1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Christopher Lenz, Postreitweg 26a, 45472 Mülheim an der Ruhr, Germany
Email: pawsandppl@gmail.com
Based on the current assessment, no data protection officer has been appointed. For all privacy matters you can contact the email address above directly.
2. General information and scope
This privacy policy applies to this website and – marked separately – to the Paws & People mobile app. Personal data is any information relating to an identified or identifiable natural person.
We process personal data exclusively on the basis of applicable data protection law, in particular the GDPR and the German Federal Data Protection Act (BDSG), as well as the German TDDDG where applicable.
3. Processing when visiting this website
3.1 Hosting and technical provision
This website is built with Lovable and published via the hosting infrastructure provided by Lovable. When the website is accessed, technically necessary data is processed so the page can be delivered to your device.
3.2 Server log files
Each time the site is accessed, the hosting infrastructure may automatically process access data in log files. This may include in particular:
- IP address of the requesting device
- date and time of access
- page or file requested
- amount of data transferred and status message
- referrer URL
- browser type, browser version and operating system
The purpose is the technical provision, stability and security of the website as well as preventing and investigating misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and trouble-free operation.
3.3 Contacting us by email
If you contact us by email at pawsandppl@gmail.com, we process the data you provide (in particular your email address, your name if given, and the content of your message) in order to handle your request.
The legal basis is Art. 6(1)(b) GDPR where the request relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries. Where the request concerns the exercise of data subject rights, processing is additionally carried out to comply with a legal obligation under Art. 6(1)(c) GDPR.
3.4 Cookies and comparable technologies
This website does not use any analytics, marketing or tracking technologies. In particular, there are no web analytics services, advertising networks, social media plugins or external video embeds. Fonts are not loaded from external servers.
No consent banner is displayed because, as things currently stand, no cookies or comparable technologies requiring consent are used. Technically necessary storage required to deliver and secure the website may take place.
Contact form on the support page
You can reach us through a contact form on the support page. The following data is processed: topic of the request, email address and message text (mandatory), plus optional name, username, device and operating system. Optionally you can attach up to three image files (JPG, JPEG, PNG or WEBP, max. 10 MB each); these are stored exclusively in a private storage area that is not publicly accessible and are only opened to handle your request. We also store the language version of the page in which the request was submitted.
The data is processed solely in order to handle and answer your request. The legal basis is Art. 6(1)(b) GDPR where the request relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to support requests.
Data submitted through the form is stored in our backend database (Supabase, see the Supabase section) and is not publicly accessible. To protect against automated misuse we use a hidden form field, server-side validation of the input and a limit on the number of requests per email address. No external captcha, analytics or form services are used. You can optionally attach up to 3 files (JPG, JPEG, PNG, WEBP, PDF, max. 10 MB each). They are stored in a private area of our backend storage, are not publicly accessible and are used solely to handle your request. File type and size are validated on the server before storing.
4. Processing in the mobile app
Paws & People is a social and community app for pets. The following processing takes place when using the app.
4.1 Registration, login and authentication
A user account is required to use the app. We process in particular your email address, credentials in encrypted form, the time of registration and technical identifiers for session management. Emails are sent for verification and account processes (for example email confirmation or password reset).
The legal basis is Art. 6(1)(b) GDPR (provision of the user relationship) and, with regard to security measures, Art. 6(1)(f) GDPR.
4.2 User profiles
You can create a personal profile for your account, for example with a display name, username, profile picture, description and further voluntary details. Depending on your visibility settings, this data may be visible to other users. Legal basis: Art. 6(1)(b) GDPR; for voluntary additional details Art. 6(1)(a) GDPR.
4.3 Pet profiles
You can create profiles for your pets (for example name, species, breed, description, images). Information in pet profiles may indirectly relate to you as the keeper. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(a) GDPR for voluntary details.
4.4 Content, media and interactions
The following content and interactions may be processed in the app:
- posts and comments
- uploaded images, videos and other media
- profile pictures
- reactions (for example likes/paws)
- friendships and follows
- groups and communities including memberships and group content
- events and courses including participation
- private messages between users
- provider and business profiles
This processing is necessary to provide the respective feature; the legal basis is Art. 6(1)(b) GDPR. Where you voluntarily publish content publicly, Art. 6(1)(a) GDPR also applies.
4.5 Private messages
Message content is processed in order to transmit and display it between the participants. There is no analysis of message content for advertising purposes. In the context of reports and abuse prevention, reported messages may be processed for review (Art. 6(1)(f) GDPR and Art. 6(1)(c) GDPR where legal obligations apply).
4.6 Reports, moderation and safety
Users can report content and accounts. We process reports, reported content, context and metadata as well as moderation decisions in order to review and prevent unlawful conduct and violations of our rules. Legal basis: Art. 6(1)(f) GDPR (platform safety and protection of users) and Art. 6(1)(c) GDPR where legal obligations apply.
4.7 Support requests
For support requests we process the information submitted and, where applicable, account data in order to handle your request (Art. 6(1)(b) and (f) GDPR).
5. Backend infrastructure (Supabase)
We use Supabase as backend infrastructure to operate the app. Supabase is used in particular for the database, authentication, storage and the app backend. Data stored there includes account data, profile data, pet profiles, posts, media, messages, groups, events, spots and further app data.
The project's primary database, authentication service and stored files are hosted in the selected AWS Frankfurt region (eu-central-1) within the European Union. Individual processing operations required to provide the service, in particular global delivery, logging, backup or support processes, may take place elsewhere.
