Privacy Policy

Last updated: 10 October 2026

This Privacy Policy explains how OnlyPaw ("we", "us", "our") collects, uses, shares, and protects your personal information when you use our mobile applications, websites, and related services (collectively, the "Service"). By using the Service, you agree to the practices described here.

1. Who we are

OnlyPaw is operated by OnlyPaw Inc., whose incorporation in the State of Delaware, USA is in progress. Our team works from the United Arab Emirates and we serve users worldwide. For privacy questions, contact us at [email protected].

2. Information we collect

2.1 Information you provide

• Account information: name, email, phone number, password (hashed), profile photo.
• Identity verification (providers): government-issued ID, selfie, home photos, background-check information where applicable.
• Pet information (customers): name, breed, age or birth date, weight, medical notes, special needs, and — if you use the Pet Passport — the pet health records and documents you add (see section 2.4).
• Payment information: we use Stripe to process payments. We do not store full card numbers on our servers; Stripe stores them in accordance with PCI DSS requirements.
• Communications: messages exchanged through the in-app chat, support tickets, reviews you write.

2.2 Information collected automatically

• Device data: device model, operating system, IP address, push notification tokens.
• Location data: approximate or precise location for nearby provider search, walk GPS routes, and pet-taxi tracking, where you grant permission.
• Usage data: screens viewed, features used, crash reports, performance metrics.

2.3 Provider identity and tax details

If you offer services as a provider, we ask for identity and tax details that depend on the country where you work: the type, number and expiry date of your identity document and images of it; your date of birth and address where required; your business details if you work as a business; and your tax identification number(s) where required (for example a TIN, SSN/ITIN, EIN, National Insurance number, UTR, or VAT/TRN number). We use them to verify your identity and to meet tax and reporting obligations in the countries where OnlyPaw operates, including digital-platform reporting rules. Identity numbers, tax IDs, date of birth and address are stored encrypted; the app only shows a masked version, and only authorised OnlyPaw staff can view a full value, with every access logged. We share these details with tax authorities only where the law requires it, and keep them for as long as the applicable tax and reporting laws require.

2.4 Pet Passport (pet health records)

If you use the Pet Passport, we store the pet health records and documents you add: your pet's birth date, microchip number, your regular vet's name, phone and address, vaccinations (dates, clinic, batch number and notes), flea, tick and worming treatments, allergies, medications, weight history, photos of vaccine cards, and test documents such as blood and urine tests, X-rays and other imaging, allergy tests, vet reports and prescriptions. We use them to show your pet's passport, to send the vaccine and treatment reminders (push and email — you can turn them off in Notification Preferences → Pet health reminders) and to share them only in the ways described here.

AI reading. When you ask the app to read a vaccine card or to summarise a test document, the photo or document is sent to our AI service provider, Anthropic, which processes it on our behalf to read the vaccine details or to write a short plain-language summary. What it reads only pre-fills the form: nothing is saved until you check and confirm it. Summaries describe only what is on the document and are not medical advice — ask your vet about results.

Who can see it. Your pet's passport is private to you. A provider can see your pet's vaccinations and whether they are up to date, flea, tick and worming treatments, allergies, medications, microchip number, regular vet contact and weight only once you have a confirmed booking with them, and only until that booking is completed or cancelled. Test documents, their AI summaries and vaccine-card photos stay private unless you turn on "Share with provider" for a specific document — and even then only a provider with a confirmed booking that hasn't ended can open it. If you create a share link, anyone who has the link can view the passport (and only the documents you ticked for that link) until the link expires or you turn it off; the page never shows your address, phone number or email. Authorised OnlyPaw staff can view passports to give support and keep the Service safe; every document they open is logged.

Deleting. You can edit or delete any record, document or AI summary in the app at any time. Deleted items disappear straight away from your passport, from providers' view and from your share links. To have them erased from our systems as well, email [email protected].

3. How we use your information

• To create and maintain your account.
• To match customers with providers, process bookings, and facilitate payments.
• To verify provider identity and run background checks where applicable.
• To send transactional notifications (booking confirmations, payment receipts, support replies).
• To send the pet vaccine and treatment reminders you can turn off in the app.
• To detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service.
• To improve the Service through aggregated, anonymised analytics.
• To comply with legal obligations.

4. How we share your information

We do not sell your personal information. We share it only as follows:

• With other users as required by the Service: a customer's first name and pet profile is shared with a provider when a booking is confirmed (for the Pet Passport, see section 2.4 for exactly what a provider can see and for how long); a provider's name, photo, services, and reviews are visible to customers searching for those services.
• With service providers (sub-processors) who help us run the Service: Stripe (payments), Resend (transactional email), Supabase (database hosting), Cloudflare R2 (file storage), Sentry (error logging), Expo (push notifications), Anthropic (AI reading of vaccine cards and summaries of pet documents you ask for). Each is bound by a data processing agreement.
• With tax authorities — a provider's identity and tax details and earnings, only where tax or digital-platform reporting law requires it (see section 2.3).
• With law enforcement or regulators when required by valid legal process or to protect the rights, safety, or property of OnlyPaw, our users, or the public.
• With a successor entity in connection with a merger, acquisition, or sale of assets — under equivalent privacy commitments.

5. How long we keep your information

We retain account data for as long as your account is active and for up to 7 years after closure for tax, fraud-prevention, and dispute-resolution purposes. Identity-verification documents are deleted within 90 days of a provider being approved or rejected, unless retention is required by law. You may request earlier deletion as described in Section 7.

6. Security

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for sensitive fields (passwords are bcrypt-hashed; SSNs are encrypted), least-privilege access controls, and audit logging. No system is impenetrable; in the event of a data breach affecting your personal information, we will notify you and the relevant authorities in accordance with applicable law.

7. Your rights

Depending on your jurisdiction (UAE Federal Data Protection Law, GDPR, CCPA, etc.) you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data, subject to retention obligations.
• Withdraw consent for optional processing (e.g., marketing).
• Receive a portable copy of your data.
• Object to or restrict certain processing.
• Lodge a complaint with a data-protection authority.

To exercise these rights, email [email protected]. We will respond within 30 days.

8. Children

OnlyPaw is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with information, contact us and we will delete it.

9. International transfers

We may transfer your information outside the country you reside in. When we do, we rely on appropriate safeguards including standard contractual clauses and adequacy decisions.

10. Cookies and tracking

Our website uses essential cookies to keep you logged in and remember your preferences. Optional analytics cookies help us understand how the Service is used. See our Cookie Policy for details.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. The "Last updated" date at the top reflects the most recent revision.

12. Contact

Privacy questions: [email protected]
General support: [email protected]