TellMeBuddy™ Privacy Policy

1. Scope & Definitions

This Privacy Policy applies to:

• Website visitors
• Registered users and subscribers
• Affiliate and referral participants

“Personal Data” means any information that identifies, relates to, describes, or could reasonably be linked to an identifiable individual, as defined under applicable privacy laws, including the GDPR and the California Consumer Privacy Act as amended by the CPRA.

2. Categories of Personal Data We Collect

Depending on how you interact with the Platform, we may collect the following categories of data:

A. Account & Identity Data

• Email address
• Account credentials (hashed passwords)
• Language, region, and preference settings
• Subscription tier and account status

B. Pet-Related & User-Generated Content

• Pet profile details (e.g., name, species, breed, age)
• Behavioral observations, wellbeing inputs, diary entries
• Uploaded photos, images, text prompts, and chat messages
• AI-generated summaries, analyses, and contextual insights

Important Notice User-generated content may include free-form or sensitive information voluntarily provided by users. You should not upload information you do not wish to be processed by automated systems.

C. Payment & Transaction Data

• Subscription plan and billing status
• Transaction identifiers and timestamps

We do not store full payment card numbers. Payments are processed exclusively by third-party processors such as Stripe or LemonSqueezy.

D. Usage, Device & Technical Data

• IP address (anonymized or truncated where required by law)
• Browser type and version
• Device and operating system
• Referrer URLs
• Session activity, timestamps, feature usage
• Cookies and similar technologies

E. Affiliate & Referral Data

• Referral or affiliate identifiers
• Attribution metadata
• Commission-related records

Affiliate and referral tracking is enabled only for approved participants and may be introduced gradually during specific growth or launch phases of the Platform.

F. Marketing, Analytics & Advertising Data

• Analytics events and usage metrics
• Cookie and pixel identifiers
• Campaign attribution and conversion data

3. How We Use Personal Data

We process personal data only for lawful, limited, and legitimate purposes, including:

A. Platform Operation & Service Delivery

• Creating and managing user accounts
• Providing AI-powered chats, analyses, dashboards, and features
• Enforcing subscription tiers, quotas, and feature access

B. AI & Automated Processing

We process user-submitted text, images, and diary entries using AI services (including third-party providers such as OpenAI) to deliver contextual insights and personalized experiences.

AI Usage Clarification

• User data is processed to deliver and improve the service
• We do not create user-identifiable AI profiles
• We do not sell user data or AI training data to third parties
• Vector representations (embeddings) and summaries may be generated solely to provide context-aware responses and are subject to lifecycle controls

AI Disclaimer AI outputs are probabilistic, non-deterministic, and may be inaccurate or incomplete. They do not constitute veterinary, medical, or professional advice and must not be relied upon as such.

C. Payments & Account Administration

• Subscription billing and renewals
• Fraud prevention and transaction verification

D. Communications

• Transactional and service-related emails
• Onboarding and product updates
• Marketing communications where permitted by law or consent

Email delivery, segmentation, and lifecycle messaging are managed via Brevo (Sendinblue).

E. Analytics & Product Improvement

We use Google Analytics (GA4) and similar tools to understand platform usage and improve performance. Where required by law: IP addresses are anonymized or truncated; analytics data is not used to directly identify individuals.

F. Marketing, Advertising & Attribution

Marketing and analytics data are used solely to optimize onboarding, retention, and platform experience — not to monetize personal data.

G. Security, Abuse Prevention & Compliance

• Fraud and abuse detection
• Rate limiting and system integrity monitoring
• AI usage and cost control
• Enforcement of Terms of Service

Internal system logs are used strictly for security, operational reliability, and cost management, and never for advertising.

4. Profiling & Automated Processing

We may create limited, non-intrusive user segments based on: subscription tier; affiliate status; activity level; language or region.

Such profiling: does not produce legal or similarly significant effects; does not constitute automated decision-making under Art. 22 GDPR.

