Privacy Policy

1. Introduction

PetOS (“we” or “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, transfer, and protect Personal Data when you visit www.petos.pet; use app.petos.pet, Doki AI, dedicated booking or storefront pages; submit a contact form; subscribe to a newsletter; contact support; or use related services (together, the “Services”).

PetOS is operated from Hong Kong and handles personal data under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486). Australia’s Privacy Act 1988 and Australian Privacy Principles (APPs) may also apply when the relevant entity and Australian-link requirements are met.

By using the Services, you acknowledge that you have read this Policy. If you disagree, stop using the Services. Read this Policy together with our Terms and Conditions.

2. Who we are and the scope of this Policy

This Policy covers Personal Data for which PetOS acts as a data user, including merchant accounts, website visitors, prospects, newsletter subscribers, and support requests. It also explains the respective roles when a merchant uses our SaaS to process End Customer and pet-related data.

The Services are for pet businesses, including groomers, pet shops, boarding and hotel operators, daycare and pet sitters, trainers, pet product brands, and wholesalers.

Our data roles are:

• PetOS as data user: we determine the purposes and means of handling merchant account details, billing, website analytics, marketing communications, and support records.
• Merchant as data user; PetOS as service provider: you decide the purposes for End Customer names, contact details, pet profiles, bookings, orders, and other data you enter. We process it under your instructions and this Policy. You must give End Customers any required privacy notice and ensure a lawful basis for processing.

3. Data we collect

Depending on how you interact with us, we may collect the following categories of data.

3.1 Data you provide directly:

• Identity and account information: name, email, phone number, company or trading name, business registration details if supplied, job title, and login credentials.
• Billing information: billing address and payment-method information, usually handled by our payment provider; we generally retain only limited payment status and invoice records.
• Business configuration: branch details, services, prices, opening hours, inventory, and staff accounts.
• Communications: messages sent through forms, email, WhatsApp, support tickets, or meetings.
• Newsletter information: email address and subscription or unsubscribe preferences.

3.2 Data submitted by merchants on behalf of End Customers:

• End Customer contact and identity details, such as name, phone number, and email.
• Pet details, such as name, breed, age, weight, health or behaviour notes, and photos, depending on what you enter.
• Bookings, orders, payment status, visit history, reviews, and messages.
• Information End Customers submit through a dedicated booking or storefront page.

3.3 Technical data collected automatically:

• Device and log information, such as IP address, browser type, operating system, referring URL, access time, and pages viewed.
• Cookies and similar technologies (see Section 8).
• Usage and diagnostic data, such as feature use, error logs, and performance measures, to operate and improve the Services.
• Analytics data, such as aggregate or pseudonymous traffic statistics collected through tools including Vercel Analytics.

3.4 Sensitive information we do not actively seek: we do not ask for sensitive Personal Data unrelated to the Services. If you voluntarily enter more sensitive information in a field such as pet health notes, ensure you have a lawful basis and provide only the minimum needed for your business.

4. How we use data

We may use Personal Data to:

• Provide, operate, maintain, and improve PetOS, Doki AI, booking and storefront pages, and related features.
• Create and manage merchant accounts, verify identity, and handle subscriptions and invoices.
• Provide customer support, training, troubleshooting, and service notices.
• Send transactional messages such as security alerts, service changes, and billing reminders.
• Send product updates, newsletters, or marketing where you consent or the law permits; you may opt out at any time.
• Monitor security, prevent fraud, detect abuse, and respond to incidents.
• Analyse aggregate or anonymised data to understand usage trends and improve features.
• Meet legal obligations, respond to lawful requests, and exercise or defend legal rights.
• Enforce our Terms and Conditions and handle disputes.

5. Purposes and applicable privacy law

We handle personal data for the purposes described in this Policy. The conditions for collection, use, and disclosure depend on the applicable Australian and Hong Kong law. These activities may include:

• Performing our contract with you, including SaaS access, accounts, and support.
• Your consent, such as for non-essential marketing communications and non-essential cookies where applicable.
• Service security, product improvements, and business-to-business follow-up where permitted by applicable law.
• Complying with legal obligations.

Merchants must determine the applicable lawful basis for End Customer data in their own circumstances, such as contract performance, consent, or legitimate interests, and explain it to End Customers.

6. Sharing and disclosure

We do not sell your Personal Data. We may share it in these circumstances:

• Service providers: cloud hosting, email delivery, analytics, payment processing, and customer support providers, under contract and only as needed to provide the Services on our instructions.
• Affiliates: within the same corporate group for operations and support, where applicable.
• Business transfers: in a merger, acquisition, restructuring, or asset sale, subject to confidentiality and the principles of this Policy.
• Legal and safety needs: to comply with law, court orders, or regulatory requests, or protect the rights, property, or safety of PetOS, users, or the public.
• At your direction: for example, an integration you enable or a disclosure you request.

