Privacy Policy – PetiFit

1. What is this Privacy Policy?

This Privacy Policy explains how PetiFit Sp. z o.o. (“PetiFit”, “we”, “us”) processes the personal data of users of the PetiFit mobile application and the petifit.com website.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and other applicable data protection laws.

2. What data do we collect?

a) User account data

• email address,
• password stored as a secure hash,
• when signing in through Apple or Google – the account identifier provided by the relevant provider and the email address, if shared with us,
• information related to account settings and operation.

We do not receive passwords for Apple or Google accounts.

b) Pet profile data

Users may provide information about their pet, such as:

• name,
• species and breed, including mixed or unknown breed,
• sex,
• date of birth or adoption,
• weight and coat colour,
• activity level and other information relating to behaviour or walks,
• allergies, illnesses and other information about the pet’s health,
• microchip or tattoo number, if the user chooses to provide it,
• other information voluntarily added by the user.

c) Photos

Users may add one or more photos to their pet’s profile, either by selecting them from the device gallery or taking a photo directly using the camera.

Photos added to a profile are visible to other PetiFit users using the social and profile discovery features.

PetiFit does not obtain permanent access to the entire photo gallery or camera. Access is granted in accordance with the permissions provided by the user and the device operating system.

Before uploading a photo, the user should ensure that they have the right to use it and that the photo does not infringe the rights or privacy of other individuals.

d) Pet health, nutrition and activity data

If the user makes use of the relevant PetiFit features, we may process information such as:

• veterinary appointments,
• vaccinations,
• medications and symptoms,
• measurements, e.g. the pet’s weight or temperature,
• user notes,
• information about meals and pet food,
• calorie or activity goals,
• photos of food or documents relating to the pet.

e) Precise device location

With the user’s permission, PetiFit may access the precise location of the device, including geographic coordinates.

Location data is used, among other things, to:

• discover dogs and users located nearby,
• calculate distances between profiles,
• provide map functionality,
• record walking routes,
• provide other location-based features within the app.

PetiFit stores precise location data on its servers where this is necessary to provide the features used by the user.

PetiFit accesses location data while the user is using the application and features that require location access. We do not track the device’s location in the background when the user is not using the app, unless in the future the user separately enables a feature requiring background location access and is clearly informed about it.

Users may change location permissions at any time in the settings of their device. Disabling location access may cause some PetiFit features, such as discovering nearby dogs or tracking a walk, to stop working properly.

f) Walking routes

If the user starts the walk tracking feature, PetiFit records the route of the walk using GPS data, including consecutive location points forming the route.

A recorded route may include, in particular:

• the route itself,
• the start and end location of the walk,
• distance,
• duration of the walk,
• other activity-related statistics.

A route is not automatically visible to other users. By default, it can be accessed by the user who recorded it and by authorised PetiFit administrators to the extent necessary for app operation, security, user support or troubleshooting.

Other users may view a route only if the owner chooses to share it using an available feature within the application.

Users should be aware that a shared route may contain information from which other people could infer places the user visits, including the approximate start or end point of the walk.

g) Matches, friends and messages

PetiFit allows users to discover pet profiles, connect with other users, create matches or friendships and communicate with one another.

In connection with these features, we may process:

• information about likes, matches and relationships between profiles,
• a list of friends or connections created within PetiFit,
• the content of messages sent through the chat feature,
• the date and time of messages and technical information relating to the conversation.

Messages are stored on PetiFit servers in order to provide chat functionality, synchronise conversations and maintain app security.

The application may currently not provide users with the ability to delete an entire conversation history themselves. Users may contact us at contact@petifit.com regarding their personal data and the rights available to them.

h) Family Sharing

If a user uses the Family Sharing feature, they may invite other people to access their pet’s data.

The information visible to invited users may include, among other things, pet profile data, photos, health and activity information, and data relating to location and walks, depending on the app features and the user’s settings.

Access is granted at the request of the user who uses the Family Sharing feature.

i) Technical data

In order to ensure the proper operation and security of the application, we may process, among other things:

• device model,
• operating system and version,
• application version,
• IP address,
• technical identifiers,
• information about errors and application crashes,
• technical logs,
• push notification token.

j) Website data

When using petifit.com, we may process technical data relating to use of the website and use cookies in accordance with the rules described later in this Policy.

3. For what purposes and on what legal basis do we process data?

4. Features using AI

Certain PetiFit features may use artificial intelligence systems, for example to analyse information, images or documents relating to a pet.

In order to provide such features, data may be transferred to external AI technology providers, including providers of third-party models, to the extent necessary to perform the action initiated by the user.

Data is transmitted using secure connections. The scope of processing depends on the specific feature used by the user.

If use of a specific AI feature requires separate consent, the user will receive appropriate information before the processing begins.

5. Who can see data in PetiFit?

Profiles and photos

Information intended for PetiFit’s social features, in particular a pet’s profile and photos added to it, may be visible to other users of the application.

Location

PetiFit may hold the precise geographic coordinates of the user’s device, but we do not share the precise device location with other users as part of the standard discovery feature.

