Privacy Policy

FlockFinder Privacy Policy

Last updated: May 2026

This Privacy Policy explains how Black Sheep Technology Ltd (trading as FlockFinder) collects, uses, shares and protects your personal data, and the rights you have over it. It applies to our website at flockfinder.co.uk, our web application at app.flockfinder.co.uk, our iOS and Android apps, our "Ask FlockFinder" tool at ask.flockfinder.co.uk, and the supply of the FlockFinder FDX EID Reader (together, the "Service").

We are committed to handling your personal data in accordance with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended (including by the Data (Use and Access) Act 2025).

1. Who we are

Black Sheep Technology Ltd is the "controller" of your personal data. This means we are responsible for deciding how and why your data is used.

Company: Black Sheep Technology Ltd, a company registered in England and Wales (company number 12365350), trading as FlockFinder.
Registered office: 4 Burlington Mews, Sevenoaks, Kent, TN13 1FJ.
Contact for privacy matters: hello@flockfinder.co.uk

2. The personal data we collect

We collect the following categories of personal data:

Account and identity data — your name, email address, phone number, password (stored in encrypted/hashed form), and the farm or business name you register.
Holding data — your County Parish Holding (CPH) number and farm or holding details. On its own this is usually business information, but combined with your name it forms part of your personal data.
Hardware order and delivery data — your delivery address and contact details when you order an FDX EID Reader.
Payment data — billing details and a record of your transactions. Card payments are processed by Stripe; we do not store your full card details.
Content you create — livestock records, medicine records, lineage and performance data, field maps, notes and photographs. This is mostly information about your animals and land rather than about people, but it may contain personal data (for example, where notes or photographs identify an individual).
Team and contributor data — where you invite team members or contractors, the name and email address of each person you invite.
"Ask FlockFinder" queries — the questions you submit to our AI assistant and the responses generated.
Usage and device data — your IP address, device type, operating system, browser type, app version, pages and features used, and dates and times of access, collected automatically.
Support data — the content of messages you send us and our correspondence with you.
Marketing data — your marketing preferences and whether you have opted in or out of communications.

We do not intentionally collect any "special category" data (such as health, racial or political data). Please do not submit such data through the Service.

3. How we use your data, and our lawful bases

Under data protection law we must have a "lawful basis" for each use of your personal data. The table below sets out what we do and why.

What we use your data for Categories of data Lawful basis Creating and managing your account; providing the app and its features Account, identity, content, team data Performance of a contract with you Processing payments and managing subscriptions Account, payment data Performance of a contract Taking, fulfilling and delivering FDX EID Reader orders Hardware order/delivery, payment data Performance of a contract Providing customer support Account, support, content data Performance of a contract; and our legitimate interests in supporting users Operating the "Ask FlockFinder" assistant Ask FlockFinder queries, account data Performance of a contract; legitimate interests in providing and improving the tool Keeping the Service secure, preventing fraud and abuse Usage, device, account data Legitimate interests in protecting our Service and users Analysing and improving the Service Usage, device, content data (aggregated where possible) Legitimate interests in developing our products Sending you service messages (e.g. renewal reminders, security notices, changes to terms) Account, marketing data Performance of a contract; legal obligation where required Sending marketing about FlockFinder products and services to existing customers Account, marketing data Legitimate interests (existing customer "soft opt-in" under PECR) — you can opt out at any time Sending marketing to people who are not existing customers Account, marketing data Consent Meeting our legal, accounting and tax obligations Account, payment, transaction data Legal obligation Establishing, exercising or defending legal claims Any relevant data Legitimate interests in protecting our legal position Evaluating or carrying out a sale, merger or reorganisation of our business Any relevant data Legitimate interests in running and developing our business Creating anonymised and aggregated data, statistics and insights Account, usage, content data Legitimate interests (after anonymisation, the resulting data is no longer personal data) Developing, training and improving our models, algorithms and features (including AI features), using anonymised or aggregated data wherever possible Usage, content data Legitimate interests in developing our products

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and have concluded they are not. You can ask us for more information about this assessment using the contact details in section 12.

Where we rely on consent (for example, certain marketing or non-essential cookies), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Anonymised and aggregated data. We may convert personal data into anonymised, aggregated data, statistics and insights. We carry out this anonymisation under our legitimate interests. Once data has been anonymised so that it no longer identifies you or any individual, it is no longer personal data, and we may use, retain, share, license and commercialise it for any purpose, including developing and marketing our own and our group companies' products and services. We will not share anonymised data with any third party in a form that identifies you or any individual.

4. Cookies and similar technologies

We use cookies and similar technologies on our website and web application to make them work, to keep you signed in, to remember your preferences, and to understand how the Service is used.

