Privacy Policy, version 1.5

This Privacy Policy describes how PetsyPlanet (we, us, the Service) collects, uses, and protects your personal data. We operate in compliance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

1. Data Controller

The controller of your personal data is LowekStudio Krystian Rygiel, Polish tax ID (NIP) 9512469584. For data protection matters, contact us at: hi@petsyplanet.pl

We have not appointed a data protection officer. For all matters concerning personal data, write directly to the address above.

2. What data do we collect?

2.1 Data you provide

• Account data: email address, optional name or display name, account identifier and information needed to sign in, including through Apple or Google.
• Pet profile data: name, species, breed, date of birth, photo, microchip number and passport details.
• Pet records: vaccinations, vet visits, medications, body weight, feeding and walks, including an optional vet visit cost.
• QR tags and missing-pet reports: contact details, city or address, description and last-seen map point you provide. Selected tag details are visible after scanning the code; published missing-pet reports are public. Sharing pet records with family covers the pets and permissions you select. The data shown when you ask a vet to complete a visit is described in a separate section.
• Website form data: email address and message content (contact form, partner inquiries, waitlist sign-up), stored in our database to handle your request.

2.2 Data collected automatically

• Our own UX analytics: event and screen name, platform, app version and a random session identifier generated at launch and not persisted on the device. Event rows contain no account or device identifier, and we do not send the content you type. You can switch this off in Settings → Privacy. Raw events are deleted after 90 days.
• Partner-offer impressions and clicks: offer identifier, offer type and interaction. These events contain no user or device identifier. Separate notification delivery logs contain the push token.
• Error and crash logs, including in guest mode: error message and stack, platform, app version and environment flag. When signed in, the log includes your account identifier. Error logs are deleted after 30 days.
• After you allow notifications: push token, platform, activity time, the status of your consents to “Messages from PetsyPlanet” and to partner offers, and the link to your account if you are signed in.
• After new, voluntary ad-measurement consent: Google Analytics for Firebase processes app events, an app-instance identifier, app and device information, and approximate location derived from IP. Details and withdrawal are described in the registration-measurement section.
• IP address and technical data in server logs, needed to serve connections and maintain security, including sign-in rate limits. Guest mode does not disable technical connections, error logs or our own offer and UX statistics.

The App is intended for people aged 16 or over. We do not knowingly collect data from younger people. If you believe someone under 16 has created an account, write to us and we will delete their data.

3. Purpose and legal basis for processing

We process your data for the following purposes:

• Performance of contract (Art. 6(1)(b) GDPR): providing PetsyPlanet, account management, synchronisation, the PDF pet health report, sharing selected data, asking a vet to complete a visit, and service messages.
• Legitimate interest (Art. 6(1)(f) GDPR): security, fixing errors, our own UX and offer analytics, a technical ledger of first verified registrations, billing and the monthly limit for document reading, and keeping the consent history to defend against claims.
• Consent (Art. 6(1)(a) GDPR): optional ad measurement and account-linked campaign attribution, Google Analytics for Firebase and Google Ads measurement, “Messages from PetsyPlanet” by email and push, partner-offer notifications, and AI document reading.
• Legal obligation (Art. 6(1)(c) GDPR): compliance with tax and legal requirements.

4. Partner content, messages and notifications

The app is free of charge and funded through partner content, banners and offers from pet shops and services. Such content is labelled as sponsored.

We provide partner-offer advertisers with aggregate impression and click counts. Offer-event rows contain no account or device identifier. Optional measurement of our own ads through Google is a separate flow described in the registration-measurement section; we do not provide pet records or account details in that flow.

“Messages from PetsyPlanet” are tips, news and information about our animal-help campaigns, sent by email and as push notifications. We send them only with your consent, which we ask for on a screen after your first sign-in; you can also turn it on or off in Settings. Push notifications with partner offers require a separate consent. The legal basis is your consent (Art. 6(1)(a) GDPR) and Article 398 of the Polish Electronic Communications Law of 12 July 2024. These consents are independent of health reminders: not giving or withdrawing them does not turn off reminders about medication, vaccinations, parasite protection or walks.

