Privacy Policy

This Privacy Policy describes how PetsyPlanet (we, us, the Service) collects, uses, and protects your personal data. We operate in compliance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

1. Data Controller

The controller of your personal data is LowekStudio Krystian Rygiel, Polish tax ID (NIP) 9512469584. For data protection matters, contact us at: hi@petsyplanet.pl

We have not appointed a data protection officer. For all matters concerning personal data, write directly to the address above.

2. What data do we collect?

2.1 Data you provide

Account data: email address, optional name or display name, account identifier and information needed to sign in, including through Apple or Google.
Pet profile data: name, species, breed, date of birth, photo, microchip number and passport details.
Pet records: vaccinations, vet visits, medications, body weight, feeding and walks, including an optional vet visit cost.
QR tags and missing-pet reports: contact details, city or address, description and last-seen map point you provide. Selected tag details are visible after scanning the code; published missing-pet reports are public. Sharing pet records with family covers the pets and permissions you select. The data shown when you ask a vet to complete a visit is described in a separate section.
City for local offers (optional): you choose it in the Offers tab to see offers from shops and services in your city. If you are signed in, we save it in your profile; in guest mode it stays only on your phone. You can change or skip it at any time. To suggest the nearest city, the App may read the phone's location once, after you allow location access. We do not store or send the location; it is only used on the phone to pick a city from the list.
Website form data: email address and message content (contact form, partner inquiries, waitlist sign-up), stored in our database to handle your request.

2.2 Data collected automatically

Our own UX analytics: event and screen name, platform, app version and a random session identifier generated at launch and not persisted on the device. Event rows contain no account or device identifier, and we do not send the content you type. You can switch this off in Settings → Privacy. Raw events are deleted after 90 days.
Partner-offer impressions and clicks: offer identifier, offer type and interaction. These events contain no user or device identifier. Separate notification delivery logs contain the push token.
Error and crash logs, including in guest mode: error message and stack, platform, app version and environment flag. When signed in, the log includes your account identifier. Error logs are deleted after 30 days.
After you allow notifications: push token, platform, activity time, the status of your consents to “Messages from PetsyPlanet” and to partner offers, and the link to your account if you are signed in.
After new, voluntary ad-measurement consent: Google Analytics for Firebase processes app events, an app-instance identifier, app and device information, and approximate location derived from IP. Details and withdrawal are described in the registration-measurement section.
IP address and technical data in server logs, needed to serve connections and maintain security, including sign-in rate limits. Guest mode does not disable technical connections, error logs or our own offer and UX statistics.

The App is intended for people aged 16 or over. We do not knowingly collect data from younger people. If you believe someone under 16 has created an account, write to us and we will delete their data.

3. Purpose and legal basis for processing

We process your data for the following purposes:

Performance of contract (Art. 6(1)(b) GDPR): providing PetsyPlanet, account management, synchronisation, the PDF pet health report, sharing selected data, asking a vet to complete a visit, and service messages.
Legitimate interest (Art. 6(1)(f) GDPR): security, fixing errors, our own UX and offer analytics, a technical ledger of first verified registrations, billing and the monthly limit for document reading, and keeping the consent history to defend against claims.
Consent (Art. 6(1)(a) GDPR): optional ad measurement and account-linked campaign attribution, Google Analytics for Firebase and Google Ads measurement, “Messages from PetsyPlanet” by email and push, partner-offer notifications, and AI document reading.
Legal obligation (Art. 6(1)(c) GDPR): compliance with tax and legal requirements.

4. Partner content, messages and notifications

The app is free of charge and funded through partner content, banners and offers from pet shops and services. Such content is labelled as sponsored.

We show local offers based on the city you choose. We do not tell partners who chose which city.

We provide partner-offer advertisers with aggregate impression and click counts. Offer-event rows contain no account or device identifier. Optional measurement of our own ads through Google is a separate flow described in the registration-measurement section; we do not provide pet records or account details in that flow.