7. Cross-border transfers

Our Services and suppliers may be located outside Hong Kong. When Personal Data is transferred abroad, we take reasonable measures, such as contractual terms, supplier diligence, and access controls, to protect it consistently with this Policy and the PDPO. We will apply additional safeguards where required by law.

8. Cookies and similar technologies

We use cookies, pixels, local storage, and similar technologies to:

• Maintain login sessions and essential website functions.
• Remember preferences.
• Understand traffic and page performance, including through analytics such as Vercel Analytics.
• Measure advertising or remarketing if enabled in the future, in which case we will update this Policy and seek consent where required.

You can manage cookies in your browser settings. Disabling some cookies may affect the Services. Mobile applications may use similar device identifiers and SDKs.

9. Data retention

We retain Personal Data only as long as needed for the purpose for which it was collected, then delete, destroy, or reasonably anonymise it unless law requires or permits longer retention, such as for accounting, disputes, or security.

• Account and subscription data: while the account is active and for a reasonable time after it ends, including for settlement and legal retention.
• Support and communication records: usually up to 24 months after resolution, or longer if a dispute is involved.
• Newsletter data: until you unsubscribe or the account is deleted.
• Logs and security records: usually for a shorter rolling period unless an investigation requires more time.
• Merchant Content, including End Customer data: primarily controlled by the merchant. After termination, we may delete it after a reasonable grace period under the Terms and this Policy, except for legal or backup copies.

10. Security measures

We use reasonable technical and organisational safeguards, including transport encryption such as HTTPS, access controls, least-privilege permissions, log monitoring, and supplier management. Internet transmission and electronic storage cannot be guaranteed absolutely secure. You should protect passwords, use available security features, and limit staff access.

If a security incident may affect your Personal Data, we will assess it under applicable law and notify you and/or regulators when required.

11. Your rights

Under the PDPO and applicable law, you may have the right to:

• Access Personal Data we hold about you.
• Ask us to correct inaccurate Personal Data.
• In certain circumstances, ask for deletion or restricted processing, subject to legal and contractual needs.
• Withdraw consent without affecting processing already carried out on that basis.
• Opt out of marketing messages using an email unsubscribe link or by contacting hello@petos.pet.
• Make a complaint about Personal Data, including to Hong Kong’s Privacy Commissioner for Personal Data.

To exercise a right, email hello@petos.pet with enough information for us to verify your identity. We may charge a reasonable fee or refuse manifestly unreasonable or repetitive requests where the law permits.

If you are an End Customer whose data is handled by a pet business through PetOS, contact that merchant first. We may assist when authorised by the merchant or required by law.

12. Children and minors

The Services are primarily for business and merchant users and are not directed at children. We do not knowingly collect Personal Data from people under 16 as merchant account holders. If you believe we collected a child’s data in error, contact us so it can be deleted.

13. Marketing communications

We may send merchant contacts product updates, business guides, or promotions. You can unsubscribe at any time. Transactional or necessary service messages, such as security and billing notices, may not be covered by a general marketing opt-out.

14. Third-party websites

The Services may link to third-party websites or services. Those parties have their own privacy practices. We are not responsible for their content or conduct, so please review their privacy policies.

15. Automated decisions and analytics

We may use analytics and, where applicable, limited automated tools to detect abuse, improve the product experience, or generate aggregate insights. We do not currently make fully automated decisions that have a significant legal effect on you. If this changes, we will update this Policy and provide information or choices required by law.

16. Updates to this Policy

We may update this Privacy Policy and publish the latest version and “Last updated” date on this page. We will give reasonable notice of material changes, such as a website notice or email. Please review this page periodically.

17. Australia privacy information

If the Privacy Act and APPs apply, individuals may seek access to and correction of personal information and make a privacy complaint, subject to legal exceptions. The APPs also address overseas disclosure and require an APP entity to explain its likely overseas disclosures in its privacy policy.

PetOS is operated from Hong Kong; Australian information may be handled by our Hong Kong team and the service providers described above. Whether a transfer is an overseas disclosure, and any required safeguards, depend on the actual data flow and applicable law.

Email hello@petos.pet for an access, correction, or complaint request. You may also contact the Office of the Australian Information Commissioner (OAIC) where the Privacy Act applies.

18. Contact and privacy enquiries

For questions, requests, or complaints about this Policy or our handling of Personal Data, contact:

• Email: hello@petos.pet (general enquiries) or support@petos.pet (support).
• Phone: (+852) 6218 4442.
• Address: 1039, 10/F, Building 19W, 19 Science Park Avenue West, Pak Shek Kok, New Territories, Hong Kong.
• Website: www.petos.pet.

You may also raise concerns with Hong Kong’s Privacy Commissioner for Personal Data at www.pcpd.org.hk.