PetOS Privacy Notice

1. Who we are and the scope of this notice

PetOS is operated by NORTH & LIGHT INNOVATIONS PORTAL, registered in Dubai, United Arab Emirates, at Dubai, UAE. Our privacy contact is info@thepetos.app. This notice covers our website, product accounts, software workspaces, support and tenant-branded pet-parent experiences.

For platform accounts, our subscription billing, security and our own business communications, we decide the purposes and means of processing and act as controller. A pet-care business normally controls the staff, household, pet, care and transaction records in its workspace; PetOS processes those records for that business under the Data Processing Addendum. If the business is itself a processor, PetOS acts as its subprocessor. Other services, including payment providers, may have independent legal responsibilities.

2. Information we handle

Account and business information: name, email, authentication identifiers, verification and security settings, profile photo, memberships and roles, business details, locations, regional settings, plan and subscription history, and recorded terms and communication choices.

Information a business or authorized pet parent provides: household and contact details, authorized pickup relationships, pet profiles and photos, vaccination evidence, care instructions and notes, bookings and attendance, incidents and care updates, messages and attachments, consents, invoices, payments and refunds. Pet information can be personal information when linked to an identifiable person. Staff and supplier records may also identify individuals.

Technical and operational information: IP address, browser and device details, session and request identifiers, timestamps, access and audit events, failed requests, anti-abuse signals and limited product lifecycle events. Support messages and website enquiries contain the details you choose to send. Avoid including unnecessary sensitive information.

3. Where information comes from

We receive information directly from you, from the business you work with or visit, from authorized household contacts or staff, from your use of PetOS, and from configured identity, payment, email and other integrations. A business must have a lawful basis to provide other people’s information and explain its own collection and care-service practices.

4. Why we process information and on what basis

We use account and service data to create and secure accounts, verify email, resolve memberships, provide requested features, process subscriptions and respond to support. Where applicable, this is necessary to perform our contract or take requested pre-contract steps.

We use proportionate technical, audit and anti-abuse information to protect users, investigate failures and operate and improve the service. Where applicable law permits, we rely on legitimate interests after considering the impact on people; where that basis is unavailable we rely on an applicable legal authorization or obtain required consent. We also process information to meet legal obligations and establish, exercise or defend claims.

Optional marketing uses your choices and any consent required by law. You can withdraw that choice without losing essential service communications. A Privacy Notice acknowledgement is not blanket consent to optional marketing, media publication, all international transfers or unrelated uses.

Business-controlled records are processed on documented instructions from the business, which is responsible for its own lawful basis, notices and any consent required for care, staff records, media and customer communications.

5. Who can see business and household information

Access depends on the relevant business membership, role, permissions and, for pet parents, authorized household relationships. A person who belongs to several businesses does not automatically share their business records between them. Your platform profile information, including your account photo, can appear in the workspaces where you participate; pet profile photos remain business records.

Business owners and authorized staff can access records needed for their role. Pet parents see the records and communications made available to their authorized household. If another household contact is authorized for the same household, that relationship can affect what they can see. Ask the business to correct relationship or access errors. Authorized PetOS personnel may access information when needed for support, security, operations or legal obligations.

6. Uploads, photos and communications

Uploaded documents, images and attachments are stored privately and checked for unsafe content before authorized access. Security processing may inspect file contents, integrity and metadata; a safe-file result does not verify medical, vaccination or identity information. Rejected, pending or quarantined files may be unavailable. A business separately controls human document verification and media-use permissions.

Email delivery sends the recipient address, relevant message content and delivery metadata to our email provider. Emails may contain business names, booking or invoice context and secure links. Delivery events help us identify failures. Essential account, security and requested service messages differ from optional marketing. Changing a preference does not erase prior sent messages or copies held by recipients.

7. Service providers and other disclosures

Google Cloud and Firebase provide hosting, database and private file storage, identity, security, logs and monitoring. Resend provides application email delivery. Stripe processes PetOS subscriptions and related payments; an eligible business may separately enable Ziina for its customer payments. The Service Providers page describes the purposes, data and processing-location information for the reviewed release and links to provider privacy information.

We disclose information only as needed to provide the requested services, to authorized advisers bound by confidentiality, to comply with lawful requests, protect rights and safety, or evaluate or complete a genuine business transfer with appropriate protections. We do not sell personal information or share it for cross-context behavioral advertising. Customer-selected integrations and independent payment providers have their own terms and privacy practices.