A partner-offer notification may lead to the partner’s website through our redirect address (petsyplanet.pl/r/…). For such a visit we only record that the campaign link was opened, with no account or device identifier, and we do not store the IP address. We add a source label (utm parameters) to the partner’s address so the partner can see that the visit came from PetsyPlanet. We also record whether Apple or Google accepted the notification for delivery and whether someone opened it. Partners receive only aggregate campaign figures: sent, delivered, opened and click-throughs.

“Messages from PetsyPlanet” are tips, news and information about our animal-help campaigns, sent by email and as push notifications. We send them only with your consent, which we ask for on a screen after your first sign-in; you can also turn it on or off in Settings. Push notifications with partner offers require a separate consent. The legal basis is your consent (Art. 6(1)(a) GDPR) and Article 398 of the Polish Electronic Communications Law of 12 July 2024. These consents are independent of health reminders: not giving or withdrawing them does not turn off reminders about medication, vaccinations, parasite protection or walks.

We send no more than 2 “Messages from PetsyPlanet” push notifications within 30 days and no more than 1 partner-offer notification per device within 7 days. You can withdraw these consents at any time in the App: Settings → Notifications. Every “Messages from PetsyPlanet” email contains a link that unsubscribes you with one click. Withdrawal takes effect immediately and requires no contact with us. Processing carried out before withdrawal remains lawful.

We store the device notification token and the push consent status for that device. On sign-out we detach the token from the account and turn off its push consents so they do not carry over to another account; the token itself may remain in the device registry. Account deletion removes tokens still associated with that account.

We keep a consent history: the channel (email, push, partner offers), whether consent was given or withdrawn, where in the App, the version of the consent text and the date. Instead of your email address, it stores a cryptographic hash of it. The history serves as proof that consent was given or withdrawn (Art. 7(1) GDPR). We keep it for the lifetime of the account and for up to 3 years after consent is withdrawn or the account is deleted, to defend against claims (Art. 6(1)(f) GDPR).

Service messages, meaning information about security, changes to the Terms or the Privacy Policy and matters concerning your account, are sent by email, notification or in the App without marketing consent, as part of performing the contract (Art. 6(1)(b) GDPR). They contain no advertising. Unsubscribing from “Messages from PetsyPlanet” does not stop service messages.

Registration attribution after app installation

After the first verified sign-in, we keep a technical new-account ledger in our database for up to 90 days: account, event and first-session identifiers and registration time. Only after voluntary ad-measurement consent do we attach campaign, creative, breed and platform labels to our own report. On Android, a random Google Play handoff reference is read after consent and is valid for up to 30 days. In versions with Google Analytics for Firebase, new, explicit consent additionally enables sending app events and technical data to Google for analytics and Google Ads measurement. Previous consent to first-party-only reporting does not enable the SDK. The registration event we send is sign_up with method app; it contains no email, account identifier, handoff reference or pet data. The SDK may automatically measure app lifecycle and sessions, use its own app-instance identifier and derive approximate location from IP, even though Google Analytics does not store the IP itself. We disable IDFA, Android Advertising ID, SSAID, IDFV and automatic screen reporting, and do not enable personalised advertising. The iOS on-device measurement variant uses event data rather than an email or phone number supplied by us; availability depends on region and Google configuration. iOS results may be aggregated or modelled and do not attribute every account to a particular ad. Returning to the browser is not required. You can withdraw consent in Settings → Privacy: this disables collection, removes a local pending event and resets local Analytics data. It does not automatically erase data already processed by Google. Deleting your account removes linked measurement in our database. Google-data retention depends on the service settings; you may contact us about erasure.

Optional Meta ad measurement in the app

Meta ad measurement is off by default and requires separate, voluntary consent in Settings → Privacy (Art. 6(1)(a) GDPR). On iOS, App Tracking Transparency (ATT) authorisation is also required. We initialise the native Meta SDK only after these conditions are met. It measures app activation and attributes installations to ads; we send fb_mobile_complete_registration only after the actual, confirmed creation of a new account’s first session.

We do not send email addresses, account identifiers, pet records or pet photos in app event parameters. The Meta SDK processes advertising, app and device identifiers, technical data and network connection metadata. Meta may link this information with advertising data to measure ad performance.