We use:

Strictly necessary cookies — required to operate the Service, authenticate you, and keep it secure. These do not require your consent.
Functional cookies — to remember your settings and preferences.
Analytics cookies — to measure and improve performance. We use PostHog for product analytics.

We will only set non-essential cookies (such as analytics or functional cookies that are not strictly necessary) with your consent, which you give through our cookie banner, and you can change your choices at any time. Some low-risk cookies (for example, certain aggregate analytics) may be used without consent under the Data (Use and Access) Act 2025, but we will still tell you about them and offer you a way to opt out.

5. Who we share your data with

We do not sell your personal data. We share it only with the following recipients, and only as needed:

Hosting and infrastructure — Microsoft Azure (our cloud hosting and storage provider).
Payment processing — Stripe.
Email and marketing communications — Mailchimp.
AI assistant — OpenAI (which powers "Ask FlockFinder").
Product analytics — PostHog.
Error monitoring — Sentry.
Professional advisers — our accountants, lawyers and insurers, where reasonably necessary.
Authorities and regulators — where we are required to disclose data by law, or to establish, exercise or defend legal claims.
Prospective buyers, investors and successors — in connection with a possible or actual sale, investment, merger or reorganisation of our business, we may share personal data with the other party and its advisers under confidentiality obligations; and if a transaction completes, your data may transfer to the buyer, who will be required to protect it in line with this policy or to notify you of any replacement policy.

Each provider that processes data on our behalf does so under a written contract that requires them to keep it secure and use it only on our instructions.

6. International transfers

We aim to store and process your data in the UK or European Economic Area. Some of our providers process personal data outside the UK, including in the United States — for example, OpenAI (which powers "Ask FlockFinder") and Mailchimp (email). Where data is transferred outside the UK, we rely on an appropriate safeguard, such as UK "adequacy" regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified), or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details using the contact details in section 12.

7. How long we keep your data

We keep your personal data only for as long as we need it:

Account, profile and content data — deleted within 90 days of your account being closed, unless we need to keep it for a reason below.
Financial and transaction records — retained for 6 years from the end of the relevant financial year, to meet HMRC and Companies Act requirements.
Support correspondence — kept for up to 2 years after your query is resolved, and longer only where we need it to resolve a dispute or meet a legal obligation.
Usage and analytics data — kept in identifiable form for up to 14 months, after which it is aggregated or anonymised.
Marketing data — kept until you opt out, after which we keep a minimal suppression record so that we do not contact you again.
Backups — data may remain in routine encrypted backups for up to 90 days after it is deleted from the live system.

Important — records you must keep yourself. Some livestock medicine and movement records carry statutory retention obligations that rest on you, not on us (for example, medicine records must generally be kept for a set period under veterinary-medicines rules). Deleting your FlockFinder account does not discharge those obligations. Please export and keep your own copies of any records you are legally required to retain.

8. How we protect your data

We use commercially reasonable technical and organisational measures to protect your data, including encryption in transit, access controls and hosting on reputable cloud infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will comply with our legal obligations in the event of a personal-data breach, including notifying the ICO and affected individuals where required.

9. Your rights

Under data protection law you have the right to:

be informed about how we use your data (this policy);
access the personal data we hold about you;
request rectification of inaccurate or incomplete data;
request erasure of your data ("right to be forgotten") in certain circumstances;
request restriction of our processing in certain circumstances;
object to processing based on our legitimate interests, and to direct marketing at any time;
request portability of data you provided to us, in a machine-readable format;
withdraw consent at any time where we rely on consent; and
not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you (see section 10).

To exercise any of these rights, contact us using the details in section 12. You can also update or delete much of your data directly within your account settings, and export your records at any time. We will respond within one month. Exercising your rights is free in most cases.

Complaints. If you are unhappy with how we have handled your data, please tell us first using the details in section 12 so we can try to put it right. You also have the right to complain to the UK's data-protection regulator:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 — Website: ico.org.uk

10. Automated decision-making

FlockFinder includes features that help you make decisions — for example, the "culling analysis" ranking, dosage suggestions, and the "Ask FlockFinder" assistant. These are decision-support tools: they present information and suggestions, but you remain in control and make the final decision. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects on you.

11. Children

The Service is intended for users aged 18 or over and is a tool for managing farm businesses and flocks. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Contact us

For any question about this policy or your personal data:

Black Sheep Technology Ltd (trading as FlockFinder) Email: hello@flockfinder.co.uk Registered office: 4 Burlington Mews, Sevenoaks, Kent, TN13 1FJ

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before they take effect, and we will update the "Last updated" date above. We encourage you to review this policy periodically.