TellMeBuddy™ Privacy Policy

1. Scope & Definitions

This Privacy Policy applies to:

• Website visitors and users of our iOS and Android apps
• Registered users and subscribers
• Affiliate and referral participants

“Personal Data” means any information that identifies, relates to, describes, or could reasonably be linked to an identifiable individual, as defined under applicable privacy laws, including the GDPR and the California Consumer Privacy Act as amended by the CPRA.

2. Categories of Personal Data We Collect

Depending on how you interact with the Platform, we may collect the following categories of data:

A. Account & Identity Data

• Email address
• Account credentials (hashed passwords)
• Language, region, and preference settings
• Subscription tier and account status
• First name and, if you add one, a profile photo
• If you use Sign in with Apple or Sign in with Google: the name, email address (or Apple’s private relay address) and account identifier that Apple or Google share with us. We never receive your Apple or Google password.
• Time zone and notification preferences

B. Pet-Related & User-Generated Content

• Pet profile details (e.g., name, species, breed, age)
• Behavioral observations, wellbeing inputs, diary entries
• Uploaded photos, images, text prompts, and chat messages
• AI-generated summaries, analyses, and contextual insights

Important Notice User-generated content may include free-form or sensitive information voluntarily provided by users. You should not upload information you do not wish to be processed by automated systems.

C. Payment & Transaction Data

• Subscription plan and billing status
• Transaction identifiers and timestamps

We do not store full payment card numbers. Payments are processed exclusively by third-party processors such as Stripe or LemonSqueezy.

D. Usage, Device & Technical Data

• IP address (anonymized or truncated where required by law)
• Browser type and version
• Device and operating system
• Referrer URLs
• Session activity, timestamps, feature usage
• Cookies and similar technologies
• In our mobile apps: app version, device model and operating system version
• A push notification token, only if you allow notifications
• Error and crash reports (for example, which screen failed and the technical error)

E. Affiliate & Referral Data

• Referral or affiliate identifiers
• Attribution metadata
• Commission-related records

Affiliate and referral tracking is enabled only for approved participants and may be introduced gradually during specific growth or launch phases of the Platform.

F. Marketing, Analytics & Advertising Data

• Analytics events and usage metrics
• Cookie and pixel identifiers
• Campaign attribution and conversion data

3. How We Use Personal Data

We process personal data only for lawful, limited, and legitimate purposes, including:

A. Platform Operation & Service Delivery

• Creating and managing user accounts
• Providing AI-powered chats, analyses, dashboards, and features
• Enforcing subscription tiers, quotas, and feature access

B. AI & Automated Processing

We process user-submitted text, images, and diary entries using AI services (including third-party providers such as OpenAI) to deliver contextual insights and personalized experiences.

AI Usage Clarification

• User data is processed to deliver and improve the service
• We do not create user-identifiable AI profiles
• We do not sell user data or AI training data to third parties
• Vector representations (embeddings) and summaries may be generated solely to provide context-aware responses and are subject to lifecycle controls

AI Disclaimer AI outputs are probabilistic, non-deterministic, and may be inaccurate or incomplete. They do not constitute veterinary, medical, or professional advice and must not be relied upon as such.

C. Payments & Account Administration

• Subscription billing and renewals
• Fraud prevention and transaction verification

D. Communications

• Transactional and service-related emails
• Onboarding and product updates
• Marketing communications where permitted by law or consent

Email delivery, segmentation, and lifecycle messaging are managed via Brevo (Sendinblue).

E. Analytics & Product Improvement

We use Google Analytics (GA4) and similar tools to understand platform usage and improve performance. Where required by law: IP addresses are anonymized or truncated; analytics data is not used to directly identify individuals.

F. Marketing, Advertising & Attribution

Marketing and analytics data are used solely to optimize onboarding, retention, and platform experience — not to monetize personal data.

G. Security, Abuse Prevention & Compliance

• Fraud and abuse detection
• Rate limiting and system integrity monitoring
• AI usage and cost control
• Enforcement of Terms of Service

Internal system logs are used strictly for security, operational reliability, and cost management, and never for advertising.

4. Profiling & Automated Processing

We may create limited, non-intrusive user segments based on: subscription tier; affiliate status; activity level; language or region.

Such profiling: does not produce legal or similarly significant effects; does not constitute automated decision-making under Art. 22 GDPR.

5. Legal Bases for Processing (GDPR)

For users in the EU/EEA/UK, processing is based on:

• Contract Performance (Art. 6(1)(b))
• Consent (Art. 6(1)(a))
• Legal Obligation (Art. 6(1)(c))
• Legitimate Interests (Art. 6(1)(f)), including security, abuse prevention, and product improvement

6. Disclosure of Personal Data

We do not sell personal data.

We may disclose limited data to:

A. Service Providers

• OpenAI – AI processing
• Stripe / LemonSqueezy – payment processing
• Amazon Web Services (AWS) – hosting and infrastructure
• Brevo (Sendinblue) – email and communication services
• Google Analytics – usage analytics
• Meta, TikTok, Google Ads – advertising and attribution
• Vercel – hosting and delivery of the website and web app
• Sentry – error and crash reporting. We do not attach your name, email address or pet content to these reports.
• Better Stack – uptime monitoring and server logs
• Google Firebase Cloud Messaging and Apple Push Notification service – delivering the push notifications you allow
• Apple and Google – sign-in, if you choose Sign in with Apple or Sign in with Google

All providers are contractually bound to data protection obligations.

