PRIVACY NOTICE /// LAST UPDATED 15 SEPTEMBER 2026
What we collect,
and what we don’t.
The Dirt House is a guide to off-road motorcycle events. We collect as little as we can, we never sell it, and every entry you make goes to the organiser, not us. This notice explains the rest in plain English.
Who we are
The Dirt House is a working name. The site is operated by SVE Ventures Ltd, a company registered in England and Wales (company number 16822306), registered office 2 Lormay Place, Westbury, Brackley, England, NN13 5NJ. For anything about your data, email sveventuresltd@gmail.com. We are the data controller for the information described below.
What we collect and why
| When you | We store | Why (lawful basis) | For how long |
|---|---|---|---|
| Ask us to tell you when entries open for an event | Your email address, the event, the consent wording you agreed to, the date and time, a hashed (one-way) version of your IP address and your browser type | To send you that one alert. Consent — you can withdraw it at any time. | Until the alert is sent, or 12 months after the event’s expected date, whichever is sooner. Deleted immediately when you unsubscribe. |
| Ask for a rider’s results by email | Your email address, the rider, when you asked and when you confirmed, and which results we have emailed you | To email you that rider’s results when they are published. Consent, confirmed from your inbox; withdraw it with the link in any email. | Until you stop the emails or unsubscribe, then deleted. Unconfirmed requests are never emailed again. |
| Unsubscribe | Your email address on a suppression list | So we never email you again by mistake. Legitimate interest in honouring your choice. | Indefinitely, or until you ask us to remove it. |
| Save a ride to “My rides” | Nothing on our servers. Saved rides live in your own browser’s local storage. | Convenience. Clear your browser data to remove them. | Until you clear them. |
| Create an account or sign in | Your email address, the name you give us, when you joined and last signed in, and a sign-in session (the dh_session cookie and a matching record, with your browser type). If you sign in with Google or Apple, we also store that account’s ID number and email address. We never see or store your Google or Apple password. | To give you your account. Contract. | Sessions expire after 90 days. The account stays until you delete it: you can download your data or delete your account yourself on the account page. |
| Buy a plan, a featured slot or a photo, or back a rider | Your email, what you bought, the amount, its status and Stripe reference numbers. Card details are handled by Stripe and never reach us. | To take payment and provide what you bought. Contract, and legal obligation for tax records. | Six years after the purchase, as UK tax law requires. |
| Claim an event as an organiser, or send a partner enquiry | Your name, organisation, email, role, website, the events and message you send, and a hashed (one-way) version of your IP address | To verify the claim and reply. Legitimate interest in running listings accurately and answering enquiries. | 24 months after we last hear from you, unless you become a customer. |
| Turn on notifications in the app | A device token from Apple or Google and which alerts you chose. No name or email. | To send the alerts you asked for. Consent — switch them off in the app or your phone settings. | Until you turn notifications off or the token stops working. |
| Visit any page | An anonymous count: the page, what you tapped (such as saving a ride) and the site you came from. No IP address, no cookie, nothing that identifies you. | To see which pages are useful. Legitimate interest. | Kept as counts. |
| Visit any page | Standard server logs held by our hosting provider (IP address, pages requested, browser type) | Security, abuse prevention and keeping the site up. Legitimate interest. | Short rolling window set by the host. |
Site analytics. We count visits, page views and clicks with PostHog in cookieless mode: nothing is stored on your device to recognise you, IP addresses are anonymised, and we strip everything from page addresses except campaign tags (so sign-in links, receipts and dashboard links never reach it). Session recording is off. We use it only for aggregate numbers about how the site is used. Legitimate interests.
We do not run advertising trackers or analytics cookies. We set dh_session only when you sign in, and dh_oauth for ten minutes while you sign in with Google or Apple. Both are strictly necessary to sign you in and keep you signed in, so they do not need a consent banner.
Partner links
Event pages include a “Make it a weekend” section with links to campsites, accommodation, travel and kit. Some are partner links: if you book, we may earn a commission. It never changes the price you pay. Following a link sends you to that partner’s own site, where their privacy notice applies. We do not pass them your personal data — a link click carries only the page you came from. Your event entry is never a partner link; it always goes to the organiser. Full list of partners and how placement is labelled: partners page.
Who else sees your data
- Supabase stores accounts, orders, organiser claims, alert signups, rider-result follows and the suppression list in a database hosted in London, UK.
- Stripe processes payments and holds card details. Stripe is its own data controller for fraud prevention; see stripe.com/gb/privacy.
- Apple and Google deliver app notifications to your device.