Location information shown to other users is limited in such a way that it does not reveal the user’s exact position and does not display location data with precision greater than the 5 km threshold.

Walking routes

Recorded routes are private by default. Other users may view a route only if the owner chooses to share it.

Messages

Messages are visible to the participants in the relevant conversation. Authorised PetiFit personnel may access them only to the extent necessary for user support, moderation, security or compliance with legal obligations.

6. Who may we share data with?

We may use external service providers that support the operation of PetiFit. Data is shared only to the extent necessary to provide the relevant service.

Recipients of personal data may include, in particular:

• IT infrastructure and hosting providers,
• technical and security service providers,
• Apple and Google – including for authentication and system services,
• external mapping service providers, depending on the device, operating system and feature being used,
• AI service providers – in connection with features initiated by the user,
• push notification service providers,
• public authorities, courts or other authorised bodies, where required by applicable law.

Entities processing data on our behalf are required to provide appropriate protection and process data in accordance with our instructions and applicable laws.

We do not sell users’ personal data.

7. Transfers of data outside the EU/EEA

Some technology providers used by PetiFit may process data outside the European Economic Area.

Where such transfers occur, we use data protection mechanisms required by applicable law, including European Commission adequacy decisions or Standard Contractual Clauses, where applicable.

8. How long do we retain data?

We retain personal data no longer than is necessary for the purpose for which it was collected.

• Account and profile data – generally for as long as the user maintains an active account.
• Photos and pet data – until deleted by the user or until the account is deleted, subject to the period required to technically remove data from our systems and backups.
• Location data – for as long as necessary to provide location-based features and in accordance with the retention rules applicable to the relevant account.
• Recorded walking routes – for as long as they remain stored in the user’s account or until they are deleted together with the account, except where longer storage is necessary for legal or security reasons.
• Messages – for as long as necessary to provide chat functionality and maintain conversation history, generally for the duration of the account, unless longer retention is necessary for security purposes, abuse reports or legal claims.
• Technical and security logs – for as long as necessary for diagnostics, security and protection against abuse, and no longer than justified by those purposes.
• Data required by law – for the period required under applicable legal provisions.
• Data relating to legal claims – until the expiry of the relevant limitation periods.

After an account is deleted, data is deleted or anonymised in accordance with PetiFit’s applicable procedures, unless continued retention is required by law or necessary to establish, pursue or defend legal claims.

9. Where and how do we store data?

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure.

Security measures include, among other things:

• encrypted transmission using HTTPS/TLS,
• secure storage of passwords in hashed form,
• limiting access to data to authorised persons,
• access control mechanisms,
• technical monitoring and infrastructure safeguards.

PetiFit’s infrastructure may include both our own systems and infrastructure provided by external IT service providers.

10. Location consent and withdrawal

PetiFit’s access to precise device location requires the appropriate permission granted by the user.

Users may withdraw location access at any time through their device settings.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Once location access is disabled, features requiring location data, such as discovering nearby dogs or tracking a walking route, may no longer be available.

11. User rights

Subject to the conditions set out in the GDPR, users may have the right to:

• access their personal data,
• receive a copy of their data,
• rectify inaccurate data,
• request deletion of data,
• restrict processing,
• data portability,
• object to processing based on legitimate interests,
• withdraw consent at any time where processing is based on consent.

To exercise these rights, users may contact us at: contact@petifit.com.

We may ask for information necessary to verify the identity of the person making the request.

Users also have the right to lodge a complaint with the competent supervisory authority for data protection. In Poland, this authority is the President of the Personal Data Protection Office (UODO).

12. Account deletion

Users may initiate deletion of their account directly within the PetiFit application in the account settings.

Deleting an account begins the process of deleting or anonymising the data associated with that account, except for information that PetiFit is required or permitted to retain for a certain period under applicable law, for security purposes, or in order to establish, pursue or defend legal claims.

If a user experiences difficulties deleting their account, they may contact us at: contact@petifit.com.

13. Training and development of AI models

If PetiFit uses users’ personal data to train or improve its own artificial intelligence models in a manner that requires a separate legal basis, users will be appropriately informed.

Where such processing is based on consent, that consent will be voluntary and may be withdrawn at any time.

Data that has been permanently anonymised in a way that makes it impossible to identify an individual is not considered personal data under the GDPR.

14. Children

PetiFit is intended for users who are at least 16 years old.

Persons under the age of 16 should not independently create an account or use PetiFit services.

15. Cookies

The petifit.com website may use cookies necessary for its proper operation.

Analytics, marketing or other non-essential cookies are used only in accordance with applicable law and, where required, after obtaining the user’s consent.

16. Changes to this Privacy Policy

PetiFit continues to develop the application and may introduce new features. As a result, this Privacy Policy may be updated from time to time.

In the event of material changes concerning the way personal data is processed, we will inform users in an appropriate manner, for example through the app, on the website or by email.

The current version of this Privacy Policy is available on the PetiFit website.