Privacy Policy

PetPals is operated by PetPals Oy (3656598-6), Vaaralankuja 14, 90460 Oulu. We are the data controller for the personal data described here under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

For any question about this policy or to exercise your rights, contact us at [privacy@petpals.fi].

Only what the service actually needs to work:

Account

Name, username, email address, city, and a password stored only as a bcrypt hash — never in readable form. Optionally a phone number, short bio, and profile picture link if you add them.

Pets

Name, species, breed, age, weight, and any care notes you write, including medication or behaviour details you choose to share with a sitter.

Sitter profile

If you offer sitting: your headline, description, city, rates, services, home details, and years of experience.

Availability

The date ranges you open for bookings.

Bookings

Dates, service type, the pets involved, your message to the other party, and the total price.

Messages

The messages you exchange with the other party about a booking.

Reviews

The rating and text you leave after a completed stay.

Session

A random session token in a cookie so you stay signed in.

Payments for bookings are taken on the site and processed by Stripe. Your card details go straight to Stripe and are never seen or stored by PetPals. What we hold is the record of the payment — the amount, its status, and the Stripe identifiers that tie it to your booking. Sitters receiving payouts give their bank details to Stripe, not to us.

When you are signed out, our hosting provider tells us the approximate city your connection appears to come from, and we use it to decide which sitters to show first on the front page. It is read while the page is being built and is not stored, not written to a log by us, and not connected to any account. Signed in, we use the city you chose yourself and ignore this entirely.

Running your account and bookings

Performance of a contract (GDPR Art. 6(1)(b)) — we cannot provide the service without it.

Showing sitter profiles and reviews publicly

Legitimate interest (Art. 6(1)(f)) in a marketplace where owners can judge who to trust with their animal.

Keeping accounts secure

Legitimate interest (Art. 6(1)(f)) in preventing unauthorised access.

If you publish a sitter profile, your name, city, headline, description, rates, availability, and any reviews you have received are visible to anyone visiting the site, including people who are not signed in. Reviews you write are shown publicly next to your name.

Your email address, phone number, and pet care notes are never shown publicly. Details of a booking are visible only to the two parties involved.

One cookie, petpals_session. It holds a random session token, lasts 30 days, and is marked HttpOnly so scripts cannot read it. It exists solely to keep you signed in — it is strictly necessary, so it does not require consent.

We use no analytics, advertising, or tracking cookies, and there are no third-party trackers on the site. Fonts are served from our own domain, so viewing a page sends no request to any font provider.

We do not sell your data or share it for marketing. It is handled only by the providers who run the service for us:

• Vercel — website hosting.
• Our database provider — stores the data described above.
• Stripe — processes booking payments and sitter payouts.

These act as processors on our instructions. Where a provider operates outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses.

Account data is kept while your account exists. Delete your account and we remove your personal data, except where we must keep certain booking records to resolve a dispute or meet a legal obligation.

Sessions expire after 30 days. Reviews may remain visible in anonymised form after account deletion, so the rating history of the person reviewed stays meaningful.

Under the GDPR you can ask us to:

• give you a copy of the data we hold about you;
• correct anything inaccurate;
• delete your data (“right to be forgotten”);
• restrict or object to how we use it;
• send you your data in a portable format.

Email [privacy@petpals.fi] and we will respond within one month. If you are unhappy with our response you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

Passwords are hashed with bcrypt and never stored or logged in readable form. Session cookies are HttpOnly and sent over HTTPS only. Access to booking details and messages is restricted to the two parties involved, and checked on the server on every request.

No system is perfectly secure. If we discover a breach affecting your rights, we will notify you and the supervisory authority as required by law.

PetPals is not intended for under-16s, and we do not knowingly collect their data. Contact us if you believe a child has registered and we will remove the account.

If we change this policy materially we will update the date above and, where the change affects you significantly, tell you directly.