Riding Lessons Website Privacy Policy

Effective date: October 16, 2026

At Chava Farms, we want you to understand what information you share with us and how we use it when you explore riding lessons or ask us to follow up.

1. Which website this policy covers

This policy covers our riding-lessons landing page and “Get started with riding” quiz at Chava Farms riding lessons, including the riding-lessons homepage, consultation requests and native riding registration (the “Site”). Chava Farms owns and operates this Site.

Our main website, chavafarms.net, booking services, waiver forms, social-media pages and messaging services are separate destinations. This policy describes this Site's quiz, consultation and registration process; it does not replace the notices or terms covering those other services.

Contact: info@chavafarms.net · (647) 989-1836
11162 Kennedy Rd., Markham, ON L6C 1P1.

2. You can see your quiz result without giving us an email

Your quiz answers are used in your browser to produce a preliminary lesson guide. Taking the quiz does not itself create an inquiry in our Google spreadsheet. The active draft stays in browser memory during internal navigation; our code does not store it in cookies or local storage. A refresh or closed tab can lose it. No CRM record is created until you explicitly submit a consultation request or registration with the required consent. After a confirmed save, the active personal-data draft is cleared; the page retains the submission reference.

When online contact requests are available, you can separately choose to ask us to follow up. Your name, phone number and email address are required for a lesson inquiry so our team can discuss your lesson options and email waiver and payment instructions once a riding session is arranged. You must select an unchecked contact-consent box before submitting a request. Browsing the Site or completing the quiz is not consent to a contact request or marketing emails.

The consent choice reads:

“I’d like Chava Farms to use my contact details, the rider’s date of birth, riding answers and lesson options to keep an inquiry record and contact me about riding lessons and next steps. Waiver details will be emailed once a session is arranged. This does not subscribe me to marketing messages.”

A different, optional, unchecked choice asks: “I am 18 or older and would like Chava Farms news and updates by email when the newsletter launches. I can withdraw my consent at any time.” Email is required for a lesson inquiry whether or not you select that newsletter choice. Entering an email by itself does not subscribe you. The newsletter is not sending yet. You can withdraw newsletter permission by contacting info@chavafarms.net; future newsletter messages must include a working unsubscribe option.

You may also use the separate newsletter signup without completing the quiz or requesting a lesson. It asks for your email and the separate, unchecked adult newsletter consent above. We save your email, consent wording/version and time, signup source and reference, and subscription/retention status in a private subscriber list. Explicit newsletter choices from other forms feed the same list; contact or registration consent alone does not. We consolidate duplicate email addresses, preserve withdrawals and do not verify email ownership or send an automatic confirmation message. A previously withdrawn address requires staff review before rejoining.

The following sections explain how we handle information when you choose to submit an online contact request. Optional ad measurement has its own separate choice, described in section 4.

2a. Ask a riding question without taking the quiz

The separate riding-question form requires a reply email address, a message and an unchecked adult contact-consent box. Your name is optional. It does not ask for a phone number, rider DOB or health/support information. Please do not include medical information or a child's name or contact details in your message.

“I am 18 or older and would like Chava Farms to use my email address and message to reply to my question. This does not subscribe me to marketing emails.”

We save the question, email, optional name, submission reference and time, contact-consent wording/version, separate newsletter choice, and administrative follow-up and notification status in a restricted question tracker. Staff reply separately; submitting the form does not itself send you an email, reserve a lesson or confirm a booking. The optional newsletter box is separate from permission to reply.

3. Information included in a contact request

• The contact person's name, phone number and email address, all required for an inquiry.
• Whether the contact is the rider, a parent/guardian, or another authorized person; the rider’s date of birth (date only), age calculated in Toronto time at submission, and the submission timestamp. DOB is the lasting CRM value; recorded age is a historical snapshot, not a permanently current age. Older age-only records stay unchanged; we never infer a DOB from an old age.
• The rider's selected current riding ability, the help needed to maintain safe spacing around other horses, and one or two goals, including details when Other is selected. A broad registration experience category is derived from the current-ability answer when supported; it is recorded separately from the answer the rider selected.
• All relevant lesson formats and reasons, a provisional rider level and review flag, plus questionnaire, rules and schema versions. Historical responses keep their original meanings.
• A submission reference, submission time, contact-consent choice and wording version; and separate newsletter-consent choice, wording version and time where applicable.
• An optional preferred riding date/time, separate from callback availability. If you choose one, a preferred callback date and three-hour window in Toronto time, with a status distinguishing a request from a confirmed appointment.
• Staff-notification status and time, and any necessary lesson-inquiry follow-up notes, including the last follow-up date, that our authorized administrator adds.

