Privacy Policy
What Petoo collects, why, who else sees it, and the rights you have over it.
Petoo helps people find and book care for animals. To do that we handle personal data — yours, and sometimes information about animals in your care. This page explains what we collect, why, who else sees it, and what you can make us do about it.
We have written it to be read, not to be survived. If anything here is unclear, that is our failure and we would like to hear about it.
1. Who we are
Petoo is operated by Nipun Sonkhla, trading as Petoo, a sole proprietorship, at:
TBD_ADDRESS
Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for the personal data described here. You are the Data Principal.
Contact: support@thepetoo.com · Grievance Officer: see Grievance Redressal.
2. What we collect
2.1 Things you give us
- Account — name, username, email address, phone number and country code, and password (stored only as a cryptographic hash, never as text we can read). We ask for your date of birth only if you choose to use Petto, our AI companion — see §4.
- Profile — avatar, bio, location, language and display preferences.
- Pets and animals — names, species, breed, age, photos, health and vaccination records, and any notes you add.
- Bookings and orders — the service or product, the vendor, delivery address, timing, and messages exchanged.
- Community content — forum posts, comments, reviews, missions, pack membership, and reputation earned.
- Welfare reports — reports about street animals or animals at risk: location, description, photographs, health observations, and any evidence attached.
- Support and complaints — the content of tickets and correspondence.
2.2 Things we record automatically
- Security and session data — the IP address and browser user-agent of your most recent login, login count, and last-active time. We use this to detect account compromise.
- Directory interactions — when you tap Call, WhatsApp, Directions, or view a listing, we record the event, the business, and the city and area. This tells us which businesses people actually need, so we know where to grow.
- Technical logs — ordinary web-server and error logs.
We do not run advertising trackers, behavioural profiling, or third-party analytics cookies.
2.3 Things we get from elsewhere
- Social login — if you sign in with a third-party provider, we receive the basic profile that provider releases.
- Payment status — our payment processor tells us whether a payment succeeded. Card and bank details are entered on the processor's own hosted checkout and never reach Petoo's servers.
- Directory listings — business names, addresses, phone numbers, opening hours and photographs for pet-care businesses, gathered from publicly available sources. See §9.
3. Why we use it, and on what basis
| What we do | Why | Basis under the DPDP Act |
|---|---|---|
| Run your account | You asked us to | Consent |
| Fulfil bookings and orders | To deliver what you paid for | Performance of our contract with you |
| Process payments, hold funds in escrow, handle refunds | To move money safely | Contract; legal obligation |
| Show you nearby vendors | The core of the service | Consent |
| Publish your reviews, posts and reputation | You chose to post publicly | Consent |
| Handle welfare reports and disputes | Animal safety; establishing or defending legal claims | Legitimate use |
| Detect fraud, abuse and account takeover | Keeping people and animals safe | Legitimate use |
| Send service messages (booking confirmations, security alerts) | You need them | Contract |
| Send optional updates and newsletters | Only if you opt in | Consent — withdrawable any time |
We do not sell personal data. We have never sold personal data.
4. Petto, our AI companion
Petto is an optional assistant inside Petoo. Please read this section specifically, because it is the part of the service that sends your words outside our systems.
- Your conversations are sent to a third-party AI provider outside India to generate replies. That provider processes the message under contract and does not use it to train models on your data.
- Petto remembers. Conversation history and what it learns about your pets are stored so it stays useful across sessions. You can view and delete this at any time.
- Petto is not a veterinarian. It will point you to a qualified vet for anything medical. Never rely on it in an emergency — contact a vet.
- Petto is for adults. You must be 18 or over to use it, which is why we ask your date of birth before your first message. We record when you accepted Petto's terms.
5. Children
Petoo accounts, bookings and payments are intended for people aged 18 and over.
To be precise about how far that goes: we do not currently verify your age when you sign up. We ask for date of birth before you use Petto, our AI companion, which is restricted to adults. We do not knowingly maintain accounts for under-18s, and if you tell us about one we will remove it. An age check at sign-up is planned — until it exists, we are not going to describe one.
There is one deliberate exception. Reporting an animal in distress is open to everyone, including under-18s, without an account. A child who finds an injured street dog should be able to get help for it, and we are not willing to put an age gate in front of that.
On that reporting route we collect only what the report needs — the animal, the location, the description. We do not track, profile, or advertise to anyone using it, as required by section 9 of the DPDP Act. If you believe a child has given us personal data beyond a welfare report, contact us and we will delete it.