- Resend delivers the emails you ask for (sign-in links, receipts, rider results and their confirmation), from servers in Ireland (EU). It sees your address and the email we send, nothing else.
- PostHog (PostHog Inc., EU Cloud in Frankfurt) receives the cookieless site analytics described above. It never receives your email, name or payment details.
- Vercel hosts the website and runs the small functions that save your signup. Vercel is a US company; our site is served from their edge network.
- Google Fonts serves the typefaces on this site, which means your browser requests them from Google’s servers. We plan to self-host the fonts to remove this.
- Event organisers never receive your alert signup. If we ever propose sharing aggregate interest with an organiser (“40 riders want to know when entries open”), it will be counts only, never addresses.
We do not sell personal data, and we will not add you to any other list without asking first.
Holiday groups and operator enquiries
When you use trip planning, we store your group name, destination, dates, budget, display name, commitment, optional riding experience and organiser-recorded external payment amounts and references. A payment record is not proof of a transaction through Dirt House. Do not include bank details, passports or medical information.
Group members can see display names, commitments and group totals. Only the trip leaders and the relevant member can see that member’s individual payment records and riding experience. Invite links expire and can be replaced by the organiser. Trip leaders can remove members or add them back. Removed members lose access to the group; their existing payment records are retained for the trip leaders, separately from current group totals. Removing someone does not cancel a booking or issue a refund. The primary trip leader can appoint or demote additional leaders, who can see individual payment records and riding experience. Money requests store a target, due date, reason and selected recipients; each rider sees only their own request details, while leaders can manage the requests. A money request does not collect money. Saved calculator budgets are visible to group members. Closing a group stops updates but retains its records; use the contact route below to request access, correction or deletion.
If you request a group quote, we share your account email, group plan and the note you choose to send with the selected operator. Individual members’ names, riding experience and payment records are not included in that initial enquiry. When the primary leader accepts an operator quote, selected riders’ account identifiers and display names are shared with that operator after the leader confirms their permission. We retain the agreed quote, rider list, booking status, operator reference and status history. Active group members can see the quote and booking status; operators and active trip leaders can see the full booking rider list, while other riders see their own entry. Removed riders retain access to their own booking records through My trips. Cancellation notes are visible to the primary leader and operator. Booking confirmation is reported by the operator and does not verify payment. In an enabled payment test, we also store the agreed deposit deadline and minimum, rider payment attempt identifiers, Stripe Checkout and payment references, amounts, refund amounts, dispute flags and notification identifiers. These test records are separate from manual external payment records. Operators and active trip leaders can see per-rider deposit status; each other booked rider can see their own details. Card entry happens on Stripe’s hosted checkout, not in Dirt House. Operator test-payment setup sends the operator’s business name, registered country and internal account identifier to Stripe. We retain the connected Stripe account identifier and payment-readiness status. New test deposits are processed on that operator’s connected account with a 10% test platform commission. Identity and bank information requested during onboarding is entered directly with Stripe, not in Dirt House. Operator profiles and trips become public only after review. We do not load advertising or product analytics on the private trip workspace.
Tours, bookings and your rider profile
When you book a tour through The Dirt House, the tour operator is the organiser and your contract is with them. We share your name, email, phone, booking details and message with that operator, and your card is charged by the operator through Stripe. Card details are entered on Stripe's page and never reach us. We keep the booking, the amounts, our commission and the Stripe references.
Your rider profile is optional until you book: licence and years riding, off-road experience, height, inside leg, gear sizes, dietary needs, date of birth, nationality, an emergency contact and, if you choose to add them, medical notes. We use it only to pass to operators whose tours you book, so they can check the tour suits you, size your bike and kit, and keep you safe. An operator sees your profile only for riders booked on their own departures. Medical notes are health data: we store them only because you give them to us for this purpose (your explicit consent), and we show them to the operator only once your place is confirmed. You can edit or delete any of it from your account at any time, and it's removed when you delete your account. If a tour has terms or a waiver, we record when you accepted them and a fingerprint of the exact text.
Crew bookings: the rider who holds places gets a link to share. Anyone with the link sees the tour, dates and the first names of riders who've booked, never emails or payment details.
Your rights
You can ask us to show you, correct, delete or export the personal data we hold about you, and you can object to or restrict how we use it. To stop alerts, use the unsubscribe page — it removes your address immediately, no login needed. For anything else, email sveventuresltd@gmail.com and we will reply within 30 days. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Children
The site is for adults planning to ride or spectate. We do not knowingly collect data from anyone under 16. If you think we have, email us and we will delete it.
Changes
When this notice changes we update the date at the top. If a change affects how we use alert signups, we will email everyone on the list before it takes effect.