8. Processing locations and international transfers

The primary PetOS application database and private upload buckets are configured in Google Cloud’s Doha, Qatar region. This is not a promise that all data remains in Qatar or the UAE. Identity services, delivery networks, support, logs, payment services and provider subprocessors may process information elsewhere. Resend’s primary processing operations are in the United States.

Where a transfer is subject to applicable restrictions, it must have a valid transfer basis and appropriate safeguards, which may include approved contractual terms or another legal mechanism. Contact us for information about the applicable arrangements. This notice alone does not create an adequacy decision, implement EU or UK transfer clauses, or replace any required explicit consent. Businesses with mandatory localization requirements should obtain written confirmation of suitability before uploading data.

9. How long information is kept

Active account and business records are kept as needed to deliver the service and the business’s lawful instructions. Moving to Free or cancelling renewal does not automatically delete a workspace. To close an account or request deletion, contact us; for business-controlled records, contact the business first. We verify authority, identify applicable legal or dispute holds, and confirm the scope and completion of the request.

Billing, accounting, audit, security and dispute records may be retained where necessary for the relevant obligation or claim. Backups and provider-held copies may remain for their applicable rotation or legal-retention periods with access restricted. Removing an item from a screen or expiring a download link is not a guarantee that every underlying copy has been erased.

For uploads, unscanned objects have a seven-day lifecycle rule and quarantined objects a 30-day lifecycle rule; deletion after the applicable threshold is managed by the storage provider and is not instantaneous. Clean files have no blanket automatic expiry and remain until an authorized workflow or reviewed deletion request removes them. Provider email records are subject to the configured standard 30-day retention and the provider’s applicable legal obligations; recipient mailbox copies are outside our control.

10. Cookies, browser storage and product signals

PetOS uses essential cookies and browser storage for sign-in, security, verification and onboarding recovery, and to remember selected business, location and interface preferences. Firebase authentication may use browser storage. Blocking necessary storage can prevent sign-in or recovery. Signing out or clearing browser data can remove saved local state.

The reviewed release does not include advertising pixels or an external behavioral analytics tracker. The application records limited internal lifecycle events, such as onboarding and subscription transitions, to operate and assess the product; these are not message or document contents. Introducing non-essential tracking requires an updated notice and consent controls wherever required by law.

11. AI and automated decisions

No external generative-AI processor is included in the reviewed production inventory for this release. If a future enabled feature sends content to an AI provider, we will disclose the processing before introducing it. AI outputs remain human-reviewed drafts. These documents do not authorize training general-purpose models on Customer content.

Permission checks, plan limits, security scans and configured workflow rules may run automatically. PetOS does not authorize AI to diagnose, prescribe, hide incidents or make care-eligibility decisions. Contact the business about its care decisions and us about an account or access decision you believe is wrong.

12. Your rights and how to ask

Depending on the law that applies, you may request access, a copy, correction, erasure, restriction or portability of your personal information, object to certain processing, withdraw consent, and challenge decisions or complain to the competent data-protection authority. Rights and exceptions vary by jurisdiction; withdrawing consent does not make earlier lawful processing unlawful.

Send platform-account or PetOS privacy requests to info@thepetos.app. For care, staff, household and other business-controlled records, contact the relevant business; we help it respond and route misdirected requests appropriately. We may verify your identity and authority without asking for unnecessary information. We respond within applicable legal deadlines and explain lawful limits, including other people’s rights, recordkeeping and security. You do not need to send identity documents through an ordinary pet-document upload.

13. Security and children

We use access controls, tenant authorization, encryption in transit and provider-managed encryption at rest, private file storage, security checks, logs and backups. No internet service is risk-free. Protect your login and report suspected unauthorized access to info@thepetos.app. We assess incidents and notify affected businesses, people and authorities where required by law.

PetOS accounts are intended for adults. A business should not invite children to create accounts and should avoid collecting children’s information unless lawfully necessary and appropriately authorized. Contact us if you believe a child has provided personal information improperly.

14. Changes and contact

The version and review date identify this notice. We will communicate material changes through the app or account contact and obtain consent when legally required. Earlier notices and acceptance records are not silently rewritten by a new version.

Privacy contact: info@thepetos.app. Operator: NORTH & LIGHT INNOVATIONS PORTAL, Dubai, UAE. You may also complain to the supervisory authority competent for your circumstances; contacting us first is optional.