6. Who else sees your data
We share only what each recipient needs.
Vendors. When you book or order, the vendor receives your name, phone number, the details of the booking, and a delivery address where one is needed. They do not receive your other bookings, your browsing, or your account history.
Service providers. We rely on:
| Provider | What for | Where processed |
|---|---|---|
| Payment gateway | Payments, refunds, vendor payouts | India |
| Cloud hosting | Running the application and database | Outside India |
| Object storage & CDN | Photographs and uploaded files | Singapore |
| AI provider | Petto's replies | Outside India |
| Error monitoring | Diagnosing crashes | Outside India |
| SMS provider | One-time codes and alerts | Varies |
| Email provider | Service and account email | Varies |
| Web fonts & maps | Page rendering and map tiles | Outside India |
Other users. Anything you post publicly — reviews, forum posts, missions, public profile fields — is visible to others by design. Your privacy settings control whether your email, phone and profile are public; email and phone are private by default.
Authorities. Where we are legally required to disclose, or where disclosure is necessary to prevent serious harm to a person or an animal.
7. Where your data is held
Some of your data is processed outside India. Photographs and uploaded files are stored in Singapore. Application hosting, AI processing and error monitoring also take place outside India. Payment processing takes place in India.
Wherever it goes, your rights under the DPDP Act travel with it, and we remain accountable to you for it.
8. How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Account and profile | Deleting removes your profile from the platform straight away, and we can restore it for 30 days if you ask us to. Permanent erasure from our database is done manually on request — see §10 | Lets you undo a deletion you regret |
| Payment and invoice records | As required by Indian financial-record law | We are not permitted to delete these |
| Welfare cases and evidence | While the case is open; afterwards the animal's record is kept and your identity as reporter is removed | Animal welfare history has lasting value; your identity does not need to persist for it |
| Dispute evidence | Until the dispute closes, plus the limitation period | Establishing or defending legal claims |
| Moderation and governance records | Kept, with the actor pseudonymised on erasure | Community decisions must remain auditable, per our governance rules |
| Petto conversations | Until you delete them | They are yours |
| Directory interaction events | Kept as aggregate; your identity is detached the moment your account is erased | We keep the count, not the person |
| Security logs (IP, user-agent) | 12 months | Fraud and intrusion investigation |
| Records of consent | Kept | Proof of what you agreed to, and when |
Where a record must survive for one of the reasons above, we anonymise rather than delete wherever that is possible.
9. Business listings in our directory
Petoo lists pet-care businesses so people can find help nearby. Listings come from publicly available sources and contain business contact information — name, address, phone, hours.
We may telephone a listed business to check the details are right. We do not record those calls.
If you run a listed business: you may have it corrected or removed. Write to support@thepetoo.com and we will act. We do not require you to create an account to ask.
10. Your rights
Under the DPDP Act you may:
- Access — get a copy of the personal data we hold about you.
- Correct — have inaccurate or incomplete data fixed.
- Erase — have your data deleted, except where §8 requires us to keep or anonymise it.
- Withdraw consent — as easily as you gave it. Some features stop working without it.
- Nominate — name someone to exercise these rights if you die or become incapacitated.
- Complain — to us first (see Grievance Redressal), and to the Data Protection Board of India if we fail you.
To exercise any of these, write to support@thepetoo.com. We will respond within 30 days.
Being straight with you: self-service export and erasure tools are being built. Until they ship, these requests are handled manually by a person reading that mailbox. Your rights are the same either way; we would rather say so than imply a button exists.
11. How we protect it
Passwords are hashed, never stored readably. Session tokens live in httpOnly cookies that JavaScript cannot read. Traffic is encrypted in transit. Access to production data is limited to people who need it.
No system is perfect. If a breach affects you, we will tell you and the Data Protection Board as the DPDP Act requires.
12. Cookies
We set cookies that are strictly necessary for the site to work — keeping you signed in, protecting forms against cross-site request forgery, remembering your theme.
We do not use advertising or analytics cookies, so we do not show a cookie banner. Note that pages loading fonts and maps from third parties will reveal your IP address to those providers, as any embedded resource does.
If we ever add analytics, we will ask first.
13. Changes
We version this policy. The version and effective date are shown at the top of the page.
For material changes — a new purpose, a new category of recipient, anything that changes what you agreed to — we will notify you and, where the law requires it, ask you to accept again. We will not use a silent edit to expand what we may do with your data.
14. Contact
Questions: support@thepetoo.com Complaints: Grievance Redressal Regulator: the Data Protection Board of India.