The quiz and consultation do not ask for gender identity, payment details, diagnoses or medical history. Please keep medical information out of their free-text fields. Date of birth supports age-based routing and guardian requirements; it does not verify identity, consent or authority.

3a. Registration and optional health/support information

Direct registration includes the shared riding questions. Registration after the survey omits those completed questions from its normal sequence and includes an editable summary of the earlier answers. Both paths submit the same complete information. If earlier answers are unavailable in the current tab, the applicant can continue with the complete form. Registration collects the rider’s name, DOB, address, height and weight; adult contact and guardian relationship where needed; an emergency contact’s name, phone and relationship; and a selected lesson format, duration and listed price. Submission date, versions, consent evidence and a reference are recorded automatically.

To prepare for participation, we ask about allergies and practical support needs. Diagnosis selections are optional. You may choose to discuss allergies or support with the team instead of providing details online. Applicable follow-ups cover ASD-related support and communication; answers hidden by a changed choice are excluded from submission. Health/support answers do not change the riding-skills classification.

The registration consent reads: “I agree that Chava Farms may use my contact details, the rider’s date of birth, riding answers and registration details, including any health and support information I choose to share, to keep a rider record, prepare for participation and contact me about lessons. This does not subscribe me to marketing messages.” This checkbox and adult/guardian authorization are unchecked by default, including when earlier answers are prefilled.

Health/support and registration records are held in restricted farm-managed registration records, separately from consultation, general-question and subscriber records. Information is for authorized intake staff arranging and preparing for riding lessons. The general question form and standalone newsletter do not request rider DOB or health information.

Registration submits information and a selected lesson time for staff review. A successful save can create a provisional calendar reservation for the requested time; the response distinguishes a reserved time from a time still requiring review. This is not a confirmed lesson or a payment. After approval, the farm emails payment instructions and the next steps for the waiver. The spot is held for 24 hours from when that instructions email is sent, with the exact deadline shown in the email. Final booking confirmation follows the required approval, payment and completed waiver. Historical requests keep the terms under which they were submitted.

4. Technical information and links

Delivering a web page or submission involves technical request information, such as an IP address, requested page and browser information. Our hosting and infrastructure providers process requests to operate and protect the service and may maintain operational or security logs. The quiz inquiry record does not include your IP address, precise location or browsing history.

The Site does not collect form answers automatically for CRM purposes. We do not use Google Analytics or Meta advertising trackers on this Site. Optional Google Ads measurement is described below and requires a separate choice.

Optional Google Ads measurement

With “Accept measurement,” Google Ads can use advertising measurement cookies and receive limited technical information, including your IP address, browser/device and ad-click information, a page address without query parameters or fragments, and generic action information with a random deduplication reference. Google may read advertising cookies that were set previously. This helps us understand whether our ads lead to registrations and other actions. Google's infrastructure may process this information outside Canada. See how Google uses information from sites that use its services.

No Google measurement library is loaded and no measurement request is sent to Google before you explicitly accept. “Accept measurement” and “Reject measurement” are equally available, and you may close the choice without accepting. Rejecting or postponing measurement does not prevent browsing, viewing your guide, using the forms or contacting the farm. Contact, registration and newsletter consent are separate from ad-measurement consent.

Our primary campaign measure is a successfully saved riding registration. Separately, we measure successfully saved consultation requests, riding questions and newsletter signup requests, and clicks on outbound contact, social-media and booking links. These other actions are secondary measures. A registration save is not a confirmed booking or proof that someone became a student. A newsletter save records the request, not verified email ownership or a newsletter being sent. A link click is not proof that a call connected, a message was delivered or a booking was completed.

A form action counts only after our server acknowledges that exact request as saved. Failed, mismatched and uncertain save responses do not count as successful saves. Accepting measurement does not replay earlier acknowledged saves or earlier clicks. We send generic event categories and a reference derived from a random submission or click ID to help avoid duplicate counting. We do not send names, email addresses, phone numbers, addresses, message text, DOB, rider ages or profiles, riding answers, lesson or callback preferences, health/support information, emergency contacts or newsletter consent answers to Google Ads. Outbound measurement does not include the full destination URL, contact address or message text.

