Privacy Policy

In short. We collect what the Platform needs to work: your account, your dogs, your bookings and your messages. We do not sell personal data, we show no advertising and we use no tracking cookies. A Center you link to sees your records, and its own privacy practices then apply to what it uses. You can ask us at any time to see, correct, export or erase your data. This box is a reading aid; the articles below are what count.

Who we are

1. The Platform is published by SPLURB (“SPLURB”, “we”, “us”), a company registered in France (RCS Grenoble). Our full details and our contact address are in Publisher and hosting. This Privacy Policy explains how we handle personal data as a data controller, that is, when we decide why and how the data is used.

2. We have not appointed a data protection officer. Write to us with any question about your data.

3. This policy goes with the Terms of Use and, for Centers, the Terms of Sale. The words “Platform”, “Center”, “Dog Owner”, “Visitor” and “Public Page” have the same meaning as in the Terms of Use.

Who decides what

Three situations must be kept apart, because they do not have the same controller:

1. Your account is ours. We are the controller of the data of your account: your profile, and, for a Dog Owner, your dogs, their vaccination records and certificates. We keep it for you and we share it with the Centers you link to.

2. A Center is responsible for what it does with your records. When you link your account to a Center, it gets access to your records and becomes the controller of what it uses and records about you: your bookings, its notes, its conversations with you, its invoices. Its own privacy information applies to that use, and you exercise your rights over it with the Center. For those Center records, we act as the Center’s processor, on its instructions.

3. A Visitor’s chat belongs to the Center that receives it. We provide the tool and store the messages on the Center’s behalf.

For everything else described below, whether it concerns you as a Dog Owner, a Visitor or a member of a Center’s team, SPLURB is the controller.

What we collect

From everyone who visits

• Technical data. Our servers and hosting log the technical details of each request: IP address, date and time, the address requested, the response, the browser and device type. We use it to keep the Platform running and secure.
• Visits to Public Pages. We count visits to a Center’s Public Page for the Center’s statistics, without cookies and without keeping a profile of you. The IP address and browser details are turned into a hash, salted with a secret that changes every day and for each Center, and used only to count a visitor once. That hash and its salt are deleted after two days. What remains is a counter per Center, per day and per traffic source (search engine, social network, direct, and so on), with the referring website reduced to one of a few categories. No visit is linked to an account, a booking or a message. Visits made by a Center’s own team are not counted.
• Our marketing website (pandacal.app) uses no cookies, no analytics and no advertising tools.

From Dog Owners

• Your account: first and last name, email address, password (kept only as a salted hash, never in clear), phone number, postal address and photo if you give them, preferred language, and the date on which you accepted the Terms.
• Your dogs: name, sex, whether neutered, birth date and photo if you give them; for each vaccine, the dates and the certificate you upload (file, type, size and name); the status of the dog (active, removed, deceased).
• Your links to Centers: which Centers your account is linked to, how the link began (invitation link, search, booking or message) and its status.
• Your bookings: the Center, the service, the dates and times, the dogs, the price, your note to the Center, the Center’s decision and its reason if it declines.
• Your messages with Centers, the discovery visits you book, and the reviews you write (rating, comment).
• Your payments, when you pay online: the amount, the status of the hold, charge or refund, the card brand and its last four digits, and whether a wallet was used. Your card number is entered on Stripe’s page and never reaches us.
• Your settings: notification preferences and, if you turn push notifications on, the address of your browser’s push service with its keys and a label for the device.
• Suggestions: the name and city of a Center you ask us to add, with your account.

From Visitors who use the chat

The text of your messages, a random token stored in your browser (we keep only its hash) that recognises your conversation, and, if you give it, your email address and your language.

From Center users

• Your account: the same account data as above, your role in the Center (owner or manager), and, if you are invited, the email address the owner typed and the hash of the invitation link.
• Your Center’s details: name, address, phone, public email, legal name, SIRET, VAT number and regime, insurance, hours, services and prices, photos. For a sole trader, part of it is personal data.
• Your Subscription: your Stripe customer identifier and the state of your Subscription. Your payment card, and the identity checks of your Stripe account for online payments, are handled by Stripe.
• Addresses you look up: the text you type in the address field, which we send to Google’s address search.
• Your use of the back-office, as needed to run it (who confirmed which booking, for example).

From your correspondence and from others

• Support. If you write to us, we keep your message and our reply.
• Emails. We keep a technical record of the emails we send, to send them once, to apply sending limits and to honour unsubscribes. The body of an email is deleted once it has been sent. If you unsubscribe, we keep a hash of your address so that we do not write to you again.
• Data we receive from others. A Center may enter information about you: a booking it creates by hand, or your dog’s details. A Center owner may give us your email address to invite you to its team.

We do not ask for your location, and the Platform does not track it. We do not need sensitive personal data such as your own health data, and we ask you not to put it in messages or notes. The vaccination records of a dog are information about an animal, linked to its owner.

Why we use it, and on what basis

1. Required or optional. The name, email address and password of an account are needed to create it; without them we cannot provide the Platform. Everything else is optional unless a Center needs it to accept a booking.

2. No selling, no advertising. We do not sell or rent personal data and we do not use it for advertising or profiling. At the date of this policy we send no marketing emails. If that changes, we will do it in line with the law and tell you.

3. No automated decisions. We take no decision that produces legal effects on you based solely on automated processing. Statuses such as “vaccination expired” are calculations that a person at the Center reviews.

Who sees your data

1. The Centers you link to, as described in the Terms of Use: your name and contact details, your dogs, their vaccination status and certificates, and your bookings and messages with that Center. Certificates are private and are shown only to you and to those Centers.

2. A Center’s team, for the Center’s own data: the owner and managers.

3. The public, only what you or a Center chose to publish: a Center’s Public Page, and a review. A review is shown with your first name, the initial of your last name and your dogs’ names; your photo and account details are never shown.

4. Our service providers (processors), who act on our instructions to host and run the Platform:

   Provider	What for	Where
   Clever Cloud SAS	Hosting of the application, of the website and of the files	France
   Supabase	Database	European Union (Paris region)
   Resend	Sending of emails (addresses and the content of the emails)	United States
   Google Ireland Ltd.	Address search for Centers	Ireland, and the United States
   Browser push services (Apple, Google, Mozilla, Microsoft)	Delivery of the push notifications you turned on	Worldwide

5. Stripe. Stripe Payments Europe, Ltd. processes payments and our Subscription billing. For payments, verification and fraud prevention, Stripe is a controller in its own right, and its own privacy policy applies.

6. Authorities, and other parties as the law requires: a court, an administration or the police, when a valid request obliges us; and a company that takes over the Platform, under the same commitments.

7. Our own people. Only administrators of SPLURB reach the administration console, for support, security and billing.

Transfers outside the European Economic Area

Our main hosting and our database are in France and in the European Union. Some providers are established in the United States or use servers outside the EEA (see the table above). In that case the transfer relies on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on the Commission’s standard contractual clauses, with additional measures where needed. You can ask us for a copy of these safeguards.

How long we keep it

After these periods, we erase the data or make it anonymous so that it no longer identifies anyone. Copies in technical backups, if there are any, disappear in their normal rotation.

Cookies and similar technologies

1. We use no advertising cookie and no analytics tracker. In your browser, the web app stores only what it needs to work for the service you asked for, and this does not require your consent:

   • your sign-in token, in the tab’s session storage, or, if you tick “Keep me signed in”, in the browser’s local storage, valid for 24 hours;
   • your language choice;
   • a draft booking, kept in the tab while you are on Stripe’s page to pay, and removed when you sign out;
   • the token of your chat with a Center, created when you send your first message;
   • dismissals of notices, per browser.

   You can delete these items in your browser’s settings; you will then be signed out.

2. Google Fonts. The web app (sign-in, back-office, dog owner app and Public Pages) displays its typeface from Google Fonts: your browser downloads the font files from Google’s servers, which therefore receive your IP address and browser details. Our marketing website hosts its own fonts and makes no such request.

3. Google Maps. A Public Page may show an embedded Google map, loaded by your browser from Google. Google may set its own cookies and process your data under its own policy.

4. Stripe. The payment pages you are sent to belong to Stripe, which uses its own cookies and similar technologies.

5. “Book a demo” on our marketing website opens a booking page of TidyCal, a third party. Its own policy applies from that point.

6. Push notifications are off until you accept the request of your browser. You can stop them at any time in your browser or in the app’s settings.

Security

We protect the data with measures that fit the risk, including: hosting in France and the European Union; encryption of connections; passwords kept only as salted hashes; separation of Centers, so that a user can reach only the data of their own Center; private storage of vaccination certificates and invoices, which are never served from a public address; limits on repeated requests; and administrative access limited to what the work requires. No system is perfectly secure. If a breach is likely to put your rights at risk, we tell the CNIL within 72 hours, and we tell you without undue delay when the risk is high.

Your rights

1. You have the right to access your data and to get a copy of it, to have it corrected, to have it erased, to restrict its use, to object to a use based on our legitimate interest, and to receive the data you gave us in a structured, commonly used format (portability). Where a use is based on your consent, you may withdraw it at any time. You can also give us instructions on what should happen to your data after your death.

2. How. You can correct most of your data yourself in the app: your profile, your dogs, your notification preferences and your language. For anything else, or to close your account, write to us at the address in Publisher and hosting. We may ask you to prove your identity. We answer within one month, which the law lets us extend by two months for complex requests, in which case we tell you. It is free unless a request is manifestly unfounded or excessive.

3. Erasing your account. Closing an account is done at your written request. When we erase it, we erase what is linked to it: your profile, dogs, links to Centers, bookings, conversations and reviews. Invoices already issued to you are kept for the legal period, in a form that no longer links to your account. A Center may keep records it is required by law to keep for its own accounts.

4. Data held by a Center. If your request concerns what a Center holds as a controller, contact the Center. If you write to us instead, we pass your request on to it.

5. Complaint. If you think we do not respect your rights, you can complain to the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr), or to the authority of your country.

Children

The Platform is not meant for anyone under 18, and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

Changes to this policy

We may update this policy, for example when we add a feature or a provider. We tell you by email or in the Platform, in good time, of any change that affects you substantially. The version and the date are at the top of the page.

Contact

For any question about this policy or your data, write to us at the address in Publisher and hosting.

• Terms of Use →
• Terms of Sale for centers →