According to the current contractual documents, the contracting party and processor for the cloud services is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Paws & People remains the controller for personal data processed in the app; Supabase processes this data on our instructions. This processing is governed by Supabase's Data Processing Addendum under Art. 28 GDPR, which supplements its Terms of Service.
Supabase engages subprocessors to provide parts of its services, including Amazon Web Services for hosting infrastructure. As the providers used may change, the current and complete list is available at https://supabase.com/legal/customer-resources/subprocessor-list. The list also states the purpose and location of each processing activity.
Where Supabase or its subprocessors process personal data outside the European Economic Area and no adequacy decision applies, the Supabase Data Processing Addendum provides in particular for the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. Selecting the Frankfurt region limits the primary storage location but does not completely exclude third-country processing by supplementary services.
Emails related to authentication and account processes are currently handled via the Supabase infrastructure. No additional email service providers are currently used.
The legal basis is Art. 6(1)(b) GDPR (provision of the app) and Art. 6(1)(f) GDPR (secure and efficient operation).
6. Location data
Paws & People offers features that require location information. These include in particular:
- map features
- dog and cat spots
- Walking Buddy
- GPS-based walking routes
- your current position where required for a feature
- route and position points during an active recording
Location data is accessed exclusively in connection with features that require location information, and only in line with the permissions you have granted on your device. You can change or withdraw these permissions at any time in your device settings.
The legal basis is your consent given via the device permission or your use of the respective feature, Art. 6(1)(a) GDPR, as well as Art. 6(1)(b) GDPR where processing is necessary to provide the feature you selected.
7. Google Maps (in the app)
Google Maps is used for map and location features in the app. When map views are loaded, data required to display map content is transmitted to the map service infrastructure. This may include your IP address, technical device and connection data, and the location or coordinate information relevant to the map section. Transfers to third countries may occur.
The legal basis is Art. 6(1)(a) GDPR or Art. 6(1)(b) GDPR where displaying the map is necessary to provide the feature you requested.
No map is loaded on this website. No other map services are used.
8. Push notifications
The app provides for push notifications, for example about interactions, messages or events in the community. Push notifications are only sent if you have granted the corresponding permission on your device. You can disable them at any time in your system settings.
Sending notifications requires processing a device-related push token. The legal basis is Art. 6(1)(a) GDPR (consent via the device permission).
9. Distribution via app stores
9.1 Apple App Store
The app is obtained via the respective app store. When downloading the app and using store features, the store operator processes data on its own responsibility (for example account, usage and payment data). We have no influence over that processing; it takes place under the responsibility of the respective store operator.
9.2 Google Play and Google Play services
The Android version is obtained via Google Play. Where Google Play services are used for basic operating system or app functions, device and usage data may be processed under the provider's responsibility.
We do not pass user data to store operators for advertising or analytics purposes.
10. Payments and Stripe
For paid offerings (in particular premium and provider subscriptions), Stripe is intended to be used, or is used, as payment service provider. During payment processing, the data required for the payment is processed by the payment service provider, for example name, email address, billing and payment data and transaction information.
We do not store complete credit card details. As a rule we only receive the information required to perform the contract, such as the status and term of a subscription.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR for commercial and tax retention obligations.
If a purchase is made as an in-app purchase via the Apple App Store or Google Play, the payment is processed by the respective store operator. In that case their terms and privacy information apply; Stripe is not necessarily involved in such a payment.
12. Recipients and processing on our behalf
Personal data is only transferred to recipients where this is necessary to provide the service or where there is a legal basis. This concerns in particular the hosting and backend infrastructure used, map and delivery services, and payment service providers.
Where service providers process data on our behalf and on our instructions, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. Where processing takes place in third countries, this only occurs on the basis of Art. 44 et seq. GDPR, in particular an adequacy decision or appropriate safeguards such as the standard contractual clauses.
Personal data is not sold. Data is not used for advertising profiles by third parties.
13. Retention period
After account deletion has been started, the account data is kept for another 14 days and then permanently deleted. Apart from that, personal data is stored only for as long as it is necessary for the purpose for which it was collected. Longer storage only takes place where statutory retention obligations exist or other permissible reasons – such as establishing, exercising or defending legal claims, or security and abuse prevention – justify further storage.
Account-related data is generally processed for the duration of the user relationship. After an account is deleted, the associated personal data is deleted or anonymised unless one of the reasons above applies.
For accounts, the deletion period is 14 days after deletion has been started. Further category-specific periods will be added here once they have been conclusively defined.
14. Your rights
Under the GDPR you have in particular the following rights:
- access to the data processed about you (Art. 15 GDPR)
- rectification of inaccurate or completion of incomplete data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing based on legitimate interests (Art. 21 GDPR)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- lodging a complaint with a competent supervisory authority (Art. 77 GDPR)
To exercise your rights, simply send a message to pawsandppl@gmail.com. To protect your data, verification of your identity may be required.
You may lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.
15. Minors
Paws & People provides for a minimum age of 14 years. Accounts for people below this minimum age are not intended.
For users aged between 14 and 17, additional requirements for the validity of consent may apply depending on the country, such as authorisation by a holder of parental responsibility. Parents and guardians are asked to accompany use of the app.
16. Data security
This website is delivered exclusively over an encrypted HTTPS connection. Transmissions in the app are encrypted as well. We take technical and organisational measures pursuant to Art. 32 GDPR to protect personal data against unauthorised access, loss and manipulation.
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you.
17. Changes to this privacy policy
We update this privacy policy when the actual data processing, the services used or legal requirements change. The version published on this page applies.