We send no more than 2 “Messages from PetsyPlanet” push notifications within 30 days and no more than 1 partner-offer notification per device within 7 days. You can withdraw these consents at any time in the App: Settings → Notifications. Every “Messages from PetsyPlanet” email contains a link that unsubscribes you with one click. Withdrawal takes effect immediately and requires no contact with us. Processing carried out before withdrawal remains lawful.

We store the device notification token and the push consent status for that device. On sign-out we detach the token from the account and turn off its push consents so they do not carry over to another account; the token itself may remain in the device registry. Account deletion removes tokens still associated with that account.

We keep a consent history: the channel (email, push, partner offers), whether consent was given or withdrawn, where in the App, the version of the consent text and the date. Instead of your email address, it stores a cryptographic hash of it. The history serves as proof that consent was given or withdrawn (Art. 7(1) GDPR). We keep it for the lifetime of the account and for up to 3 years after consent is withdrawn or the account is deleted, to defend against claims (Art. 6(1)(f) GDPR).

Service messages, meaning information about security, changes to the Terms or the Privacy Policy and matters concerning your account, are sent by email, notification or in the App without marketing consent, as part of performing the contract (Art. 6(1)(b) GDPR). They contain no advertising. Unsubscribing from “Messages from PetsyPlanet” does not stop service messages.

Registration attribution after app installation

After the first verified sign-in, we keep a technical new-account ledger in our database for up to 90 days: account, event and first-session identifiers and registration time. Only after voluntary ad-measurement consent do we attach campaign, creative, breed and platform labels to our own report. On Android, a random Google Play handoff reference is read after consent and is valid for up to 30 days. In versions with Google Analytics for Firebase, new, explicit consent additionally enables sending app events and technical data to Google for analytics and Google Ads measurement. Previous consent to first-party-only reporting does not enable the SDK. The registration event we send is sign_up with method app; it contains no email, account identifier, handoff reference or pet data. The SDK may automatically measure app lifecycle and sessions, use its own app-instance identifier and derive approximate location from IP, even though Google Analytics does not store the IP itself. We disable IDFA, Android Advertising ID, SSAID, IDFV and automatic screen reporting, and do not enable personalised advertising. The iOS on-device measurement variant uses event data rather than an email or phone number supplied by us; availability depends on region and Google configuration. iOS results may be aggregated or modelled and do not attribute every account to a particular ad. Returning to the browser is not required. You can withdraw consent in Settings → Privacy: this disables collection, removes a local pending event and resets local Analytics data. It does not automatically erase data already processed by Google. Deleting your account removes linked measurement in our database. Google-data retention depends on the service settings; you may contact us about erasure.

Community

Applies to the “Community” feature when it is available in the App.

If you join the Community in the App, we also process:

• The name visible to others, the date you accepted the rules and your confirmation that you are at least 16.
• Your questions, answers and photos, and the pet badge on a question: name, breed and age in years. Other Community members see them in the App; they are not published on the internet. For an anonymous question, others do not see the author, but the moderation team does.
• Before upload, photos are resized and re-encoded, so they contain no data about where the photo was taken or about the device.
• “Helpful” marks, reports, blocks of other people and the history of notifications about answers.
• The moderation log: decisions about your posts, their statements of reasons and the results of automated assessment.
• We send the query entered in Community search to our server to find matching questions. We do not include the query text in UX analytics events.

The legal bases are performance of the contract (Art. 6(1)(b) GDPR), i.e. providing the Community, our legitimate interest in keeping users safe (Art. 6(1)(f) GDPR) and obligations under the Digital Services Act (Art. 6(1)(c) GDPR): handling reports, statements of reasons and appeals.

When automated moderation is enabled, we send the post text and photo to OpenAI as a data processor under a data processing agreement. OpenAI assesses the content for violations and does not use it to train models. Data may be processed outside the European Economic Area on the basis of standard contractual clauses. OpenAI may retain it for up to 30 days for abuse monitoring. We do not send your email address or other account data.

Posts are checked automatically by OpenAI's moderation tool. A post may be temporarily hidden until a moderator reviews it. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). A block on posting or on an account is always approved by a human. You can contest any decision by writing to hi@petsyplanet.pl; a human will review it.

We keep posts until you delete them or your account. We automatically delete the moderation log and resolved reports after 6 months, when the time to appeal has passed. Posts secured as evidence of illegal content are kept for as long as law enforcement requires, including after account deletion.

AI document reading

Applies to the “AI document reading” feature when it is available in the App.

If the feature is available in your app, you can scan a document from your vet (for example a discharge summary, an invoice or a page of the pet's health booklet) or choose a PDF file, and the App will suggest entries for the pet's records based on it.

• What we send: photos of the document pages or the PDF file are sent to Claude, an artificial intelligence model. The document may contain your data (for example name, surname, address) and data of other people, such as the vet. Before scanning, you can cover any data you do not want to share.
• Recipient: Anthropic Ireland, Limited, Dublin (Ireland), as a data processor under a data processing agreement (DPA). Processing may take place in the United States by Anthropic PBC and its sub-processors. The transfer of data outside the European Economic Area is based on standard contractual clauses adopted by European Commission Decision (EU) 2021/914.
• The provider does not use submitted documents to train models. It deletes them no later than after 30 days. It keeps them longer, for up to 2 years, only if its safety systems flag the content as violating its usage policies.
• We do not store photos or document files. We save only the data you review and approve: the visit, vaccinations, parasite protection and weight.
• Usage log: number of pages, number of tokens, cost and reading status, without the document content. It is used for billing with the provider and for enforcing the limit of 10 pages per month. We keep it for 90 days.

Document reading is based on your consent (Art. 6(1)(a) GDPR), which we ask for on a screen before your first scan. Without consent the scanner will not start, and the rest of the App works normally. You can withdraw consent in the App: Settings → Privacy. Withdrawal does not affect the lawfulness of readings carried out before. We keep the usage log on the basis of our legitimate interest (Art. 6(1)(f) GDPR), namely billing and enforcing the limit.

Asking a vet to complete a visit

When you ask a vet to complete a visit record, we store the vet's email address and your message, and the vet receives an email with a one-time link valid for 7 days.

After opening the link, the vet always sees the same set of data: the pet's name, species, breed and date of birth, information about allergies and neutering, current medication, the latest weight, the details of this visit (date, type, clinic and its address, vet, diagnosis, recommendations, cost, notes) and your message. The vet does not see your email address or any other records. What the vet enters is added to this visit in your pet's records.

Towards you, the legal basis is performance of the contract (Art. 6(1)(b) GDPR). We process the vet's data, meaning the email address and the content entered, on the basis of our legitimate interest in handling your request (Art. 6(1)(f) GDPR). The vet is informed about this processing on the page the link leads to. By providing the vet's address, you confirm that you may use it for this purpose.

5. How long do we retain data?

• Account and pet records: for the lifetime of the account. Account deletion starts removal of data from the active database and file storage. Separate periods apply to technical logs and evidence of violations described below; deletion does not automatically erase data already sent to Google.
• After account deletion, the following remain: foods you added to the catalogue (without a link to your account), the consent history as proof that consent was given or withdrawn (see section 4), and settlement data for fundraising campaigns, without data about voters.
• Our raw UX events: 90 days; error logs: 30 days. Partner-offer statistics are retained for campaign operation and settlement; automatic UX-event pruning does not cover them.
• Vet invitations with the vet's email address: no later than 14 days after sending. Missing-pet reports: up to 30 days after the case is marked as resolved.
• Community moderation log and resolved reports: 6 months. Document reading usage log: 90 days.
• Voting in Pomagamy campaigns (when a campaign is running): we store your vote, its date and the result of checking whether your account meets the campaign rules, as well as hashes of your IP address and app installation ID, calculated separately for each campaign to detect double voting. We delete the hashes 90 days after the campaign ends, and keep the vote itself until the campaign is settled and for the limitation period for claims. Results are never published with your name.
• Consent history: for the lifetime of the account and for up to 3 years after consent is withdrawn or the account is deleted.
• Address on the “Messages from PetsyPlanet” mailing list: until you unsubscribe or delete your account. After you unsubscribe, we keep the address with an unsubscribe flag, and after you delete your account only a one-way hash of it, so that we do not send another marketing message to that address.
• Technical registration ledger and our own attribution report: up to 90 days; store handoff reference: up to 30 days. Deleting an account removes its linked measurement records in our database.
• Website Google Analytics and in-app Google Analytics for Firebase statistics: according to each service’s retention settings. Collection requires the applicable consent; withdrawal does not automatically erase data already processed.
• Security logs and administrator access logs: 90 days.
• Tax records: 5 years as required by Polish law.

6. Who do we share data with?

We never sell your personal data. We may share it with:

• OVH SAS: hosting of the server running the database and the app (data centre in Warsaw), and email
• Cloudflare, Inc.: DNS for our domains, i.e. pointing the website, app and database addresses to our server. Data may be processed outside the EEA on the basis of standard contractual clauses.
• Anthropic Ireland, Limited (with Anthropic PBC in the US): AI document reading, when the feature is available and you consent to it (details in the “AI document reading” section)
• OpenAI, a data processor for automated Community moderation when it is enabled (details in the “Community” section)
• Google Ireland Limited / Google LLC: sign-in with a Google account if you choose it (we receive your email address, name and Google account identifier), push notification delivery on Android, and, after voluntary consent, Google Analytics for Firebase, Google Ads measurement and website analytics. For analytics, events, an app-instance identifier, technical information and IP-derived approximate location are processed. Data may be processed outside the EEA; Google provides information about transfer safeguards, including standard contractual clauses. Google information: https://policies.google.com/technologies/partner-sites
• Apple: Sign in with Apple if you choose it, and push notification delivery on iPhone. When you sign in with Apple, we store a refresh token so that we can revoke the App's access to your Apple ID when you delete your account.
• Expo (650 Industries, Inc., USA): push notification delivery and App updates downloaded outside the store (OTA). The transfer of data to the US is based on standard contractual clauses.
• Komoot GmbH (Photon service): city name suggestions in the App and on the website; it receives the text you type and your IP address. OpenStreetMap: map tiles when you mark where a pet went missing or was seen; it receives your IP address and the map area viewed. The App loads the map library from unpkg.com.
• Publicly: missing-pet reports you publish are visible on our website odnajdzpupila.pl, and QR tag details you set as visible can be seen by anyone who scans the code.
• Public authorities, where required by law

7. Your rights

Under GDPR you have the right to:

• Access your personal data
• Rectification of inaccurate data
• Erasure (right to be forgotten)
• Restriction of processing
• Data portability. Send a request for a copy of your data in a machine-readable format to hi@petsyplanet.pl. In the App you can also download a PDF pet health report, from the pet's profile or from Settings.
• Object to processing
• Withdraw consent at any time

To exercise these rights: hi@petsyplanet.pl

You also have the right to lodge a complaint with your national data protection supervisory authority.

8. Data security

We apply the following security measures:

• Encrypted connections to the app and website (HTTPS)
• Row-Level Security: each user can only access their own data and the data of pets someone has shared with them
• Only the administrator has access to production data; admin panel sign-in attempts are rate-limited
• Daily database backups on our server

9. Cookies

The PetsyPlanet website uses cookies. For full details, see our Cookie Policy.

10. Changes to this policy

Each version of this Policy has a number and date, shown at the top of the document. We will notify you of material changes by email or in-app notification at least 14 days before they take effect. Changes that require your consent will only apply once you have given it.

11. Contact

Privacy enquiries: hi@petsyplanet.pl

LowekStudio Krystian Rygiel, Poland