PetDeets Privacy Policy

Effective Date: August 6, 2026 Last Updated: October 21, 2026

1. Introduction

This Privacy Policy explains how Stinky Software LLC ("PetDeets," "we," "us") collects, uses, shares, and protects personal information when you use the PetDeets mobile applications, website at petdeets.com, and related services (the "Service").

For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), Stinky Software LLC, an Oregon limited liability company, is the data controller of the personal information described in this Policy.

Contact: [email protected] · 21000 NW Logie Trail Road, Portland, OR 97231, United States

2. A Note About Pet Data

Most of what you store in PetDeets is information about animals — their medications, weights, allergies, feeding schedules, and health history. Information about an animal is generally not "personal data" about a human, and is not protected health information under HIPAA (which applies to human patients).

However, records you upload — veterinary invoices, lab results, insurance documents, photographs — frequently contain your name, address, phone number, payment references, and the names of your veterinarians. We treat that information as your personal data and protect it accordingly.

3. Information We Collect

3.1 Information you provide

3.2 Information collected automatically

We do not collect device location. The application requests no location permission and records no GPS coordinates. Addresses appear in the Service only where you have typed them in yourself.

3.3 Information from others

If someone invites you to a household or shares a pet record with you, we receive your email address from them in order to send the invitation.

4. How We Use Information and Our Legal Bases

For users in the EEA and UK, GDPR requires us to identify a lawful basis for each purpose:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object at any time (see Section 9).

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use your pet records or uploaded documents to train artificial intelligence models, and we do not permit our vendors to do so.

5. Automated Processing

Where the Service offers automated extraction of information from documents you upload, this processing is used only to pre-fill fields for your review. It does not produce any decision with legal or similarly significant effects, and no output is applied without your confirmation. You may decline to use the feature and enter information manually.

To perform this extraction we transmit the specific file you submit — and nothing else from your account — over an encrypted connection to Anthropic PBC in the United States, which returns extracted text for your review. Anthropic acts as our processor under a written agreement and does not use the content to train its models. If you would rather not send a document to a third party, do not use the feature: every field it fills can be entered by hand.

6. How We Share Information

The short version: we never sell your personal data, and we never give it to other companies for their own use — not for advertising, not for marketing, not for anything. It goes only to the people you choose to share with (6.1), to the service providers that run parts of PetDeets for us under contract (6.2), where the law requires it (6.3), or if PetDeets itself changes hands (6.4).

We share personal information only as described below.

6.1 People you authorize

Household members, caregivers, sitters, walkers, or veterinary staff you invite receive access to the records you choose to share, at the permission level you set. You control this and can revoke it at any time — though revocation does not retrieve information already viewed or downloaded.

6.2 Service providers (processors)

Each provider is bound by a written data processing agreement, may process personal information only on our documented instructions, and may not use it for its own purposes.

Media files are stored primarily on infrastructure we operate directly and served over encrypted connections. A mirrored copy is held in offsite backup storage as described in Section 8.3.

6.3 Legal and safety

We may disclose information where we reasonably believe it is required to comply with a law, regulation, subpoena, court order, or lawful governmental request; to enforce our Terms; to investigate fraud or security incidents; or to protect the rights, property, or safety of any person or animal. Where legally permitted, we will notify you before disclosing your information in response to a legal request.

6.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you and the acquirer will remain bound by this Policy or provide notice before materially changing it.

6.5 Aggregated and de-identified data

We may create and use aggregated or de-identified data that cannot reasonably be used to identify you. We will not attempt to re-identify such data.

7. International Data Transfers

We are based in the United States and our primary infrastructure is located in the United States. Traffic to the Service is routed through a global content delivery network, so connection metadata may be processed at an edge location nearer to you. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States, which may have data protection laws different from those of your country.

For transfers from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with supplementary technical measures including encryption in transit and at rest. A copy of the relevant transfer mechanism is available on request at [email protected].

8. Data Retention and Deletion

8.1 General principle

We retain personal information only for as long as necessary to provide the Service to you, or for as long as required by law.

8.2 Active accounts

While your account is active, we retain your account information and pet records so the Service works as intended. You may delete individual records, pets, or documents at any time from within the application.

8.3 Account deletion — 30-day erasure commitment

When you delete your account, or when we delete it at your request, we will permanently erase your personal information from our production systems within thirty (30) days, except where retention is required by law.

Specifically:

1. Immediately upon deletion request, your account is deactivated, access is revoked, and your data is removed from all live and shared views. Any sharing links or caregiver access are invalidated. During the thirty (30) day window you may restore your account by signing in again.

2. Within thirty (30) days, your account information, pet records, uploaded documents and photographs, and associated media files are permanently erased from our production databases and object storage.

3. Care you logged for other households. If you delete your account, care you logged in someone else's household, like a dose you checked off, stays in their pet's history. Your name and contact details are removed; it shows as "Former member."

4. Encrypted database backups are retained on a rolling schedule and removed in the ordinary course within ninety (90) days. Deleted data may persist in those backups until they age out, is not restored to production, and is not accessible or used for any purpose. If a backup must be restored for disaster recovery, we will re-apply pending deletions promptly following restoration.

5. Offsite backup copies of media. Uploaded photographs and documents are mirrored to encrypted offsite storage for disaster recovery. When your data is erased under paragraph 2, the corresponding offsite copies are removed on the next daily reconciliation, and in any event within the ninety (90) day window described in paragraph 4.

