Privacy Policy

1. Who we are

Pawlio ("Pawlio", "we", "us", "our") is a digital pet identity and records wallet operated by Pawlio ID Ltd, a company registered in England and Wales.

We are the data controller for the personal data described in this policy. If you have any questions, email us at hello@pawlioid.com.

2. What this policy covers

This policy explains what personal data we handle when you use app.pawlioid.com and the emails we send. It does not cover third-party websites you may reach through links from Pawlio; those have their own policies.

3. Information we collect

We collect the following:

• Account details you give us: your email address and password (your password is stored securely by our authentication provider and is never visible to us in plain text), and optionally your name, phone number, country, postcode or region, and a profile photo.
• Pet records you add: your pet's name, species, sex, photos, microchip number, vaccinations, medical notes, and any documents you upload, such as vaccination certificates, vet letters or insurance papers.
• Sharing and transfer data: the read-only share links you create, ownership transfer requests (including the recipient's email address), and any messages someone sends you through a pet's public profile.
• Activity and security logs: a record of key actions (for example sign-in, uploads, shares, transfers, data exports and public-profile views) together with your IP address and browser type, kept to keep the service secure and to detect abuse.
• Technical data needed to run the service: a cookie that keeps you signed in, and bot-protection checks.
• Aggregate visit counts (no cookie, no consent needed): for each visit to a public page we record only a page type, your country (derived from the network, never stored as an IP address) and the referring website's name (its host, such as google.com, never the full address, a real profile link, or your browser type). This is a simple count and cannot identify you.
• Unique and returning visitor counts (only if you accept our cookie notice): a first-party cookie (pawlio_vid) holding a random identifier with no personal data, used solely to tell unique visitors from returning ones. Nothing is set unless you accept, and you can withdraw at any time.

4. Why we use your data, and our lawful bases

Under UK GDPR we rely on the following lawful bases:

• To provide the service (performance of a contract): creating your account, storing and showing your pet records, generating share links, processing ownership transfers, and sending you service emails such as confirmations and reminders.
• To keep the service secure and prevent abuse (legitimate interests): activity logging, bot protection and rate limiting.
• To send optional product or marketing updates (consent): only if you opt in. You can withdraw your consent at any time.
• To meet legal obligations (legal obligation): for example responding to lawful requests or keeping records we are required to keep.

5. Who we share it with

We do not sell your personal data. We use a small number of trusted providers that process data on our behalf, under contract and only on our instructions:

• Supabase: database, authentication and file storage, hosted in the EU (London region).
• Resend: sending transactional emails.
• Vercel: hosting the application.
• Cloudflare Turnstile: bot and abuse protection on sign-up and sign-in.

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards, such as UK or EU approved data-transfer mechanisms. We may also disclose data where the law requires it.

6. How we protect your data

• Private by default: you can only see your own pets' records. Documents and microchip numbers are never shown publicly.
• Database row-level security restricts every record to its owner.
• Files are kept in private storage and served only through short-lived signed links to people you authorise.
• Share and transfer links are stored only as salted hashes, never as the raw token, and can be revoked or expire.
• Public profiles show only the fields you choose, and tokenised or public pages are kept out of search engines.

7. Public profiles and sharing are your choice

If you turn on a pet's public found-pet profile, the information you select becomes visible to anyone with the link. Please do not put anything sensitive in open notes. You stay in control of what is shared and can turn it off at any time.

8. How long we keep it

We keep your account and pet records for as long as your account is active. When you close your account we permanently delete your profile, the pets you currently own and their uploaded files, and we anonymise your security logs (removing your identifier, IP address and browser type). Pets you have transferred to someone else stay with their new owner.

Our operational and security logs are deleted automatically on a schedule: public contact-form rate-limit records after 30 days; security activity logs after 12 months; aggregate visit records and unique-visitor counts after about 14 months; and in-app feedback after 24 months. We may keep limited records longer where we need to meet a legal obligation or resolve a dispute.

9. Your rights

Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, and ask for a portable copy. You can download a copy of your data at any time from Account, then Your data.

To exercise any right, email hello@pawlioid.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), although we would like the chance to help first.

10. Cookies

Strictly-necessary cookies run the service: one keeps you signed in, and one set by Cloudflare Turnstile provides bot protection. These are essential, so they need no consent.

Aggregate visit counts to our public pages are recorded without any cookie at all, so they happen whether or not you accept the notice. They are a simple count and do not identify you.

Only the unique and returning visitor counts use a cookie. With your consent we set one first-party analytics cookie (named pawlio_vid) that holds a random identifier and no personal data, kept for up to about 13 months. We ask before setting it, you can decline, and nothing is set unless you accept. You can change or withdraw your choice at any time using the controls at the bottom of this page; withdrawing clears the cookie from your browser.

We do not use advertising or third-party tracking cookies.

11. Children

Pawlio is intended for adults aged 18 and over. It is not intended for use by children.

12. Changes to this policy

We may update this policy from time to time. We will change the date above and, for significant changes, let you know in the app or by email.

13. Contact

Questions about this policy or your data? Email hello@pawlioid.com.