B. Affiliates & Referral Systems

Limited attribution data for referral tracking. Commission structures are confidential and disclosed only to approved participants via authenticated interfaces.

C. Legal & Business Transfers

• Legal or regulatory authorities where required
• Mergers, acquisitions, or asset transfers

D. Buddy Family (shared pets)

Buddy Family is optional. If you create or join a Buddy Family, the following applies:

• Pets that are shared with the family, and their data (pet profile, check-ins, diary notes, photos, Buddy Scans, wellbeing scores, medical findings and vet reports), are visible to every member of that family, and every member can add to them.
• Your first name and profile photo are shown to the other members next to the entries you create and in the member list.
• Your chats with Buddy, your email address, your payment details and your account settings are never shared with other members.
• When you join, you decide which of your own pets you share. Pets you do not share stay private.
• The person who manages the family can see the member list and remove members. Any member can leave at any time. After leaving, you keep your own pets and account; pets owned by others are no longer visible to you. Entries you added to another member's pet stay part of that pet's history until you delete them or delete your account.
• We process this data to provide the shared-care feature you chose to use (performance of a contract, GDPR Art. 6(1)(b)).

7. Cookies & Tracking Technologies

We use cookies and similar technologies (such as pixels, SDKs, and local storage) to operate, secure, analyze, and improve the Platform.

Cookies are small text files stored on your device when you visit a website. They may be set by us (first-party cookies) or by third-party service providers (third-party cookies).

We use the following categories of cookies:

A. Strictly Necessary Cookies

These cookies are essential for the operation, security, and functionality of the Platform. They enable core features such as authentication, session management, fraud prevention, and system stability.

These cookies cannot be disabled through our consent tools.

B. Analytics Cookies

These cookies help us understand how users interact with the Platform, improve performance, and optimize features.

For example, we use Google Analytics (GA4).

Analytics cookies may collect information such as IP address (where required by law, anonymized or truncated), device type, browser type, and usage behavior.

C. Advertising & Marketing Cookies

These cookies are used to measure campaign performance, enable attribution tracking, and improve onboarding and marketing effectiveness.

They may be set by providers such as Meta, TikTok, or Google Ads and may track interactions across websites.

Retention Period

Cookies may remain on your device for varying durations depending on their purpose. Session cookies expire when you close your browser. Persistent cookies may remain for up to 24 months unless deleted earlier by you.

EU/EEA/UK Users

Where required by applicable law (including the ePrivacy Directive and GDPR), we obtain your prior consent before placing non-essential cookies (e.g., analytics or advertising cookies) on your device. You may withdraw or modify your consent at any time via the cookie settings tool available on the Platform.

U.S. Users

U.S. users may manage cookie preferences through browser settings or applicable opt-out mechanisms (such as Global Privacy Control where supported). For more information about how personal data collected via cookies is processed, please refer to the relevant sections of this Privacy Policy.

D. Mobile Apps

Our iOS and Android apps do not load advertising pixels or advertising SDKs, and they do not track you across apps or websites owned by other companies. Inside the apps we use first-party analytics (Google Analytics, with Google signals and ad personalization turned off) to understand how features are used, and error reports to keep the apps working.

You can turn push notifications on or off at any time in your device settings or in the app under More → Notifications.

8. Data Retention & Account Termination

We retain personal data only as long as reasonably necessary to: provide the Platform; comply with legal and accounting obligations; resolve disputes; ensure security and abuse prevention.

You can delete your account at any time: in the app under More → Account & privacy → Delete account, on the web under Account & privacy, or by emailing legal@tellmebuddy.com from the email address on your account. Step-by-step instructions: tellmebuddy.com/delete-account.

When you delete your account, we immediately and permanently delete your account and profile, all pets you own and their data (check-ins, diary entries, Buddy Scans, chats, medical findings and vet reports) and every photo and file you uploaded. We cancel an active subscription, remove you from our email lists and, if you used Sign in with Apple, revoke our access to your Apple sign-in. If you manage a Buddy Family, it ends; members keep the pets they added themselves.

We keep only: payment and invoice records, for as long as tax and accounting law requires; usage and cost statistics that no longer contain your name, email address or pet content; and backups, which expire on a rolling basis so that deleted data is removed from them within 35 days.

9. Security Measures

We implement industry-standard safeguards, including: HTTPS encryption; secure password hashing; access controls; infrastructure-level protections.

No system is entirely secure, and absolute security cannot be guaranteed.

10. Children’s Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

11. International Data Transfers

Data may be processed in the United States or other jurisdictions. Where required, transfers rely on: Standard Contractual Clauses (SCCs); adequacy decisions or equivalent lawful mechanisms.

12. U.S. Privacy Rights (CCPA / CPRA)

California residents may have the right to: know what personal data we collect and use; request deletion or correction; opt out of certain data sharing for advertising; not be discriminated against for exercising rights.

Requests may be submitted to legal@tellmebuddy.com.

13. GDPR Rights (EU/EEA/UK)

You may have the right to: access; rectification; erasure; restriction; data portability; objection; withdraw consent; lodge a complaint with a supervisory authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last Updated” date and, where appropriate, additional notice.

15. Contact Information

Arithor LLC
30 North Gould Street
Sheridan, Wyoming 82801
United States

📧 legal@tellmebuddy.com