You can withdraw consent in Settings → Privacy. Withdrawal stops subsequent Meta measurement of the app, but does not automatically erase data already sent to Meta.

Community

Applies to the “Community” feature when it is available in the App.

If you join the Community in the App, we also process:

The name visible to others, the date you accepted the rules and your confirmation that you are at least 16.
Your questions, answers and photos, and the pet badge on a question: name, breed and age in years. Other Community members see them in the App; they are not published on the internet. For an anonymous question, others do not see the author, but the moderation team does.
Before upload, photos are resized and re-encoded, so they contain no data about where the photo was taken or about the device.
“Helpful” marks, reports, blocks of other people and the history of notifications about answers.
The moderation log: decisions about your posts, their statements of reasons and the results of automated assessment.
We send the query entered in Community search to our server to find matching questions. We do not include the query text in UX analytics events.

The legal bases are performance of the contract (Art. 6(1)(b) GDPR), i.e. providing the Community, our legitimate interest in keeping users safe (Art. 6(1)(f) GDPR) and obligations under the Digital Services Act (Art. 6(1)(c) GDPR): handling reports, statements of reasons and appeals.

When automated moderation is enabled, we send the post text and photo to OpenAI as a data processor under a data processing agreement. OpenAI assesses the content for violations and does not use it to train models. Data may be processed outside the European Economic Area on the basis of standard contractual clauses. OpenAI may retain it for up to 30 days for abuse monitoring. We do not send your email address or other account data.

Posts are checked automatically by OpenAI's moderation tool. A post may be temporarily hidden until a moderator reviews it. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). A block on posting or on an account is always approved by a human. You can contest any decision by writing to hi@petsyplanet.pl; a human will review it.

We keep posts until you delete them or your account. We automatically delete the moderation log and resolved reports after 6 months, when the time to appeal has passed. Posts secured as evidence of illegal content are kept for as long as law enforcement requires, including after account deletion.

AI document reading

Applies to the “AI document reading” feature when it is available in the App.

If the feature is available in your app, you can scan a document from your vet (for example a discharge summary, an invoice or a page of the pet's health booklet) or choose a PDF file, and the App will suggest entries for the pet's records based on it.

What we send: photos of the document pages or the PDF file are sent to Claude, an artificial intelligence model. The document may contain your data (for example name, surname, address) and data of other people, such as the vet. Before scanning, you can cover any data you do not want to share.
Recipient: Anthropic Ireland, Limited, Dublin (Ireland), as a data processor under a data processing agreement (DPA). Processing may take place in the United States by Anthropic PBC and its sub-processors. The transfer of data outside the European Economic Area is based on standard contractual clauses adopted by European Commission Decision (EU) 2021/914.
The provider does not use submitted documents to train models. It deletes them no later than after 30 days. It keeps them longer, for up to 2 years, only if its safety systems flag the content as violating its usage policies.
We do not store photos or document files. We save only the data you review and approve: the visit, vaccinations, medications, parasite protection and weight.
Usage log: number of pages, number of tokens, cost and reading status, without the document content. It is used for billing with the provider and for enforcing the limit of 10 pages per month. We keep it for 90 days.

Document reading is based on your consent (Art. 6(1)(a) GDPR), which we ask for on a screen before your first scan. Without consent the scanner will not start, and the rest of the App works normally. You can withdraw consent in the App: Settings → Privacy. Withdrawal does not affect the lawfulness of readings carried out before. We keep the usage log on the basis of our legitimate interest (Art. 6(1)(f) GDPR), namely billing and enforcing the limit.

Asking a vet to complete a visit

When you ask a vet to complete a visit record, we store the vet's email address and your message, and the vet receives an email with a one-time link valid for 7 days.

After opening the link, the vet always sees the same set of data: the pet's name, species, breed and date of birth, information about allergies and neutering, current medication, the latest weight, the details of this visit (date, type, clinic and its address, vet, diagnosis, recommendations, cost, notes) and your message. The vet does not see your email address or any other records. What the vet enters is added to this visit in your pet's records.

