Legal
Privacy Policy
What we collect, why we collect it, who we share it with, and how to get it back or have it erased.
Last updated: 2 October 2026
This Privacy Policy explains how Petifly ("we", "us", "our") collects, uses, and shares personal information when you use the Petifly mobile application and related services (the "App"). By using the App you agree to the practices described here.
Data controller / contact: Petifly, support@petifly.pet. Petifly operates primarily in Cyprus and the EU; we process personal data in accordance with the EU General Data Protection Regulation (GDPR).
1. Information We Collect
We only collect information needed to provide the App's features. You provide most of it directly.
| Category | Examples | Required? |
|---|---|---|
| Account & identity | Email address and password, or Google Sign-In or Sign in with Apple (authentication is handled by Firebase); first and last name | Email & password, Google or Apple required; name optional |
| Contact details | Phone number, postal/shipping address | Optional (address required for shop delivery) |
| Pet information | Pet name, species, breed, age, weight, photos, and health records you choose to add (vaccinations, medications, allergies, medical conditions, microchip ID) | Optional |
| Location | Precise (GPS) or approximate location, only when you use location-based features (nearby vendors/events, lost-pet SOS, maps), and, if you choose to track a walk, its GPS route, stored on your account. When you share a walk, the start and end of the route are hidden. | Optional |
| Photos | Images you upload for your profile, pets, community posts, or SOS reports | Optional |
| User content & messages | Reviews, in-app chat messages, community posts, pet journal entries, and messages to the in-app pet assistant | Optional |
| Orders | Products ordered, order history, delivery address | Only if you place an order |
| Notifications | If you enable push notifications, your device's push subscription and browser user-agent string | Optional |
| Diagnostics | If the app crashes, a crash report (device model, operating system and app version, the error, and your Petifly user ID, never your name or email) is sent to Google Firebase Crashlytics. You can turn this off in Privacy & Data → Crash reports. | Optional (can be turned off) |
| Usage | Which features you use in the App (for example that a booking was started or a walk was saved), linked to your account and used only to improve the App. Never sold or used for advertising. | Automatic |
Payments: The App does not store your card or bank details. Card payments for bookings, shop orders, tips, event tickets and adoption fees are entered into Stripe's secure payment form, shown inside the App or on Stripe's own page, and go directly to Stripe; we receive only confirmation and order details, never your full card number. On iPhone, Petifly subscriptions are bought through Apple's App Store: Apple handles the payment, and we receive only the subscription status, through our subscription service RevenueCat.
2. How We Use Your Information
- Create and manage your account and authenticate you securely.
- Provide core features: pet health records, bookings, shop, community, events, lost & found, and the pet assistant.
- Show nearby vendors, events, and map results based on your location.
- Enable lost-pet SOS alerts and the smart pet tag reunification feature.
- Process orders and deliver items to your address.
- Send notifications you have enabled.
- Find and fix crashes using crash reports, unless you turn them off.
- Maintain safety, prevent abuse, and comply with legal obligations.
Legal basis for each purpose
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account and providing the App's features | Performance of a contract, Art. 6(1)(b) |
| Processing payments and keeping tax/accounting records | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Using your location for nearby results and maps | Consent, given via the device permission prompt and withdrawable in device settings, Art. 6(1)(a) |
| Marketing emails and promotional notifications | Consent, given by the optional tick box at signup or in Profile → Privacy & data, Art. 6(1)(a) |
| Finding and fixing crashes (crash reports) | Legitimate interests, Art. 6(1)(f); you can turn crash reports off in Privacy & Data → Crash reports |
| Understanding which features are used, to improve the App | Legitimate interests, Art. 6(1)(f) |
| Security, fraud prevention, debugging and defending legal claims | Legitimate interests, Art. 6(1)(f) |
AI features
The pet assistant, care advice, and vendor copilot send the text of your request (and, where relevant, details of the pet it concerns) to a third-party AI provider (OpenAI, Anthropic, or Google) so an answer can be generated. These providers act as our processors and are contractually barred from using your data to train their models. We store your prompts and the answers so you can see your history; you can delete them in the app and they are included in your data export. AI answers are general guidance only, are never a substitute for veterinary advice, and are not used for automated decision-making with legal or similarly significant effects (Art. 22).