5. Legal Bases for Processing (GDPR)

For users in the EU/EEA/UK, processing is based on:

• Contract Performance (Art. 6(1)(b))
• Consent (Art. 6(1)(a))
• Legal Obligation (Art. 6(1)(c))
• Legitimate Interests (Art. 6(1)(f)), including security, abuse prevention, and product improvement

6. Disclosure of Personal Data

We do not sell personal data.

We may disclose limited data to:

A. Service Providers

• OpenAI – AI processing
• Stripe / LemonSqueezy – payment processing
• Amazon Web Services (AWS) – hosting and infrastructure
• Brevo (Sendinblue) – email and communication services
• Google Analytics – usage analytics
• Meta, TikTok, Google Ads – advertising and attribution

All providers are contractually bound to data protection obligations.

B. Affiliates & Referral Systems

Limited attribution data for referral tracking. Commission structures are confidential and disclosed only to approved participants via authenticated interfaces.

C. Legal & Business Transfers

• Legal or regulatory authorities where required
• Mergers, acquisitions, or asset transfers

7. Cookies & Tracking Technologies

We use cookies and similar technologies (such as pixels, SDKs, and local storage) to operate, secure, analyze, and improve the Platform.

Cookies are small text files stored on your device when you visit a website. They may be set by us (first-party cookies) or by third-party service providers (third-party cookies).

We use the following categories of cookies:

A. Strictly Necessary Cookies

These cookies are essential for the operation, security, and functionality of the Platform. They enable core features such as authentication, session management, fraud prevention, and system stability.

These cookies cannot be disabled through our consent tools.

B. Analytics Cookies

These cookies help us understand how users interact with the Platform, improve performance, and optimize features.

For example, we use Google Analytics (GA4).

Analytics cookies may collect information such as IP address (where required by law, anonymized or truncated), device type, browser type, and usage behavior.

C. Advertising & Marketing Cookies

These cookies are used to measure campaign performance, enable attribution tracking, and improve onboarding and marketing effectiveness.

They may be set by providers such as Meta, TikTok, or Google Ads and may track interactions across websites.

Retention Period

Cookies may remain on your device for varying durations depending on their purpose. Session cookies expire when you close your browser. Persistent cookies may remain for up to 24 months unless deleted earlier by you.

EU/EEA/UK Users

Where required by applicable law (including the ePrivacy Directive and GDPR), we obtain your prior consent before placing non-essential cookies (e.g., analytics or advertising cookies) on your device. You may withdraw or modify your consent at any time via the cookie settings tool available on the Platform.

U.S. Users

U.S. users may manage cookie preferences through browser settings or applicable opt-out mechanisms (such as Global Privacy Control where supported). For more information about how personal data collected via cookies is processed, please refer to the relevant sections of this Privacy Policy.

8. Data Retention & Account Termination

We retain personal data only as long as reasonably necessary to: provide the Platform; comply with legal and accounting obligations; resolve disputes; ensure security and abuse prevention.

Upon account termination, personal data is deleted or anonymized in accordance with legal requirements and operational constraints.

9. Security Measures

We implement industry-standard safeguards, including: HTTPS encryption; secure password hashing; access controls; infrastructure-level protections.

No system is entirely secure, and absolute security cannot be guaranteed.

10. Children’s Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

11. International Data Transfers

Data may be processed in the United States or other jurisdictions. Where required, transfers rely on: Standard Contractual Clauses (SCCs); adequacy decisions or equivalent lawful mechanisms.

12. U.S. Privacy Rights (CCPA / CPRA)

California residents may have the right to: know what personal data we collect and use; request deletion or correction; opt out of certain data sharing for advertising; not be discriminated against for exercising rights.

Requests may be submitted to legal@tellmebuddy.com.

13. GDPR Rights (EU/EEA/UK)

You may have the right to: access; rectification; erasure; restriction; data portability; objection; withdraw consent; lodge a complaint with a supervisory authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last Updated” date and, where appropriate, additional notice.

15. Contact Information

Arithor LLC
30 North Gould Street
Sheridan, Wyoming 82801
United States

📧 legal@tellmebuddy.com