Towards you, the legal basis is performance of the contract (Art. 6(1)(b) GDPR). We process the vet's data, meaning the email address and the content entered, on the basis of our legitimate interest in handling your request (Art. 6(1)(f) GDPR). The vet is informed about this processing on the page the link leads to. By providing the vet's address, you confirm that you may use it for this purpose.

Completing a visit and post-visit reminders

Applies to the “Completing a visit and post-visit reminders” feature when it is available in the App.

If the feature is available in your App, after a planned visit we ask how you want to complete it.

What data: the visit status (planned or completed), the details you add or approve (for example diagnosis, recommendations, cost) and the link between the visit and a scanned document if you choose to scan. Document scanning and asking your vet are described in separate sections.
Reminder: the notification to complete a visit is scheduled by your phone. We do not send any extra data to our server for this.
Purpose and legal basis: keeping the pet's records you ask for, i.e. performance of the contract (Art. 6(1)(b) GDPR).
Retention: visit data is kept like the rest of the records, for as long as the account exists or until you delete it.

Pomagamy: voting

Applies to the “Pomagamy: voting” feature when it is available in the App.

If a “Pomagamy” campaign is running, you can vote in the App or on petsyplanet.pl/pomagamy for the organisation that will receive the pool funded by partners. The campaign is governed by the campaign rules (in Polish).

What data: account identifier, chosen candidate, vote date and the result of checking whether the account meets the campaign rules (account creation date, owning a pet, number of days with entries in the last 30 days, confirmed account). To detect double voting we store cryptographic hashes of the IP address and the App installation ID, calculated separately for each campaign, and whether you have seen the campaign announcement and result.
The eligibility check is automatic and only concerns taking part in the vote. A moderator may invalidate a vote that breaks the campaign rules, giving a reason. If you disagree with a refusal or invalidation, write to hi@petsyplanet.pl and a person will review it.
Purpose and legal basis: running the vote under the campaign rules, i.e. performance of the contract (Art. 6(1)(b) GDPR), and preventing abuse on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
What we publish: only aggregate results (votes per candidate), the pool and transfer confirmations. We never link a result to your account or name.
Retention: we delete the IP and installation hashes 90 days after the campaign ends. The vote itself is kept until the campaign is settled and for the limitation period for claims. After you delete your account, the vote remains without a link to the account so that the campaign result stays correct.
Recipients: we do not share voters' data with organisations or partners.

Acceptance of the Terms

When you accept the Terms at registration or accept a change to the Terms that requires acceptance, we record: account identifier, Terms version, date and time of acceptance, where it happened (registration or change), platform, App version and a cryptographic hash of your email address.

Purpose and legal basis: showing the terms on which we concluded the contract and defending against claims, i.e. our legitimate interest (Art. 6(1)(f) GDPR).
Retention: for as long as the account exists and, after it is deleted, until the limitation period for claims expires. After deletion the record stays without a link to the account, only with the email hash.
Recipients: we do not share this data.

5. How long do we retain data?

Account and pet records: for the lifetime of the account. Account deletion starts removal of data from the active database and file storage. Separate periods apply to technical logs and evidence of violations described below; deletion does not automatically erase data already sent to Google.
After account deletion, the following remain: foods you added to the catalogue (without a link to your account), the consent history as proof that consent was given or withdrawn (see section 4), and settlement data for fundraising campaigns, without data about voters.
Our raw UX events: 90 days; error logs: 30 days. Partner-offer statistics are retained for campaign operation and settlement; automatic UX-event pruning does not cover them.
Push notification send log (device token and delivery status): 90 days after the campaign is sent. Aggregate campaign results, with no personal data, are kept for settlement with partners.
Vet invitations with the vet's email address: no later than 14 days after sending. Missing-pet reports: up to 30 days after the case is marked as resolved.
Community moderation log and resolved reports: 6 months. Document reading usage log: 90 days.
Voting in Pomagamy campaigns (when a campaign is running): we store your vote, its date and the result of checking whether your account meets the campaign rules, as well as hashes of your IP address and app installation ID, calculated separately for each campaign to detect double voting. We delete the hashes 90 days after the campaign ends, and keep the vote itself until the campaign is settled and for the limitation period for claims. Results are never published with your name.
Consent history: for the lifetime of the account and for up to 3 years after consent is withdrawn or the account is deleted.
Address on the “Messages from PetsyPlanet” mailing list: until you unsubscribe or delete your account. After you unsubscribe, we keep the address with an unsubscribe flag, and after you delete your account only a one-way hash of it, so that we do not send another marketing message to that address.
Technical registration ledger and our own attribution report: up to 90 days; store handoff reference: up to 30 days. Deleting an account removes its linked measurement records in our database.
Website Google Analytics and in-app Google Analytics for Firebase statistics: according to each service’s retention settings. Collection requires the applicable consent; withdrawal does not automatically erase data already processed.
Security logs and administrator access logs: 90 days.
Tax records: 5 years as required by Polish law.

