PETLoves Privacy Notice

How PETLoves handles data, permissions, content and privacy requests.

1. Controller and contact

The controller for PETLoves is Alessandro Caturano. For information or to exercise your data rights, contact privacy@petloves.it. Do not send passwords or access codes.

2. Data processed

We process data needed for the features you use:

• Account and profile: email, account identifier, credentials handled by the authentication service, name, role, preferences and information you enter. At registration or a new declaration, your birth date is temporarily requested to calculate the minimum age threshold. The server retains a protected 16+ or 18+ declaration, role, rule version, self-declared source and recording/evaluation timestamps, not the complete date. The declaration is not public.
• Pets, diary and documents: pet profiles, notes, reminders, documents and veterinary information you enter. These may also contain personal details of owners and contacts. Avoid unnecessary human health or other personal data.
• Community and services: posts, images, stories, questions, answers, comments, reviews, meetups, followers/following, chats, bookings and updates shared with the participants involved. We do not import your phone address book.
• Location and searches: saved area, approximate or precise location when authorized, places attached to content and remote search text.
• Notifications: preferences, inbox and delivery tokens when enabled. Revoking permission does not delete all previous notification records.
• Support, safety and diagnostics: requests, reports, moderation decisions, consent events, app/device technical data, errors and performance timings. Operational tickets may be generated automatically and linked to your account by the server. Minimization and redaction do not necessarily make data anonymous.

Drafts may remain on your device; active accounts, synchronization, publication and services also use servers. This release does not record new walks, request microphone access, upload new video/audio or enable payments or paid campaigns. Existing videos or historical walk archives have a separate deletion lifecycle.

3. Purposes and proposed legal bases

Age: minimized declaration and a new 18+ declaration

The new flow does not retain the complete birth date in operational account, profile or recovery data. The date entered is used during the request to calculate the threshold and is not saved in the declaration. A 16+ declaration does not automatically become 18+ as time passes: when needed, we request a new explicit declaration. Recovery does not invent missing information or use a pet's birth date. The current export includes the minimized declaration, not a reconstructed full date. Account erasure includes its removal path; backups, offline copies and earlier exports have separate lifecycles.

The migration verified on 29 September 2026 covers structured fields in the operational systems inventoried. It does not certify erasure of every date that might appear in earlier backups, messages, attachments or exported copies. This flow does not ask for documents: it is a self-declaration, not documentary identity verification or a certification of adulthood. The 16/18 thresholds are PETLoves access rules. Users aged 16-17 remain minors. You can request correction through support; safeguards against arbitrary changes do not remove that right.

Optional analytics and device diagnostics

Non-essential navigation, usage and performance analytics are optional. You can refuse or withdraw consent without losing essential features. Access to their history and collection require effective consent for the current account; remote transmission also depends on service configuration. An active choice does not mean remote transmission is enabled.

Automatic device incident collection, including fault tickets and crash archives, is disabled in the current candidate. Calling an operation diagnostics does not make it necessary. Any future reactivation requires an approved specific purpose and disclosure, relevant consent and fresh verification; a previous analytics choice will not implicitly authorize a new purpose. Requested data saving and recovery, server-side security controls and voluntary support exports remain separate.

If a withdrawal cannot be confirmed by the server while offline, optional collection is already suspended on the device. The interface distinguishes these states and offers a confirmation retry; it does not claim an unverified server withdrawal is complete. Copies already lawfully retained follow their own terms and are not described as automatically erased merely by withdrawal.

Content and evidence requiring greater protection

Veterinary information about a pet is not automatically a person's health data. However, free text, images or documents may contain special-category human data or information about criminal offences. We do not request these for ordinary support and ask you not to include unnecessary information. The internal term sensitive evidence also covers ordinary confidential logs; it does not mean every log falls within GDPR Art. 9.