3. How We Share Information
We do not sell your personal data. We share it only as needed to run the App:
| Recipient | What & why |
|---|---|
| Google Firebase | Authentication, push delivery and crash reporting (Crashlytics). Your email and password are used to authenticate your account. If you choose Google Sign-In, Google shares your Google account email and basic profile with us to create or access your account. |
| Apple | If you choose Sign in with Apple, Apple confirms your identity and shares your name and email address, or a private relay address if you choose to hide your email. On iPhone, Apple also processes App Store subscription payments. |
| RevenueCat | Records the status of subscriptions bought through the App Store, so your plan is unlocked on your account. |
| Our backend servers & cloud storage | Processes and stores the data you enter, including uploaded images, on our behalf. |
| Twilio | Text messages from businesses you have opted in to. |
| Resend | Account, booking and receipt emails. |
| Cloudflare | Hosting of our website and web app. |
| Mapping services (OpenStreetMap and map-tile providers) | When you use location search or maps, your coordinates and search queries are sent to these services to return results. |
| Stripe | Card payments for bookings, orders, tips, tickets and adoption fees, through Stripe's secure payment form, and payouts to the businesses you pay (Stripe Connect). |
| AI providers (OpenAI, Anthropic, Google) | The content of your requests to the pet assistant, care advice, and vendor copilot, so an answer can be generated. They may not train on your data. |
| Other users (public content) | Reviews and community posts are visible to other users. If you create a smart pet tag, the contact details and pet info you add to it are shown publicly to anyone who scans the tag, to help reunite you with your pet. |
| Family and sitters you share a pet with | If you share a pet with family or a sitter, they can see that pet's profile and health records according to the role you give them. A sitter care card shows only what you choose to include. |
| Shelters | If you submit an adoption application, the details are shared with the relevant shelter. |
| Legal authorities | Where required by law. |
4. Transfers Outside the EEA
Some of our processors, including Google, Apple, Stripe, RevenueCat, OpenAI, Anthropic, Twilio, Resend and Cloudflare, process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the provider is certified under it. Contact us for a copy of the safeguards in place.
5. Data Retention
| Data | How long we keep it |
|---|---|
| Account and pet data | While your account exists; erased or anonymized normally within 30 days of deletion |
| Bookings, orders and invoices | Up to 7 years, as tax law requires, anonymized once your account is deleted |
| AI conversations | Until you delete them, or until your account is deleted |
| Consent records | Life of the account plus 3 years, so we can demonstrate the consent you gave (Art. 7(1)) |
| Security and audit logs | Up to 12 months |
6. Your Rights & Account Deletion
Under the GDPR you have the right to access your data, correct it, erase it, restrict or object to how we use it, receive it in a portable format, and withdraw any consent you have given. Withdrawing consent is as easy as giving it and does not affect processing carried out beforehand.
You can exercise most of these yourself in the app: Profile → Privacy & data lets you download a full export of your data and manage your marketing consent, and Profile → Delete account permanently removes your account; see our Delete your account page. For anything else, email support@petifly.pet; we respond within one month.
If you believe we have handled your data wrongly you can complain to your national data protection authority. In Cyprus that is the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy); if you live elsewhere in the EU you may complain to your own country's authority.
7. Cookies
The App stores a small amount of data on your device to keep you signed in and remember your preferences. These are strictly necessary for the service to work and therefore do not require consent. The App does not use advertising or third-party tracking cookies, and we do not profile you across sites.
Our website (petifly.pet) may use Google Analytics and the Meta Pixel to count visits and measure how our advertising performs, but only if you choose Accept in the cookie banner. If you choose Reject, or make no choice, neither is loaded and no analytics or advertising cookies are set. You can change your choice at any time from the Cookie settings link in the website footer.
If you chose Accept and then send us the partner form, our server also tells Meta that a partner enquiry was made, so we can measure which ads bring partners. Your email address, phone number and city are sent only in hashed (irreversibly scrambled) form, together with Meta's own browser identifiers. Without Accept, nothing about your enquiry is shared with Meta.
If you chose Accept and arrived through a link in one of our social media posts or ads, our website also tells our server which post or ad the link came from, and whether you then tapped a link to download the app. We keep only daily totals per post or ad, so we can see which posts people find useful. Nothing that identifies you is kept with these counts: no name, account, IP address or cookie. Your browser keeps a short note for that visit only, so it is counted once. Without Accept, nothing is sent.
8. Security
All data is transmitted over encrypted HTTPS connections. Authentication is handled by Firebase and passwords never reach our servers. Access to production data is limited to staff who need it. If a breach ever puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where required.
9. Children
The App is not intended for children under 16. We do not knowingly collect data from children under that age; if you believe a child has given us data, contact us and we will delete it.
10. Changes
We may update this policy. If a change materially affects you, we will ask you to review and accept the new version the next time you open the app, and update the "Last updated" date here.
11. Partner Enquiries From Our Website
If you register your interest as a clinic, shelter or other pet business through the form on petifly.pet, we store the details you submit so that we can reply to you.
| Category | Examples |
|---|---|
| Business details | Business name, registered name, type of business, city and country, website and social page |
| Contact details | Contact person, role, email address and phone number |
| What you tell us | The features you are interested in, and anything you write in the notes field |
| Technical details | Your IP address and browser user-agent, kept solely to detect and prevent automated abuse of the form |
Legal basis: your consent, which you give by ticking the box on the form. You may withdraw it at any time by emailing us, and we will delete your enquiry.
Who sees it: only Petifly staff whose role includes partnerships, and only through our internal admin dashboard, which requires a named account and specific permission to open. We do not sell these details or share them for marketing.
How long we keep it: the technical details above are deleted after 30 days. Enquiries we decline or mark as spam are deleted after 12 months. If we go on to work together, your details are kept as part of that business relationship.
Anti-abuse: the form is protected by Cloudflare Turnstile, which checks that a person and not a script is submitting it. Cloudflare processes technical data for this purpose as our processor.
To ask what we hold, correct it, or have it deleted, email support@petifly.pet.
12. Contact
Questions about this policy or your data: support@petifly.pet.