Privacy Policy

1. Introduction

International Pet Registry ("IPR," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our website at internationalpetregistry.net and related services (the "Service").

This policy is designed to comply with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable data protection laws worldwide.

By using the Service, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not use the Service.

2. Information We Collect

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Service: Register pets, facilitate microchip searches, process transfers, maintain medical records, operate the lost-and-found system.
• Process payments: Charge registration fees, subscriptions, and transfer fees through Stripe.
• Communicate with you: Send registration confirmations, transfer notifications, lost pet alerts, service updates, and respond to support inquiries.
• Ensure security and prevent fraud: Detect and prevent fraudulent registrations, unauthorized access, and abuse of the platform.
• Improve the Service: Analyze usage patterns, debug issues, and develop new features.
• Legal compliance: Comply with applicable laws, regulations, and legal processes, including responses to lawful government requests.
• Professional directory: Display professional listings for shelters, vets, breeders, and government agencies who opt in to the public directory.

4. Legal Basis for Processing (GDPR Article 6)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data under the following legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to fulfill our contract with you, including account creation, pet registration, payment processing, and service delivery.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate interests, including fraud prevention, security, service improvement, and platform integrity, where these interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with legal obligations, including tax reporting, regulatory compliance, and responses to lawful requests from authorities.
• Consent (Art. 6(1)(a)): Where we rely on your consent (e.g., for optional analytics cookies, marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Vital Interests (Art. 6(1)(d)): In exceptional cases, processing necessary to protect the vital interests of an animal (e.g., emergency contact for a lost or injured pet).

5. Information Sharing & Disclosure

We do not sell your personal information. We share your information only in the following circumstances:

• Public Microchip Search: When a microchip number is searched, we display the owner's contact information based on the owner's privacy settings (see Section 6). By default, only the pet's name and a masked contact method are shown.
• Linked Professionals: If you link your pet's profile to a veterinarian, shelter, or breeder, those professionals can view your pet's information and, in the case of veterinarians, medical records.
• NAAR Subscribers: Authorized professional accounts with an active NAAR subscription can access NAAR records. Pet owner personal information is not shared through NAAR.
• Service Providers: We share data with third-party service providers who assist in operating the Service, including Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Hostinger (email). These providers are bound by data processing agreements and are prohibited from using your data for their own purposes.
• Legal Requirements: We may disclose information when required by law, subpoena, court order, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, prevent fraud, or ensure user safety.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such transfer and any choices you may have regarding your data.

6. Owner Privacy Controls

IPR gives pet owners granular control over what information is displayed when their microchip is searched. Owners can toggle the visibility of:

• Full Name: Show or hide your full name in search results.
• Phone Number: Show or hide your phone number in search results.
• Email Address: Show or hide your email address in search results.

Even when contact information is hidden, users who find a lost pet can use the IPR platform to send a notification to the registered owner without seeing the owner's actual contact details. These privacy settings can be changed at any time from your account dashboard.

7. International Data Transfers

IPR operates globally and may transfer your personal data to countries outside your country of residence, including the United States. When we transfer data from the EEA, UK, or Switzerland to countries that have not received an adequacy decision from the European Commission, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data processing agreements with all sub-processors that include equivalent protections.
• Supplementary technical and organizational measures, including encryption in transit and at rest.

You may request a copy of the safeguards we use for international data transfers by contacting us at privacy@internationalpetregistry.net.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law:

• Account Data: Retained for the duration of your account plus 2 years after account closure (to facilitate pet recovery if needed).
• Pet Registration Data: Retained for the lifetime of the pet or as long as the registration is active. Microchip registrations are intended to be permanent records.
• Medical Records: Retained for 7 years after the last entry, or longer as required by applicable veterinary regulations.
• Payment Records: Retained for 7 years to comply with tax and financial reporting requirements.
• NAAR Records: Retained indefinitely, as the registry is designed as a permanent record of animal abuse.
• Usage Data: Aggregated usage data is retained indefinitely. Identifiable usage data is retained for 26 months.
• Support Communications: Retained for 3 years after resolution.

When data is no longer needed, it is securely deleted or anonymized in accordance with our data disposal procedures.

9. Your Rights Under GDPR

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right of Access (Art. 15): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate personal data.
• Right to Erasure (Art. 17): You have the right to request deletion of your personal data, subject to certain exceptions (e.g., legal obligations, NAAR records).
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Restriction (Art. 18): You have the right to request restriction of processing in certain circumstances.
• Right to Object (Art. 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority.

We will respond to valid requests within 30 days. In complex cases, we may extend this period by an additional 60 days with prior notice. We may request identity verification before processing your request.

10. Your Rights Under CCPA/CPRA

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You have the right to know what personal information we collect, use, disclose, and sell about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: IPR does not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit how we use sensitive personal information.

To exercise these rights, contact us at privacy@internationalpetregistry.net or submit a request through your account settings. We will verify your identity before processing requests. Authorized agents may submit requests on your behalf with proper documentation.

Categories of Personal Information Collected (last 12 months): Identifiers, personal information per Cal. Civ. Code § 1798.80(e), internet or network activity, geolocation data, professional information, and inferences drawn from the above.

11. Your Rights Under PIPEDA

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) grants you the following rights:

• Access: You have the right to access the personal information we hold about you.
• Correction: You have the right to request correction of your personal information.
• Withdrawal of Consent: You may withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
• Complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

We obtain meaningful consent for the collection, use, and disclosure of personal information. The form of consent (express or implied) depends on the sensitivity of the information and the reasonable expectations of the individual.

12. Children's Privacy (COPPA)

IPR is not directed to children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at privacy@internationalpetregistry.net so we can take appropriate action.

Users between 13 and 18 years of age may use the Service only with the involvement and consent of a parent or legal guardian.

13. Cookies

We use cookies and similar tracking technologies to operate and improve the Service. For detailed information about the cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy.

14. Security Measures

We implement industry-standard technical and organizational security measures to protect your personal data, including:

• Encryption of data at rest and in transit (TLS 1.3).
• Row-Level Security (RLS) policies in our database.
• Role-based access controls.
• Regular security assessments and monitoring.
• Secure authentication with bcrypt password hashing.

For comprehensive details about our security practices, please see our Security & Compliance page.

15. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by GDPR Article 33).
• Notify affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34).
• Notify affected California residents as required by California Civil Code § 1798.82.
• Document all breaches and remedial actions taken.

Notifications will include the nature of the breach, the categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address the breach.

16. Data Protection Officer

IPR has designated a Data Protection Officer (DPO) to oversee compliance with data protection regulations. You may contact the DPO at:

• Email: dpo@internationalpetregistry.net
• Subject: Data Protection Inquiry

The DPO is responsible for monitoring compliance with GDPR, other data protection laws, and our internal data protection policies. The DPO serves as the point of contact for data subjects and supervisory authorities.

17. How to Exercise Your Rights

You may exercise your data protection rights by:

• Email: Send a request to privacy@internationalpetregistry.net.
• Account Settings: Use the privacy and data management tools available in your account dashboard.
• Mail: Send a written request to International Pet Registry, Attn: Privacy Team, via the contact address on our website.

We will respond to all valid requests within 30 days (or within the time frame required by applicable law). We may require identity verification before processing your request to protect your privacy and prevent unauthorized disclosure of personal data.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date and provide notice through the Service or via email.

We encourage you to periodically review this page to stay informed about our privacy practices. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy.