Privacy Policy
This Privacy Policy describes how Petsly collects, uses, and protects your personal information when you use our mobile application and services. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national data protection laws. During walk sessions, we also collect GPS route data including latitude, longitude, speed, and accuracy.
1. Information We Collect
We collect information you provide directly to us, such as when you create an account, make a booking, or contact us for support. This includes your name, email address, phone number, payment information, and pet details.
2. How We Use Your Information
We use your information to provide and improve our services, process transactions, send notifications, provide customer support, and ensure the safety and security of our platform.
3. Information Sharing and Sub-Processors
We do not sell your personal information to third parties. We share your information only as necessary to provide our services. Our key data processors, each bound by a Data Processing Agreement (DPA) that requires GDPR-compliant handling, are: Stripe, Inc. (payment processing and payout identity verification — USA; safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses); Supabase, Inc. (database hosting, file storage for photos and documents, and authentication — USA; safeguard: SCCs); Google LLC / Firebase (push notification delivery via Firebase Cloud Messaging — USA; safeguard: EU-US Data Privacy Framework); Google LLC (Sign-in with Google — USA; safeguard: EU-US Data Privacy Framework); Apple Inc. (Sign-in with Apple — USA; safeguard: SCCs); Twilio Inc. (phone number verification via SMS — USA; safeguard: SCCs); Resend Inc. (transactional email delivery — USA; safeguard: SCCs); Railway Corp. (backend API hosting and database infrastructure — USA; safeguard: SCCs); Sentry, Inc. (error monitoring — stack traces may contain anonymised user identifiers — USA; safeguard: SCCs). We require all processors to maintain appropriate security measures and to process your data only on our documented instructions. For further information on any processor or the safeguards applied to international transfers, please contact us at privacy@petsly.pet. Where we use AI-assisted content analysis (see Automated Content Analysis (AI) below), our provider is Anthropic, PBC (analysis of platform content to generate internal safety and quality signals — USA; safeguard: Standard Contractual Clauses).
4. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments. However, no method of internet transmission is completely secure, and we cannot guarantee absolute security.
5. Location Information and GPS Tracking
Profile location: With your permission, we collect your approximate home or work location to display your profile on the search map. This is optional; you can disable it at any time in your privacy settings (Settings > Privacy > Show on Map). Live GPS tracking during walks: When a pet owner requests live GPS tracking for a walk or drop-in visit and the sitter consents to share their location, we collect real-time GPS coordinates from the sitter's device during the active session. This data is: (a) visible in real time to the pet owner who booked the service; (b) stored as individual location points for up to 6 months, after which they are automatically and permanently deleted; (c) stored as a summary walk route (polyline overview) for the duration of the booking record; and (d) accessible to authorised Petsly support and administrative staff for dispute resolution purposes only. GPS tracking only occurs during active bookings and only when both parties have accepted the booking. The sitter may decline GPS sharing at any time. You can disable location access entirely in your device settings, which will prevent all GPS-based tracking by Petsly.
6. Cookies and Tracking
We may use cookies and similar tracking technologies to collect information about your app usage and preferences. Essential cookies are required for core platform functionality. Analytics cookies help us understand how users interact with the platform so we can improve our services. You can manage non-essential cookie preferences through your device or browser settings.
7. Your Rights (GDPR)
If you are located in the European Economic Area, you have the following rights regarding your personal data: (a) Right of Access — to request a copy of the personal data we hold about you; (b) Right to Rectification — to request correction of inaccurate data; (c) Right to Erasure — to request deletion of your personal data in certain circumstances; (d) Right to Restriction — to request that we limit how we use your data; (e) Right to Data Portability — to receive your data in a structured, machine-readable format (JSON); (f) Right to Object — to object to processing based on legitimate interests. To exercise any of these rights, please email us at privacy@petsly.pet with the subject line 'Data Rights Request'. For data portability requests, we will provide your profile information, pet profiles, booking history, and sent messages within 30 days. You also have the right to lodge a complaint at any time with your national data protection supervisory authority. In Cyprus, this is the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).
8. Children's Privacy
Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware of such collection, we will delete the information immediately.
9. Data Retention
We retain your personal data for the periods set out below. Account profile (name, email, phone, location): until account deletion plus a 30-day grace period. Pet profiles: until account deletion. Booking history (amounts, dates, status): 7 years from booking date (legal and tax obligation under Cyprus law). Messages: until account deletion. GPS walk tracks (precise location points): 6 months from collection, then automatically and permanently deleted. Walk session metadata (route summary): until the booking record is deleted or the account is closed. Financial documents such as receipts and payout statements: 7 years (Cyprus Income Tax Law). KYC identity documents: until account deletion plus 30 days, or longer where required by applicable financial regulations. Push notification tokens: until the device is unregistered or the account is deleted. Error logs (Sentry): 90 days. Anonymised analytics: indefinitely, as they are no longer linked to your identity. Where we are required by law to retain data beyond the periods above — for example for dispute, fraud, or tax purposes — we will do so but will restrict further processing to the minimum necessary. When your account is deleted, identifiable fields are anonymised within 30 days; financial records are retained in anonymised form for the applicable statutory period.
10. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at privacy@petsly.pet or through the Help & Support section of the app.
11. Data Controller
The data controller responsible for your personal data is Theodoros Herodotou, trading as Petsly Pet Services (Cyprus Business Name registration number EE 63545). For all data protection enquiries, including requests to exercise your GDPR rights, please contact us at privacy@petsly.pet. Our full legal and contact details are published at https://petsly.pet/legal. Where required by applicable law, we have designated a point of contact for data protection matters reachable at the same address.
12. Legal Basis for Processing (GDPR Article 6)
We process your personal data on the following lawful bases: (a) Contract performance (Article 6(1)(b)) — to create and manage your account, process bookings, handle payments, and provide customer support; (b) Legitimate interests (Article 6(1)(f)) — to improve our platform, prevent fraud, ensure security, and send service-related communications; (c) Consent (Article 6(1)(a)) — for optional features such as marketing emails; and for walk-session GPS tracking, where the sitter explicitly starts a walk and must have granted background location permission. Where we rely on consent, you may withdraw it at any time via your account settings without affecting the lawfulness of processing prior to withdrawal; (d) Legal obligation (Article 6(1)(c)) — where processing is required to comply with applicable law, including financial and tax regulations.
13. International Data Transfers
We may transfer your personal data to third-party service providers located outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V, including the European Commission's Standard Contractual Clauses (SCCs) or reliance on adequacy decisions. For further information about the safeguards applied to international transfers, please contact us at privacy@petsly.pet.
14. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with GDPR Article 34.
15. Message Monitoring and Content Moderation
When you communicate with other users through our in-app messaging, we collect and store the content of those messages, including the text and any images you send. To keep the platform safe and prevent fraud, messages and shared images are automatically screened by content-moderation systems that detect prohibited content, such as abusive, sexual, or unsafe material, and attempts to share personal contact details or move a transaction off the platform. Content that triggers these systems may be automatically filtered, blocked, or flagged for review. In addition, authorised Petsly support and administrative staff may access and review message content where reasonably necessary to: provide customer support; investigate a report or safety concern; resolve a dispute between users; detect, prevent, or address fraud, abuse, or breaches of our Terms of Service; or comply with a legal obligation. We access message content only to the extent necessary for these purposes and handle it in accordance with this Privacy Policy. The legal bases for this processing are our legitimate interests in keeping the platform safe and trustworthy and in preventing fraud (Article 6(1)(f) GDPR) and, where applicable, compliance with a legal obligation (Article 6(1)(c) GDPR). Messages are retained for the period set out in the Data Retention section above.
16. Automated Content Analysis (AI)
To identify safety risks, fraud, and service problems that keyword-based filters cannot detect, we may use an automated system that periodically reviews platform content using a third-party large language model provided by Anthropic, PBC (USA). Where we do, the content reviewed may include in-app messages and, depending on our configuration, quote notes, booking request notes, and booking notes, together with related structured booking information. The system produces internal, categorised signals for our support and administrative staff — for example a suspected attempt to move a payment off the platform, a user who appears stuck in a flow, or a possible safety concern. Any such signals are advisory only and are reviewed by a person before any action is taken. We do not make decisions producing legal or similarly significant effects about you solely by automated means within the meaning of Article 22 GDPR, and the automated system cannot suspend, restrict, or penalise an account. Where content is sent for analysis, it is transferred to Anthropic, PBC in the United States under Standard Contractual Clauses, is processed solely to return the analysis to us, and is not used to train the provider's models. Signals we generate are retained in accordance with the Data Retention section above. The legal basis for this processing is our legitimate interests in keeping the platform safe and trustworthy, preventing fraud, and improving our service (Article 6(1)(f) GDPR). You may object to this processing on grounds relating to your particular situation — see Your Rights (GDPR) above, or contact us at privacy@petsly.pet.
17. Google Calendar Data
Service providers can choose to connect a Google Calendar so that times they are already busy are automatically blocked from bookings on Petsly. This is optional and only happens after you sign in with Google and grant permission. With that permission we request read-only access to your calendars (Google scope calendar.readonly) and your Google account email address. We read the list of your calendars so you can choose which one to sync, and then the start time, end time and title of events in the calendar you chose; events marked as "free" are ignored. We use this data only to block the matching times on your Petsly availability. Event titles are shown only in your own availability view so you can recognise each blocked time; customers only see that a time is unavailable. Your email address is used only to show which Google account is connected. Access tokens are stored encrypted. We never create, change or delete events in your Google Calendar. We do not sell this data, use it for advertising, or use it to train AI models, and we do not share it with anyone except the hosting providers listed in Section 3, who process it on our behalf. You can disconnect at any time from the calendar sync settings in the app, which deletes the stored tokens and all synced events, or revoke access at https://myaccount.google.com/permissions. Petsly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Last Updated: 3 October 2026