Ordinary legitimate interest alone is insufficient for special-category data. Evidence necessary for a specific legal claim requires separate assessment of Art. 9(2)(f); not every ticket or QA check qualifies. Criminal-offence data also require Art. 10 conditions. Without an applicable ground, routine collection or reuse is not authorized: access must be restricted, redaction/removal assessed, and any specific obligation preventing deletion documented. Approval of this notice is not explicit consent by data subjects and does not retroactively remedy collection without a legal basis. For support, moderation and QA evidence, the operator must distinguish ordinary confidential information, special-category data and criminal-offence data; limit access and copies, retain only what is necessary, and apply section 6. Case classification, grounds for retention and provider compatibility must precede reuse or further disclosure. A legal basis does not override a provider's contractual prohibitions. We do not promise a filter capable of recognizing every sensitive item. This proposed procedure requires operational adoption; this document does not certify review of every existing copy.

Refusing essential data prevents the relevant feature, such as creating an account without required information. Optional choices can be managed in your profile and device settings. Without location permission, you can use alternatives based on an entered area. Service notifications follow available preferences; this notice does not introduce advertising or newsletter consent.

4. Address search and MapTiler

When you type an address, PETLoves may send your search text and filters such as language, country and city area directly to MapTiler AG, including as you type, to suggest results. The connection also exposes your IP address to the provider. The function does not add your PETLoves email, account identifier or access token. That does not make the search anonymous.

Typing an address does not require GPS permission. Resolving the current location instead uses the operating system's service through Expo. Revoking GPS does not prevent a search you choose to type from being sent. Local cache duration does not determine how long the provider retains logs.

The MapTiler DPA dated 24 March 2026, received on 28 September, describes the provider as a processor and provides online incorporation without a separate signature.

5. Recipients, external services and transfers

The current technical flow involves these services for the features used:

Historical copies still needed in previous Gmail, personal Outlook, personal OneDrive and legacy Aruba mail are managed separately until their verified disposition. Migration does not restart retention periods or certify deletion of original copies, versions or trash.

The SES, SNS and SQS configuration uses the Frankfurt region. This is not a promise that support, subprocessors or all provider processing remain exclusively within the EEA; the information and safeguards applicable to the actual services still apply.

Push messages may be visible on your lock screen depending on device settings. Voluntarily opening Maps or another navigation app sends that app the selected destination; its further processing is governed by its own notice. This does not itself activate general PETLoves location consent.

Published content is visible to the audience of the feature; chats and bookings to the participants involved. Public pages may be indexed. We do not publish age declarations or tickets as profile content. Authorized operators access data needed for support and moderation. Disclosures to authorities require applicable grounds. Professionals are independently responsible for their services. We do not sell personal data and the candidate does not introduce behavioural advertising or cross-app advertising identifiers.

Providers do not have the same role for every activity: processing on behalf of PETLoves must be distinguished from providers' own purposes. Vercel and Expo also describe independent-controller roles for certain service data. Calling a vendor a service provider therefore does not justify every exclusion from Google Data Safety sharing disclosures.

Services may involve access or transfers outside the EEA, including for support and subprocessors. Public documents reviewed provide mechanisms such as standard contractual clauses and, where applicable, adequacy decisions. We do not certify that every flow stays in the EU, every provider is DPF-certified, or these mechanisms have been verified for every PETLoves account. Copies and details of applicable safeguards can be requested through the privacy contact, with protection for other parties' confidential information.

6. Retention and deletion

Account data and content remain available while you use the service, until deletion or the expiry applicable to the feature. Closing a chat, cancelling a booking or resetting local data does not necessarily delete server records.

You can delete your content where supported and request account deletion in the app. Pending media removals must be handled separately. Withdrawing consent stops the relevant future processing without affecting lawful processing before withdrawal.

Raw analytics events are retained for 90 days from server receipt. Daily cleanup removes expired events; under normal operation, waiting for the next cycle can add up to one day. Failures or backlogs require operational action. Backups follow a separate lifecycle.

Disabled push registrations are removed by daily cleanup after 30 days from recorded deactivation; later server-side changes may postpone expiry. Active registrations are not removed merely because the app has not been used. Waiting for the cycle and potential failures have the same operational limits described above. Permission revocation on the device may reach the server only later.

