Privacy Policy

1. Who we are (the data controller)

PetTag is the data controller for personal data collected through this site. You can contact us at:

support@pet-tag.app

2. What data we collect

We collect the following data:

From you, when you sign up:

• Your email address
• A password (stored securely, hashed — we can't see it)
• Optional: your full name and phone number

From you, when you add a pet:

• The pet's name, breed and similar details
• An optional photo
• Medical notes, behaviour notes (you decide what to add)
• Privacy preferences (whether your phone/email show on the public page)

From you, when you buy a tag:

• Billing email
• Shipping address (so we can post the tag to you)
• Payment is processed by Stripe — we never see or store your card details

Automatically, when someone scans a tag:

• The time and date of the scan
• The user-agent of the scanning device (basic browser info)
• If the pet is in lost mode, a rough area for the scan (such as the town), worked out from the scanning phone's internet connection. We email it to the owner so they know where to look; it isn't stored, and it isn't the finder's exact location
• We do not store the finder's precise location, IP address, or identity

From finders, when they message you:

• The message text they write
• The contact details they choose to share (email or phone)
• Their location, if they choose to share it, so the owner can see where their pet was found
• A one-way code made from their internet connection and a random secret that's thrown away when the day ends, so one person can't flood an owner with messages. It can't be turned back into an address

If you share how a lost pet got home:

• The story you write, the first name and area you give, and the pet's name. If you're the owner, how they got home and whether we may use their profile photo
• Your email address (an owner's account email, or the one a finder chooses to give), only so we can ask you about the story. It's never shown
• We only keep it if you tick the box saying we can share it, and we read every story before using it on pet-tag.app or our social pages. Email support@pet-tag.app and we'll take yours down and delete it

3. Why we use it (legal basis)

Under UK GDPR, we need a legal basis for using your data. Here's ours:

Performance of a contract:

To run your account, host your pet's profile, deliver tags you've ordered, and process payments. Without this data, we can't provide the service you signed up for.

Legitimate interest:

To improve the service, prevent abuse, fix bugs, and contact you with important service updates (e.g. if there's a security issue with your account). We've balanced this against your privacy rights.

It's also why, about a week after your tags are posted, we email you once to ask for a review. We only send it once, and your order confirmation and that email each have a link to say no, after which we won't send it. Refunded orders aren't asked. Google and Trustpilot only get your details if you choose to post your review there too.

Legal obligation:

To comply with tax, accounting, fraud-prevention, and similar legal requirements.

Consent:

For optional things like marketing emails, if we ever offer them — you'd need to opt in first and can opt out any time.

If you leave your email address on our Black Friday page, we use it for one thing: a single email when the sale starts (20 November 2026). Its link removes your address, and we delete the list after the sale.

It's also how we share a story of a lost pet getting home: only when you've ticked the box to say we can, and you can take it back at any time.

4. Who we share it with

We don't sell your data. We only share it with services we use to run PetTag:

• Supabase — our database and authentication provider (data stored in the EU)
• Vercel — hosts our website (data may be processed globally for performance)
• Stripe — processes your payments. They have their own privacy policy: stripe.com/privacy
• Resend — sends transactional emails (order confirmations, finder messages, etc.)
• Cloudflare — provides our domain and email routing
• Google — in two places only. On the page you see straight after paying, your order number, delivery country and email address are passed to Google Customer Reviews so it can ask whether you'd like its survey, and it only emails you if you say yes. If you open the language menu, Google Translate is loaded to translate the page, so Google receives the page's text and your IP address. Their privacy policy: policies.google.com/privacy

Each of these providers is contractually required to protect your data. We use them because they're reliable and respect privacy laws.

We may also share data if legally required (court order, fraud investigation, etc.). We'll resist disclosure requests that aren't legally valid.

5. What's public, and what's not

The whole point of a pet tag is for finders to see your pet's profile when they scan. So your pet's public profile is public by design. Anyone who scans the QR code, or visits the tag URL, can see what you've chosen to display.

By default, your public profile shows:

• Your pet's name, breed, photo
• Medical and behaviour notes you wrote
• A message form to contact you (but not your email or phone)

You can enable "reveal phone" or "reveal email" from your pet's edit page if you want finders to see your direct contact info. Otherwise, finders message you through a form, and we email you. Your details stay private unless you choose to share them.

Your account email is never shown publicly.

6. How long we keep it

• Account data — for as long as you have an account. Delete your account and we delete it.
• Pet data — same as your account, plus any photos you upload.
• Order data — kept for 6 years to comply with UK tax and accounting rules.
• Scan event metadata — kept for as long as the associated tag is active.
• Server logs — typically kept for 30 days for security and debugging.

7. Your rights

Under UK GDPR you have the right to:

• Access — ask for a copy of the data we hold about you
• Rectification — ask us to correct mistakes
• Deletion — ask us to delete your data (and you can do this yourself from your account settings)
• Restriction — ask us to limit how we use it
• Portability — ask for a copy in a portable format
• Object — object to certain types of processing
• Complain — complain to the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email support@pet-tag.app. We'll respond within 30 days.

8. Cookies and analytics

We use only essential cookies needed to keep you logged in and the site working (session cookies, CSRF protection). We don't use tracking cookies or third-party advertising cookies.

We count page views ourselves so we can see which pages are useful. Each visit is recorded with a one-way code made from your IP address, your browser and a secret that changes every night, so two pages in one visit count as one person, and tomorrow the same visitor is a different code. The secret is random and is thrown away when the day ends, so after that nobody, us included, can work a code out again. We can't work out who you are from it, and it never leaves our database. If you arrive by tapping one of our adverts, the visit notes which advert it was (the advert's link says so), so we can tell which adverts are worth paying for. We don't use Meta's or anyone else's tracking pixel. Page view records are deleted after about 13 months, and a pet's tag page isn't counted at all.

To tell a first-time visitor from someone coming back, we keep a second one-way code, made the same way but from a secret that changes each month. It's stored on its own, with nothing but the date we first and last saw it, and it answers one question: have we seen this person before? It is never attached to the pages you looked at, so your browsing still can't be joined up from one day to the next, and codes nobody has used for about two months are deleted. Nothing is stored on your device for any of this.

To see how many people visit each page, we use Vercel Web Analytics. It counts page views and where they came from without cookies, without a device fingerprint and without following anyone from site to site. The numbers we see are totals, not people: we can't tell who visited a page. Vercel is already our hosting provider, listed in section 4.

There are two exceptions. The first is the page you see straight after paying. It loads Google's Customer Reviews box, which asks whether Google may email you a short survey about your order, and it is a question, not a box already ticked. Your order number, delivery country and email address are passed to Google so it can ask, and Google only writes to you if you say yes. That box is on the confirmation page and nowhere else on the site.

The second is the language menu at the top of each page. Opening it loads Google Translate, which translates the page into the language you pick, and your choice is remembered in a cookie called googtrans. Once it's loaded, Google can set cookies of its own. If you never open the menu, Google Translate isn't loaded at all.

If we ever add anything that does track individuals, we'll update this policy and ask for your consent first.

9. International transfers

Some of our service providers may process data outside the UK and EU (e.g. Vercel uses servers globally). When data goes outside the UK/EU, we rely on protections like the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

10. Children

PetTag is not aimed at children under 18. We don't knowingly collect data from children. If you believe a child has signed up, please email us and we'll delete the account.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when. For significant changes, we'll email account holders.

12. Contact

Questions, concerns, or requests about your data? Email support@pet-tag.app.