Privacy Policy — PetPoint platform
This policy explains how PetPoint processes personal data when you visit our website, create an account or subscribe to PetPoint. It does not cover the data that grooming businesses store about their own clients in PetPoint: for that data the business is the controller and PetPoint only processes it on its behalf. If you are a client of a salon, please read the salon's privacy notice on its website or contact the salon.
1. Who we are
[Seller legal name], [ENI / Unipessoal Lda], NIF [number], [address], Portugal ("PetPoint", "we"). Contact for privacy matters: privacy@[domain].
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating and running your account | name, email, password (stored as a hash), language, Google account ID if you sign in with Google, business you belong to and your role | performance of contract (Art. 6(1)(b) GDPR) | while your account exists |
| Keeping you signed in and secure | session identifiers, IP address, browser (user agent), sign-in attempts | contract; legitimate interest in security (Art. 6(1)(f)) | sessions 30 days; security logs up to 30 days |
| Subscription, payment and invoicing | business legal name, VAT/NIF number, billing address, billing email, plan, payment history; card data is handled by Stripe and never reaches us | contract; legal obligation (Art. 6(1)(c)) for tax records | invoices and accounting records 10 years (Portuguese tax law); other billing data until the end of the contract plus 90 days |
| Service emails (verification, password reset, invitations, billing notices) | email, name, language | contract | per our email provider's log retention |
| Support | your messages and contact details | contract; legitimate interest | 3 years after the request is closed |
| Product news and waiting list | email, role, city, business size, language, how you heard about us | consent (Art. 6(1)(a)) — you can withdraw at any time via the link in each email | until you unsubscribe |
| Understanding how our website is used | aggregated statistics without cookies or personal identifiers (Plausible Analytics, EU) | legitimate interest | aggregated only |
| Measuring which channels bring new businesses | campaign parameters (utm, referrer, referral code) saved with your business at sign-up, and product usage events (without data about your clients) | legitimate interest in improving our product and marketing | while the business account exists |
| Backups | a full encrypted copy of our database | legitimate interest; security (Art. 32) | 30 days |
We do not sell personal data and do not use it for automated decisions with legal or similarly significant effects.
3. Who receives data
We use service providers (processors) to run PetPoint: Vercel (hosting), Neon (database, Frankfurt), Resend (email), GitHub (encrypted backups) and Stripe (payments; Stripe is also an independent controller for payment data). The current list with locations is at subprocessors. We may also share data with our accountant and with authorities when the law requires it.
4. International transfers
Our database is in the EU (Frankfurt). Some providers are based in the United States. Where data leaves the EEA we rely on the EU-US Data Privacy Framework for certified providers or on the European Commission's Standard Contractual Clauses.
5. Cookies
We use only cookies that are necessary to provide the service you request: keeping you signed in, remembering the selected business and language, and opening a salon website through its link. We do not use advertising or tracking cookies, so we do not show a cookie banner. If this changes, we will ask for your consent first.
6. Your rights
You can request access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to privacy@[domain]; we answer within one month. You also have the right to lodge a complaint with a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or the authority of your country of residence.
If you are the owner of a business account and close it, see our Terms of Service for how long you can still export your business data and when it is deleted.
7. Security
We store data in the EU, encrypt connections and backups, isolate the data of each business, limit staff access, and log important actions. See Annex II of our Data Processing Agreement.
8. Children
PetPoint is a service for businesses and is not intended for children under 16.
9. Changes
We will publish the new version on this page with its date and, for significant changes, inform account owners by email in advance.