VettedTails Privacy Policy

DRAFT — PENDING COUNSEL REVIEW. Prepared with best reasonable assumptions; not reviewed by an attorney. Bracketed items are open counsel decisions.

Version: DRAFT-2026-07-11 · Effective date: [TBD — set at counsel signoff] · Sync: rendered verbatim by `vettedtails-frontend` at `/privacy` (ADR-030 versioning applies).

Last updated: [DRAFT — 2026-07-11]

This Privacy Policy explains what VettedTails ("we," "us") collects, why, who we share it with, and the choices you have. It applies to our website, mobile apps, and services (the "Platform").

1. Information we collect

You provide it:

• Account & profile: display name, email address, password (handled by our auth provider; we never see it), role (owner/sitter), profile photo.
• Sitter profile: bio, service offerings and rates, and your service location. We convert your address to geographic coordinates at save time and store only the coordinates, not the street address. Your precise location is never shown publicly; owners see distance only.
• Pet profiles (owners): name, species, breed, size, age, photos, and medical/behavioral notes you choose to add.
• Bookings & payments: booking details and payment records. Card numbers go directly to Stripe; we never receive or store them. Sitters' identity/KYC and bank details are collected by Stripe for payout onboarding.
• Messages between booking parties, reviews, support tickets (including safety-incident reports), and waitlist email addresses.
• Sitter trust documents: Certificate of Insurance details (carrier, policy number, limits, dates) and the certificate document.

Collected automatically:

• Usage analytics (PostHog): product events tied to a random user ID — we do not put names, emails, phone numbers, or precise locations in analytics events; searched locations are recorded at coarse (city/area) precision.
• Error and diagnostic data (Sentry) and standard server logs.
• Cookies: authentication/session cookies required to operate the Platform. [Confirm at counsel review: no advertising cookies exist today.]

From third parties:

• Background-check information (sitters): with your separate, standalone FCRA authorization, Checkr (a consumer reporting agency) prepares a background report. This can include criminal-history information. We store the check's status, adjudication state, and the notice audit trail; the report itself lives with Checkr.

Precise geolocation — GPS walk tracking (sitters, mobile app): with your device-level permission, the mobile app collects location samples from the sitter's device during a walk, including in the background. This is sensitive personal information under some state laws (e.g., CCPA/CPRA). How it works:

• Samples are used to build a walk record for the booking's owner.
• Never live: the owner's in-progress view is delayed by at least [15] minutes; the full route is visible only after the walk completes.
• Coverage/quality metrics about the tracking itself (sample frequency, gaps, permission state) are recorded.
• Sitters may decline the permission; their listings will indicate that walks are not GPS-verified.
• We use precise location only to provide this feature — never for advertising, and we do not sell it.

2. How we use information

To operate the marketplace (matching, bookings, payments, payouts); to run trust and safety features (background checks, insurance verification, suspensions, off-platform-payment notices — which are informational and never block your messages); to send transactional email (booking lifecycle, receipts, policy expiry warnings); to provide support and investigate reports; to measure and improve the product (UUID-keyed analytics); to comply with law (tax forms, FCRA process, legal requests); and to enforce our Terms.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

3. Who we share it with (sub-processors)

We also share: with the other party to your booking (owners see sitter profile, distance, reviews, and post-walk GPS records; sitters see owner name, pet profiles, and booking details); with authorities when legally required; and with a successor in a business transfer (you would be notified).

4. Retention & account deletion

You can delete your account in-app (or by writing to [SUPPORT_EMAIL]). On deletion we:

• anonymize your profile (name becomes "Deleted user"; photo and contact details removed);
• permanently delete your message contents, pet profiles, photos, precise location point, and all GPS walk traces;
• retain booking and payment records (including refund records) as required for tax, accounting, and payment-processor reconciliation;
• retain reviews you wrote, attributed to the anonymized profile — deleting an account does not silently change other users' ratings;
• retain Terms/Privacy acceptance records and, for sitters, background-check adjudication and notice records for the period required by law [counsel: confirm FCRA retention];
• mark your login as deleted with our auth provider so it can no longer be used.

Active-account data is retained while your account exists. Webhook/event logs are pruned on a rolling ~90-day basis.

5. Your rights

Depending on where you live (e.g., California), you may have rights to access/export, correct, and delete your personal information, and to limit certain uses of sensitive personal information. On the Platform:

• Export: account settings → "Export my data" produces a machine-readable (JSON) copy of your profile, pets, bookings, messages, and reviews. Only you can export your own data.
• Delete: account settings → "Delete account" (Section 4 describes what is retained and why).
• We honor rights requests at [SUPPORT_EMAIL] within the timelines required by applicable law, and we do not discriminate against you for exercising them.
• We use sensitive personal information (precise geolocation; background-report data) only to provide the requested services and for legal compliance — the purposes for which no separate limit-use right is required under CPRA. [Counsel: confirm; see legal-questions Q12(d).]

6. Security

Row-level security and least-privilege access controls on our database; encrypted transport everywhere; payment card data handled exclusively by Stripe; secrets never shipped to browsers or apps; administrative access via offline tooling on operator-controlled machines only (no web admin exists). No system is perfectly secure; we will notify affected users and regulators of a breach as required by law.

7. Children

The Platform is for adults 18+. We do not knowingly collect information from anyone under 18; if you believe we have, contact [SUPPORT_EMAIL] and we will delete it.

8. Changes to this policy

This policy is versioned; your acceptance is recorded with the version and timestamp. Material changes are presented for re-acceptance before you continue using the Platform.

9. Contact

VettedTails — [LEGAL ENTITY NAME, address TBD at LLC formation] Privacy requests & questions: [SUPPORT_EMAIL] · https://vettedtails.com/support