6. Server and security logs containing IP addresses are retained for up to 30 days for security and abuse-prevention purposes, then deleted or de-identified.

7. We will confirm completion of erasure by email once the process is complete.

8.4 Exceptions — retention required by law or for legal claims

We may retain limited information beyond thirty (30) days only where necessary to:

• comply with tax, accounting, and financial record-keeping obligations (transaction records — amount, date, and customer identifier — typically retained for seven (7) years, held by our payment processor and in our billing records);
• comply with an applicable legal obligation, court order, or lawful governmental request;
• establish, exercise, or defend legal claims, where a dispute is pending or reasonably anticipated; or
• maintain a minimal suppression record — an irreversible hash of your email address — solely to honor your deletion or opt-out request and prevent re-creation of deleted data.

Information retained under this Section is limited to what is strictly necessary, is not used for any other purpose, is access-restricted, and is deleted once the retention obligation expires.

9. Your Privacy Rights

9.1 Rights under GDPR (EEA, UK, Switzerland)

You have the right to:

• Access — obtain confirmation of whether we process your personal data and receive a copy of it;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure ("right to be forgotten") — have your personal data deleted, subject to the legal exceptions in Section 8.4;
• Restriction — limit how we process your data in certain circumstances;
• Data portability — receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• Object — object to processing based on our legitimate interests, and to object at any time to direct marketing;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing;
• Not be subject to solely automated decision-making producing legal or similarly significant effects (we do not engage in such decision-making);
• Lodge a complaint with your national supervisory authority. A list is available at edpb.europa.eu; UK residents may contact the Information Commissioner's Office at ico.org.uk.

9.2 Rights under California law (CCPA/CPRA)

California residents have the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; to opt out of sale or sharing for cross-context behavioral advertising; to limit use of sensitive personal information; and to be free from discrimination for exercising these rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

You may designate an authorized agent to make a request on your behalf; we will require proof of authorization.

9.3 Other U.S. states

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, portability, and opt-out, including the right to appeal a denied request. To appeal, reply to our response or write to [email protected] with "Privacy Appeal" in the subject line.

9.4 How to exercise your rights

You can delete your account at any time from within the application under Settings → Account.

Data export and portability. You may request a complete copy of your account data — your profile, pet records, and document metadata — in a structured, machine-readable format. Email [email protected] to request one.

To exercise any other right, email [email protected].

We will verify your identity, typically by confirming control of the email address associated with your account, before acting on a request. We will respond within thirty (30) days, or within one month for GDPR requests, and may extend by up to sixty (60) additional days for complex requests, with notice to you. There is no charge for these requests unless they are manifestly unfounded or excessive.

10. Cookies and Similar Technologies

Mobile applications. We do not use cookies in our mobile apps. We use local device storage for session tokens, settings, and offline caching. Analytics are collected using a first-party identifier and, in debug builds, are disabled entirely.

Website and web app. Our website at petdeets.com and the PetDeets web app use only strictly necessary cookies, for authentication and security — these cannot be disabled. We do not use analytics or advertising cookies.

In the PetDeets web app, we use PostHog to see which steps people use. It receives your account ID and the steps you took, never names, notes or pet details, and it sets no cookies. PostHog processes it for us and may not use it for anything else.

Global Privacy Control. We honor the Global Privacy Control (GPC) signal as a valid opt-out request where required by law.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

• encryption in transit (TLS) for all connections between apps, our servers, and our database;
• encryption at rest for our database and stored media;
• passwords stored only as salted hashes — never in plain text;
• token-based authentication with scoped, revocable access;
• access controls limiting production data access to those who require it;
• automated encrypted backups with validated restore procedures;
• infrastructure and application monitoring with alerting;
• vendor review and written data processing agreements with all processors.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your credentials confidential. If we become aware of a breach affecting your personal information, we will notify you and the relevant supervisory authorities as required by applicable law — under GDPR, notification to the supervisory authority within 72 hours where the breach is likely to result in a risk to your rights and freedoms.

12. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. In the EEA, users must be at least 16 unless a parent or guardian consents, subject to the lower age set by their member state. If you believe a child has provided us personal information, contact [email protected] and we will delete it promptly.

13. Third-Party Links and Affiliate Programs

The Service may link to third-party sites, including affiliate links through the Amazon Services LLC Associates Program. Those sites have their own privacy practices, which we do not control. Clicking an affiliate link may result in the third party setting cookies or receiving a referral identifier. We receive only aggregate commission reporting, not information identifying which individual user made a purchase. Review the privacy policy of any site you visit.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account and/or by prominent in-app notice at least thirty (30) days before the changes take effect. The "Last Updated" date at the top always reflects the current version.

15. Contact Us

Data Controller Stinky Software LLC 21000 NW Logie Trail Road, Portland, OR 97231, United States Email: [email protected]

Availability. The Service is currently offered only in the United States. We do not presently distribute the application in, or direct it to, the European Economic Area or the United Kingdom, and we have therefore not appointed a representative under Article 27 of the EU or UK GDPR. If we begin offering the Service in those territories we will appoint a representative and update this Policy before doing so.

The GDPR-based rights described in Section 9.1 are extended to all users as a matter of practice, regardless of where you live.

You have the right to lodge a complaint with your local data protection authority, though we would appreciate the chance to address your concern first.