Moderation reports with a verified final decision and their related actions are subject to daily cleanup after 365 days. Appeals, open cases, restrictions still in force and related evidence still needed postpone removal and require review. More recent events or changes may also postpone it. Classified ordinary technical audit events follow 365 days from the event, with the same protections for related cases. Consent, age and account-erasure records and other unclassified event families require separate assessment: this cleanup does not delete them. Cycle delays and backlogs remain subject to the operational limits described above.

The server social inbox expires 90 days after server-recorded creation, even for unread notifications. Cleanup removes notifications and the content of linked cloud copies, without deleting the underlying chat messages, bookings or content. Empty removal markers may remain for another 90 days from their server update to synchronize offline devices; guards prevent expired entries from being restored even after those markers expire. Future local reminders are excluded. Cycle delays and failures require the same operational oversight described above.

Closed tickets and support copies under our control follow 180 days from verified closure. Operator review reconciles email, archives and exports before database removal. Open cases, appeals, legal holds and related evidence still needed are excluded and reviewed; recent changes can postpone expiry. This is an assisted procedure, not automatic mailbox deletion. Diagnostic bundles voluntarily sent to support follow 30 days after closure of the related case, with the same exclusions. Delays and failures require operator action, not indefinite retention.

Minimum evidence of account erasure follows 365 days after verified completion of the request. The initial removal phase or a final technical event alone is not sufficient when media cleanup, uncertain attribution or disputes remain pending. Exceptions require review at least every 30 days, a recorded reason and limitation to evidence still needed. A hashed identifier is not treated as automatically anonymous.

Administrative role assignment evidence remains while needed to justify access, then follows 365 days after verified revocation. Evidence excluding administrative privileges from reviewer accounts remains necessary while those accounts are used. Evidence expiry does not revoke access or alter an account.

Technical QA evidence containing personal data is reviewed when the relevant criterion closes. Unnecessary raw copies must be removed within 30 days after the final candidate decision, after preparing a minimized dossier. That dossier is reviewed 12 months after the candidate is replaced; further retention requires justification. Evidence still needed for open cases or disputes is excluded from removal and reviewed. These are assisted procedures: an aggregate expiry check does not certify deletion of external copies, backups or immutable snapshots.

The temporary realtime transport log has a configured 14-day window and daily cleanup. It is separate from content and conversation tables; deleting that log does not delete the underlying content.

In the verified Supabase Pro configuration, daily database backups are available for a 7-day window. API/database logs have a documented 7-day retention under that plan. Storage objects are not included in database backups: file removal requires the separate media-cleanup path. These periods do not describe all PETLoves copies or every provider's records, and do not certify physical erasure of every byte.

Server consent events and the protected age declaration have a removal path associated with account deletion, distinct from withdrawing an individual consent. This notice does not introduce an additional period for retaining them after account deletion. Minimum evidence of deletion follows the separate criterion described above.

Any new unclassified audit families require review, not indefinite retention for generic audit purposes. Instant deletion of every copy is not promised. Copies independently kept by recipients and search engine caches are not deleted by resetting the app alone.

7. Your rights

Where applicable, you can request access, correction, erasure, restriction and portability. You can object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. The in-app export is not a substitute for a complete access request for server data outside the snapshot.

Contact privacy@petloves.it. We may request proportionate information to verify your identity; we do not ask for your email password. We normally respond within one month, with reasoned extensions where allowed by law. You can complain to the Italian data protection authority or the competent authority in your EU country.

8. Minors, personalization and decisions

Personal accounts require a minimum age of 16; professional accounts require 18. Users aged 16-17 remain minors. The privacy threshold does not grant the capacity to enter any contract or authorize unrelated purposes. The minimized declaration is not documentary identity verification.

These access thresholds are distinct from store content ratings, which can vary by country and operating-system version. A lower content rating does not authorize creating a PETLoves account below its access threshold; a professional account still requires age 18 or older.

Preferences, area and interactions may affect content ordering. This release does not introduce solely automated decisions producing legal or similarly significant effects. Safety filters may restrict content; reporting, review and support contact paths are available.

9. Updates

Changes do not create retroactive consent or replace consent required for new optional purposes.