We do not use enhanced conversions, Google Analytics, remarketing or personalized advertising through this Site's tag. Ad-personalization consent stays denied. We do not send contact details, their hashes, customer lists or health/support details to Google Ads, and do not use your form answers to build advertising audiences.

Use “Privacy choices” on a Site application page to change your choice. We remember a versioned choice in this browser's local storage for up to 180 days and ask again when it expires or the notice version changes. If you reject after accepting, our code stops future events, removes accessible first-party advertising measurement cookies and its stored event references, and reloads the page when the Google library has already loaded. Save any inquiry or registration before turning measurement off: reloading can lose an unsaved draft. A rejection guard in browser session storage also prevents an old accepted local-storage choice from restoring measurement after withdrawal. If preference storage is blocked, a fixed rejection-only flag in the page address and tab preserves that rejection through the reload. It takes precedence over any older accepted choice and is cleared only after rejection can be saved safely, or you explicitly accept again. This flag contains no form or contact information. If a preference cannot be saved, the available in-memory/session safeguard applies; acceptance is not carried to a new page without a valid saved choice. We cannot remove Google's own-domain cookies or undo information already received by Google.

After consent, this browser stores only random or hashed-random event references and timestamps for duplicate-attempt protection, limited to the most recent 200 references. References older than 90 days are pruned the next time the Site's measurement code is used; browser local storage does not delete them automatically while you are away. Rejecting removes these references. Advertising measurement cookies are configured with a 90-day lifetime; Google may refresh that lifetime on later consented visits. Google retains information it receives under its own applicable policies and account settings. This measurement storage is separate from the inquiry-retention period below.

Following a booking, email, telephone, WhatsApp, maps or social-media link opens a separate service. With measurement consent, the Site may record the generic click described above. Information you provide at the destination is handled under that service's applicable privacy notice; it is not automatically copied into the farm's inquiry tracker or sent back to this Site as a completed contact or booking.

5. Why we use your information

We use a submitted inquiry to prepare an age-appropriate lesson conversation based on current skills, experience, readiness around others and goals. We respond by phone and email, discuss all relevant lesson options, consider riding and callback preferences, and manage follow-up. Once a riding session is arranged, staff email the waiver and payment instructions separately. This quiz does not automatically email documents or collect completed waivers, signatures or medical information.

Submission references, consent records and notification status help us avoid duplicates, document your choices and resolve delivery problems. Limited request checks also help protect the service against misuse. Newsletter permission is a separate purpose and does not authorize using the full rider profile for a mailing list or advertising platform.

The quiz follows predefined rules to identify all relevant lesson formats. It does not send your answers to an AI model, make a clinical assessment or confirm lesson placement. Our team must confirm suitability and availability. A callback window is a requested time to receive a call, not a three-hour consultation or a confirmed appointment. A contact request is not a booking, payment or automatic result email, and creates newsletter permission only if you separately opt in.

6. Who handles the information

We use OpenAI Sites and its Cloudflare hosting infrastructure to serve the Site and process its contact-request connection. We use Google Apps Script to receive and validate a request, Google Sheets to store it, and Google's email service to notify the authorized inquiry administrator.

The new consultation and registration trackers are restricted to the administrator’s account; access requires an explicit staff grant. Existing inquiry, question and subscriber records remain accessible to their already-authorized staff. A notification contains a submission reference and a link to the private tracker, not the visitor’s name, contact details, DOB, riding answers or health/support details. Opening the link still requires permission to access the tracker.

Service providers process information as part of providing these services. Their infrastructure may process or store information outside Canada, where it may be subject to the laws and lawful access requirements of other jurisdictions. We do not promise Canada-only storage. You can contact our privacy contact with questions about these arrangements.

We do not sell inquiry or registration information or send your contact details, message, DOB, riding answers or health/support information to advertisers. If you accept optional ad measurement, the limited technical information, generic action and random reference described in section 4 are sent to Google Ads to measure our ads. We do not authorize personalized advertising or remarketing through this Site's tag. We may disclose information where required by law, for a legal proceeding, or to establish or protect legal rights, as permitted by applicable law. Any disclosure connected with a proposed transfer of the organization would also need to comply with applicable law. We remain responsible for the inquiry information under our control.

