Privacy policy

1. Who is responsible

Data controller

IGNIRA TECHNOLOGIES S.L. (PawAI)

Spanish tax ID (NIF)

B-23957723

Registered address

Avenida Fernando Arce, 10, 39300 Torrelavega, Cantabria, Spain

Privacy contact

[email protected]

We are not required to appoint a Data Protection Officer and have not appointed one. Requests are handled at the address above.

2. What we collect

Account data

Name, email address, password (always stored as a hash, never in the clear), language, country, weight unit and, if you use "Continue with Google", the identifier Google returns to us.

Pet data

Name, species, breed, sex, neuter status, birth date (exact or approximate), weight and target weight, activity level, weight history, feeding plans and logs, treats, reminders, health events and any notes you write.

Photos

The images you upload of your pet, its food or its food label, along with the technical metadata of the file. These are your personal data because they are tied to your account.

Generated results

Body condition estimates, calorie needs, portion sizes, food safety checks, reports and beauty cards, with the date and the model that produced them.

Payment data

Your Stripe customer and subscription identifiers, plan, status, dates and amounts. We never receive or store your card number — Stripe handles it directly.

Technical and usage data

IP address, user agent, session identifier, pages viewed, in-app actions, error logs and logs of AI model calls (without the contents of your photos).

Consent records

A record of your choices: acceptance of this policy, marketing consent and cookie choices, with their date. The law requires us to be able to prove them.

Account data and pet data are required to provide the service: without them we cannot create your account or calculate anything. Everything else is optional and not giving it to us does not stop you using PawAI.

We do not process special categories of data (GDPR art. 9). Your pet's health data is not your health data — data protection law protects people, not animals. We still treat it with the same care.

3. Why we use it, and on what legal basis

Where the basis is consent, you can withdraw it at any time without affecting the lawfulness of what came before. Where the basis is legitimate interest, we have balanced that interest against your rights, and you can object by writing to us.

About audience measurement: we do it with Umami on our own servers, without cookies, without storing anything on your device and without sharing it with anyone. You do not need to write to us to object: you can switch it off yourself from the cookie preferences panel, and the "Reject all" button switches it off too. If you have an account, usage events are linked to it and are deleted when you delete the account.

4. Artificial intelligence and automated decisions

To estimate body condition, read a pet food label or check whether a food is safe, we send the photo and the pet data to Google Gemini models. Google acts as our processor and, under its paid API terms, does not use that content to train its models.

These estimates are automated, but they do not produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR art. 22: they are guidance about an animal, not decisions about a person. You can correct any input and recalculate, and you can always check the result with your vet.

Body condition result screens state that the estimate was generated by artificial intelligence.

5. Who we share it with

We do not sell your personal information. We disclose it only to the providers we need in order to run the service, each under a data processing agreement (GDPR art. 28):

We may also disclose data to authorities and courts where the law requires it, and to legal or accounting advisers bound by professional secrecy.

6. International transfers

Hosting, the database and your photos are in the European Union. Some of the providers above are established in the United States, so international transfers take place.

Those transfers rely on the EU-US Data Privacy Framework adequacy decision where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with supplementary measures. You can ask us for a copy of those safeguards at [email protected].

7. How long we keep it

We keep each type of data for the period shown in section 3. When you delete your account we erase your data and your photos, except for:

• Payment transaction records, which we anonymise and keep as amounts only, for the mandatory commercial and tax periods.
• A minimal record of the deletion itself (the date, whether you asked for it or we carried it out, and how much data was removed), which we keep for 3 years. It contains neither your email nor your name: your identity is reduced to a code that cannot be read and that only serves to answer you if you ever ask whether we deleted you. The period matches the limitation period for GDPR infringements (art. 78 LOPDGDD), which is how long that proof could be demanded of us. Once it is over, the record deletes itself.
• The record of your consents, which we keep with that same unreadable identity and for that same period, because the law requires us to be able to prove you gave them (GDPR art. 7.1).
• Backups, which are overwritten within 30 days at most.

8. Your rights

You can exercise, free of charge and at any time, your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given.

• In the app: Profile → Privacy and data, where you can download your data, change your email preferences and delete your account.
• Without an account, or for anything else: request an export of your data or write to [email protected].

We answer within one month, extendable by two more for complex requests, and we will tell you if that happens. If you are in the EU and think we handled your request badly, you can complain to your national supervisory authority — in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

9. Children

We require you to be at least 16 to open an account, and you confirm it when you register. That is deliberately above the legal minimums: 14 in Spain (art. 7 LOPDGDD) and 13 in the United States (COPPA). We do not direct the service at anyone younger and do not knowingly collect their data.

If we find we have collected a child's data without the required authorisation, we delete it. If you believe that has happened, write to [email protected] and we will sort it out.

10. Security

We apply technical and organisational measures proportionate to the risk: encryption in transit (HTTPS), passwords stored with strong hashing, role-based access control, logging of administrative access, backups, and minimisation of personal data in technical logs. No online service can guarantee absolute security. If a breach occurred that put your rights at risk, we would tell you and notify the authority under GDPR arts. 33 and 34.

11. Notice for United States residents

This section supplements the rest of the policy for people using PawAI from the United States, in line with the California Online Privacy Protection Act (CalOPPA).

Categories of information collected

Identifiers (name, email, IP address, device and payment customer identifiers), commercial information (purchases and subscriptions), content you upload (photos and pet data), internet activity within our service, and inferences generated by the models.

Who it is shared with

The providers listed in section 5, always on our instructions and to run the service.

Sale and cross-context behavioural advertising

We do not sell personal information for money. If you accept the advertising cookie category, the Meta and TikTok pixels receive data that California law may treat as "sharing" for cross-context behavioural advertising. Declining that category in the banner, or from the Cookie policy, stops it.

Do Not Track signals

Browsers can send a "Do Not Track" (DNT) signal. There is no common standard for responding to it and PawAI does not respond to DNT signals. The effective control is the cookie banner: advertising does not load without your consent, and audience measurement is switched off from that same panel.

How to exercise your rights

Through the same channels as section 8. We handle access, correction and deletion requests regardless of your state, and we never treat anyone worse for making one.

Effective date and changes

The date of the latest revision appears at the bottom of this page. Material changes are announced on the site and, where they affect you substantially, by email.

12. Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version at this same address with its date, and if a change affects you substantially we will tell you by email or in the app before it takes effect.