We never sell your personal data. We may share it with:

OVH SAS: hosting of the server running the database and the app (data centre in Warsaw), and email
Cloudflare, Inc.: DNS for our domains, i.e. pointing the website, app and database addresses to our server. Data may be processed outside the EEA on the basis of standard contractual clauses.
Anthropic Ireland, Limited (with Anthropic PBC in the US): AI document reading, when the feature is available and you consent to it (details in the “AI document reading” section)
OpenAI, a data processor for automated Community moderation when it is enabled (details in the “Community” section)
Google Ireland Limited / Google LLC: sign-in with a Google account if you choose it (we receive your email address, name and Google account identifier), push notification delivery on Android, and, after voluntary consent, Google Analytics for Firebase, Google Ads measurement and website analytics. For analytics, events, an app-instance identifier, technical information and IP-derived approximate location are processed. Data may be processed outside the EEA; Google provides information about transfer safeguards, including standard contractual clauses. Google information: https://policies.google.com/technologies/partner-sites
Apple: Sign in with Apple if you choose it, and push notification delivery on iPhone. When you sign in with Apple, we store a refresh token so that we can revoke the App's access to your Apple ID when you delete your account.
Expo (650 Industries, Inc., USA): push notification delivery and App updates downloaded outside the store (OTA). The transfer of data to the US is based on standard contractual clauses.
Komoot GmbH (Photon service): city name suggestions in the App and on the website; it receives the text you type and your IP address. OpenStreetMap: map tiles when you mark where a pet went missing or was seen; it receives your IP address and the map area viewed. The App loads the map library from unpkg.com.
Publicly: missing-pet reports you publish are visible on our website odnajdzpupila.pl, and QR tag details you set as visible can be seen by anyone who scans the code.
Public authorities, where required by law

Meta Platforms Ireland Limited: optional in-app ad measurement after separate consent and, on iOS, ATT authorisation, described in the Meta measurement section. Meta information: https://www.facebook.com/privacy/policy/ and https://www.facebook.com/legal/technology_terms

7. Your rights

Under GDPR you have the right to:

Access your personal data
Rectification of inaccurate data
Erasure (right to be forgotten)
Restriction of processing
Data portability. Send a request for a copy of your data in a machine-readable format to hi@petsyplanet.pl. In the App you can also download a PDF pet health report, from the pet's profile or from Settings.
Object to processing
Withdraw consent at any time

To exercise these rights: hi@petsyplanet.pl

You also have the right to lodge a complaint with your national data protection supervisory authority.

8. Data security

We apply the following security measures:

Encrypted connections to the app and website (HTTPS)
Row-Level Security: each user can only access their own data and the data of pets someone has shared with them
Only the administrator has access to production data; admin panel sign-in attempts are rate-limited
Daily database backups on our server

9. Cookies

The PetsyPlanet website uses cookies. For full details, see our Cookie Policy.

10. Changes to this policy

Each version of this Policy has a number and date, shown at the top of the document. We will notify you of material changes by email or in-app notification at least 14 days before they take effect. Changes that require your consent will only apply once you have given it.

11. Contact

Privacy enquiries: hi@petsyplanet.pl

LowekStudio Krystian Rygiel, Poland