7. How long we keep inquiries

For an inquiry or registration that does not become a booking, we retain your contact details, quiz answers and related inquiry record for no longer than 12 calendar months after the last substantive follow-up, unless a specific legal requirement or documented legal hold requires longer retention. If there has been no follow-up, we measure this period from the submission date. We remove information sooner when it is no longer needed or when we can fulfil a deletion request. Automated notifications and internal administrative notes do not restart this period.

If an inquiry or registration enters the farm’s booking process, staff document that transition and the applicable booking retention arrangements, retain only the information needed for that service, and explain those arrangements to you. Conversion to a booking does not by itself justify keeping an unnecessary duplicate quiz inquiry.

Our authorized inquiry administrator handles record review and removal, with privacy questions directed to our privacy contact. Removal covers the active tracker, related inquiry emails and authorized working copies under our control. The current connection does not automatically delete records; removal is a manual responsibility.

Provider backups and version history may persist under the provider's retention and recovery practices after removal from our active records. We cannot guarantee immediate erasure from every backup. Any information retained for a specific legal obligation or hold is restricted to that purpose and reviewed for removal when the reason ends. Retention does not permit us to add you to marketing lists.

Until the newsletter launches, optional newsletter permission is recorded with the originating request where applicable and in the separate private subscriber list. This is not an indefinite mailing list, and copying a consent does not restart its retention period. Newsletter permission from an inquiry or registration expires with that request and no later than 12 calendar months after its last substantive follow-up, or submission when there has been no follow-up. Standalone newsletter permission is retained for no longer than 12 calendar months after that explicit signup unless renewed; a riding-question newsletter choice is retained for no longer than 12 calendar months after its explicit opt-in unless renewed. Staff review and remove expired entries and unnecessary copies manually. Newsletter permission does not extend retention of rider or question information. Withdrawal stops active use sooner; a minimal suppression record may remain as needed to honour the withdrawal and prevent accidental re-addition. Your separate lesson-inquiry request can remain unless you also withdraw it. Launching the newsletter requires review of its notice, retention and unsubscribe arrangements before any newsletter is sent.

8. How we protect information

The Site and its connection to Google use HTTPS. The server signs submissions so the Google receiver can check that they came through the configured connection. The spreadsheet is not shared publicly, and the notification avoids including the inquiry's contact details. Our application keeps DOB, contact information and health details out of URLs, analytics, diagnostic logs and notification-email bodies. An immutable submitted payload and reference are kept in the restricted record to reconcile retries; staff follow-up notes do not alter that snapshot.

These measures reduce risk, but no internet transmission or storage system can guarantee absolute security.

9. Children and information about another rider

The person submitting an online contact request must be 18 or older and must be the rider, their parent or guardian, or another adult authorized to inquire for them. Younger riders can still view the preliminary quiz guide without sending their contact details. This adult-contact rule applies to the inquiry form; it does not set the minimum age for riding lessons.

For a rider under 18, a parent or legal guardian must explicitly confirm their relationship and authority and use their own contact details. A younger rider can start the quiz, and a guardian can continue the in-memory answers without inheriting checked consent. Registration asks for the rider’s name; consultation does not. The DOB and riding answers describe the rider, while the main phone and email identify the adult to contact. We recalculate guardian requirements when registration opens and at submission.

If you believe someone under 18 has submitted their own contact details through this form, please contact our privacy contact so we can investigate and arrange removal or an appropriate parent/guardian follow-up.

10. Your choices, access and privacy questions

You may contact us to ask what inquiry information we hold about you, how it has been used or disclosed, to request a correction or deletion, or to withdraw your request for further lesson-inquiry contact. We may need reasonable information to verify your identity before releasing or changing a record. We will explain any applicable legal restriction that prevents us from fully fulfilling a request.

Withdrawing consent may prevent further follow-up, but it does not prevent you from viewing the quiz result. Please do not email identity documents or medical information unless we have agreed on an appropriate way to provide necessary information.

Privacy contact: Sara Tamar Ackermann
info@chavafarms.net
(647) 989-1836
11162 Kennedy Rd., Markham, ON L6C 1P1.

11. Changes to this policy

We will update this policy and its effective date when our practices change. Material changes will be explained through an appropriate notice, and we will seek additional consent where required. A policy update will not silently turn a lesson inquiry into a marketing subscription.

Read the accompanying website terms.