cookies, and collecting usage data doesn't use cookies either. Gallop Admin on the web uses a secure cookie to keep you signed in. Cloudflare Turnstile may use cookies or similar technology only to tell people from bots.
Analytics on 9horsemen.com
The only analytics on 9horsemen.com is Cloudflare Web Analytics, from Cloudflare, which hosts the site. It gives us traffic statistics such as page views, countries, referring sites and how fast pages load. These are combined across all visitors, don't use cookies and aren't used to identify you. We don't use advertising or other tracking scripts. When you follow a link from 9horsemen.com to the Gallop builder, your browser tells the builder which page you came from, and we count that as described under usage data.
Security and breaches
Information is encrypted in transit. Each business's data is kept separate in our database, and only people who need it can access our systems.
- Your account details: if a privacy breach affecting your information is likely to cause serious harm, we'll tell you and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.
- Your customers' records: if a breach affects your customers' information, we'll tell you without undue delay, and within 72 hours of confirming it, so you can meet your own duties to notify your customers and regulators.
How long we keep it
Unclaimed previews created in the builder are deleted automatically within 24 hours. Builder conversations are deleted 30 days after the last message. If you ask us to get in touch or join a waiting list, we keep your email, your note and what you asked for until we've dealt with it, or until you ask us to delete it. Account and business data are kept while your account is active. They're deleted when you ask us to delete your account, or when an inactive Free account is deleted as described in our terms. Deleted data may stay in our encrypted backups for up to 7 days before it's overwritten. Records of sales and billing may be kept longer where the law requires it, for example for tax.
Children
The services are for businesses and aren't directed at anyone under 18. We don't knowingly collect personal information from children for our own purposes.
Your rights
You can ask us to access, correct, export or delete your personal information by emailing hello@9horsemen.com. If you're not happy with how we handle your request, you can complain to the Office of the Privacy Commissioner.
We'll respond within 20 working days, as the Privacy Act 2020 requires, or sooner where another law sets a shorter time. If your request is about information a business on Gallop holds about you as its customer, we'll pass it to that business, as described above.
Rights outside New Zealand
Depending on where you live, you may have extra rights under your local privacy laws. We'll honour them where they apply to us.
- Australia: under the Privacy Act 1988, you can ask to access or correct your information, and complain to the Office of the Australian Information Commissioner if you're not satisfied with our response.
- European Union and United Kingdom: under the GDPR and UK GDPR, you can ask us to access, correct, delete, restrict or export your information, and object to how we use it. Where we rely on your consent, you can withdraw it at any time. You can also complain to your local data protection authority.
- California and other US states: you can ask to know what personal information we hold about you, and ask us to correct or delete it. We don't sell or share personal information for advertising, and we won't treat you differently for using your rights.
Under the GDPR and UK GDPR, we rely on these legal grounds to use your information:
- Contract: to provide the services you've signed up for, including sign-in, hosting, messages and billing.
- Legitimate interests: to keep the services secure, prevent fraud and abuse, provide support and improve the services.
- Legal obligation: to keep tax and billing records and respond to lawful requests.
- Consent: where we ask for it, such as for optional features.
When we transfer information out of the EU or UK, we rely on safeguards such as the European Commission's standard contractual clauses and the UK's equivalent, or on New Zealand's adequacy decision. Our Data Processing Addendum covers transfers of customer data we process for businesses.
To use any of these rights, email hello@9horsemen.com. We may need to confirm your identity first.
Changes
If we change this policy, we'll update the date at the top of this page and, for significant changes, let account holders know.