Privacy Policy
Last updated: July 2026
1. Who We Are
PetFlow is a pet spa management platform operated by your local pet spa (the "Business"). The Business is the Data Controller for the personal data you share with them through PetFlow. PetFlow (the platform provider) acts as a Data Processor on behalf of the Business.
2. What Data We Collect
- Identity data: Your name
- Contact data: Phone number (WhatsApp), email address, postal address
- Pet data: Pet name, species, breed, weight, temperament notes, medical alerts, vaccination records
- Transaction data: Appointment history, invoices, payment records
- Communication data: WhatsApp chat history with our AI assistant
- Technical data: IP address (for security), browser type (for the web dashboard)
- Consent data: Records of your consent and marketing preferences
3. Why We Collect Your Data (Legal Basis)
| Purpose | Legal Basis |
|---|---|
| Booking & managing appointments | Consent (DPDP S.4) / Contract performance |
| Sending appointment reminders | Legitimate interest / Consent |
| Managing pet health records | Consent |
| Processing payments | Contract performance / Legal obligation |
| Sending marketing promotions | Explicit marketing consent |
| Fraud prevention & security | Legitimate interest / Legal obligation |
| Legal compliance & record-keeping | Legal obligation |
4. Third Parties We Share Data With
- OpenAI — AI assistant powering our WhatsApp chatbot. Your conversation messages are processed by OpenAI. See OpenAI Privacy Policy.
- Twilio / WhatsApp — For sending and receiving WhatsApp messages.
- Razorpay / Stripe — For processing payments. Payment card data is never stored on our servers.
- Amazon S3 — For storing pet photos and media files.
- Firebase (Google) — For authentication services.
We do not sell your personal data to any third party. View our full sub-processor list →
5. Data Retention
- Chat messages: Automatically deleted after 90 days from your last conversation.
- Appointment records: Retained for 3 years for service history.
- Financial records (invoices): Retained for 7 years as required by law.
- Marketing campaign logs: Anonymized after 12 months.
- Consent records: Retained indefinitely as proof of lawful processing.
6. Your Rights
Depending on your country, you have the following rights over your data:
- Right to Access — Request a copy of all data we hold about you.
- Right to Rectification — Ask us to correct inaccurate information.
- Right to Erasure — Ask us to delete your personal data ("right to be forgotten").
- Right to Data Portability — Receive your data in a machine-readable format.
- Right to Restrict Processing — Ask us to pause processing your data.
- Right to Object — Object to marketing communications at any time.
How to exercise your rights:
- • WhatsApp: Reply MY DATA to any of our messages
- • Marketing opt-out: Reply STOP to any marketing message
- • Contact the spa directly during business hours
We will respond within 7 days (India / DPDP Act), 30 days (UAE / PDPL), or 45 days (USA / CCPA).
7. Security
We use AES-256-GCM encryption for sensitive credentials, HTTPS for all data transmission, bcrypt hashing for passwords, and role-based access controls. Payment data is encrypted at rest and processed only through PCI-compliant providers (Razorpay / Stripe).
8. Cookies
Our web dashboard uses cookies for authentication (session cookies) and security. We do not use tracking or advertising cookies without your explicit consent.
9. Applicable Laws
- 🇮🇳 India: Digital Personal Data Protection Act, 2023 (DPDP Act)
- 🇦🇪 UAE: Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL)
- 🇺🇸 USA: California Consumer Privacy Act (CCPA / CPRA)
10. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via WhatsApp or email. Continued use of our services after the effective date constitutes acceptance of the updated policy.
11. Contact
For any privacy-related queries, contact your local pet spa directly. For platform-level issues, contact PetFlow support.