Privacy Policy
Version effective from 2026-05-15 · Data controller: [Legal entity TBD]
Notice: Working draft pending review by qualified legal counsel.
What personal data we process
| Data category | Legal basis | Retention |
|---|---|---|
| Account data (email, name, date of birth) | Art. 6(1)(b) GDPR — performance of a contract | Duration of the account + 14 days |
| Pet profile data (name, species, photo) | Art. 6(1)(b) GDPR | Duration of the account |
| Health records (vaccinations, visits) | Art. 6(1)(b) GDPR | Pseudonymised after account deletion |
| Push tokens and device settings | Art. 6(1)(b) GDPR | Duration of the account |
| Analytics data (PostHog — no PII) | Art. 6(1)(f) GDPR | 24 months |
Data processors
We share your data solely with the following processors:
- Supabase — database, authentication, storage (EU Frankfurt, AWS)
- Stripe — payments (USA — EU Standard Contractual Clauses)
- Resend — transactional emails (USA — EU Standard Contractual Clauses)
- Loops — lifecycle & marketing emails (USA — EU Standard Contractual Clauses)
- PostHog CE — analytics (self-hosted on Hetzner, EU)
Your rights
Under the GDPR you have the right of access, rectification, erasure, portability and restriction of processing.
Send requests to: [email protected]
Supervisory authority: Office for Personal Data Protection (ÚOOÚ), Prague; users in Slovakia may contact the Office for Personal Data Protection of the Slovak Republic (ÚOOÚ SR), Bratislava.