Privacy Policy

PupperWalk ("we", "our", "us") operates the PupperWalk mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and other applicable data protection laws.

1. Data Controller

The data controller is Winners Media Limited (company number 08173436), trading as PupperWalk. Registered address: Wood & Disney Ltd, Lodge Lane, Langham, Colchester, England, CO4 5NE. For enquiries, contact us at [email protected].

2. What Data We Collect

Account Data

• Full name
• Email address
• Phone number (optional)
• Profile photo (optional)
• Business name and logo (dog walkers)
• Password (encrypted, never stored in plain text)

Client & Dog Data

• Client names, addresses, phone numbers, email addresses
• Dog names, breeds, allergies, behavioural notes, feeding instructions, emergency contacts, microchip numbers, photos

Walk Data

• Walk start and end times
• Walk duration
• Walk updates (text messages and photos)
• Dog mood indicators
• GPS coordinates and route data (when GPS tracking is enabled)
• Walk distance

Location Data

• When GPS tracking is enabled by the dog walker, we collect foreground location data during active walks only
• Location is captured approximately every 15–30 seconds during a walk
• We do NOT track location when the App is closed or in the background
• We do NOT track client (dog owner) location at any time
• GPS tracking can be disabled by the walker in their profile settings

Communication Data

• Messages between walkers and clients
• Photo attachments in messages
• Client replies to walk updates (Pupdates)

Waiver Data

• Digital signatures (typed name)
• Timestamp of signature
• Waiver content at time of signing

Technical Data

• Device type and operating system
• App version
• Timezone
• Push notification token (for delivering notifications)
• Crash reports and error logs (via Sentry, anonymised — no message content or personal data included)

3. How We Use Your Data

We process your data for the following purposes:

Purpose	Legal Basis (GDPR Art. 6)
Providing the dog walking management service	Performance of contract
Sending walk updates to dog owners	Performance of contract
GPS tracking of walk routes	Legitimate interest (proof of service) + Consent
Push notifications	Consent
Subscription billing	Performance of contract
Waiver collection and storage	Legitimate interest (liability protection)
Messaging between walkers and clients	Performance of contract
Account security and authentication	Legitimate interest
Service improvement	Legitimate interest

4. GPS Location Data — Specific Disclosure

What we track: Latitude, longitude, and timestamp during active walks when GPS is enabled.

Why: To provide proof of walk distance and route to dog owners, and to create walk reports.

Who sees it: The dog walker and their clients only. We do not share location data with any third party.

How to control it: Dog walkers can disable GPS tracking at any time in Profile → Availability → GPS Walk Tracking. When disabled, no location data is collected and no route/distance information is shown to clients.

Retention: GPS route data is stored for as long as the walk record exists. You can delete walk records or your entire account at any time.

5. Data Sharing

We share your data only with:

Recipient	Purpose	Data Shared
Supabase (database provider)	Data storage and authentication	All app data (encrypted at rest)
Expo (push notifications)	Delivering push notifications	Device push token and notification content
Stripe (payments)	Subscription billing	Email, payment method (we never see full card numbers)
Sentry (error monitoring)	Crash reporting and performance monitoring	Device type, OS version, app version, error stack traces (no personal content)
Apple/Google (app stores)	App distribution	Standard app store analytics

We do NOT sell, rent, or trade your personal data to any third party for marketing purposes.

6. Data Retention

• Active accounts: Data is retained for the duration of your account.
• Walk data: Retained for 2 years after the walk date, then automatically anonymised.
• Messages: Retained for 1 year after the last message in the conversation.
• Deleted accounts: All personal data is deleted within 30 days of account deletion. Some anonymised data may be retained for analytics.
• Waiver signatures: Retained for the duration required by applicable law (typically 6 years for contractual records in the UK).

7. Your Rights (GDPR)

You have the right to:

• Access your personal data (see Data Export in the App)
• Rectify inaccurate data (edit your profile and dog details)
• Delete your account and all associated data (Profile → Delete Account)
• Restrict processing in certain circumstances
• Port your data to another service (see Data Export)
• Object to processing based on legitimate interest
• Withdraw consent at any time (e.g., disable GPS tracking, disable notifications)

To exercise any right, contact [email protected] or use the in-app controls.

8. Data Security

We implement appropriate technical and organisational measures:

• All data encrypted in transit (TLS/HTTPS)
• Database encrypted at rest
• Authentication via secure tokens
• Row-level security ensuring users only access their own data
• Passwords hashed using bcrypt
• Regular security updates

9. International Transfers

Your data is processed on servers in the EU (London, eu-west-2 region). If data is transferred outside the EEA, appropriate safeguards are in place (Standard Contractual Clauses).

10. Children's Data

The App is not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately.

11. Changes to This Policy

We may update this policy. Material changes will be notified via the App. Continued use after notification constitutes acceptance.

12. Complaints

You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

13. Contact

[email protected]