Privacy policy

1. Who we are (Data Fiduciary)

This policy is issued by FLUFFYPET CARE PRIVATE LIMITED ("FluffyPet", "we", "us", "our"), a Private Limited Company (limited by shares) incorporated in India on 17 November 2023, CIN U96092JH2023PTC021537, with registered office at 4C-RAM, Sitakunj Apartment, Ranchi University, Ranchi 834008, Jharkhand, India. Under the DPDP Act 2023 we are the Data Fiduciary for personal data processed through the FluffyPet platform - including https://fluffypet.care, https://jobs.fluffypet.care and https://investor.fluffypet.care.

For privacy questions write to privacy@fluffypet.in. Grievance Officer details are in §13.

2. Scope

This policy applies to all personal data processed through our consumer apps, provider/vet/clinic/NGO/breeder/seller workspaces, the investor site, the jobs portal, our APIs, support channels, and any FluffyPet-branded service. It applies to data principals located in India and, on a best-effort basis, to non-resident users who interact with us.

3. Personal data we collect

• Account & identity: name, email, phone, password hash, profile photo, role (owner / vet / clinic admin / provider / NGO / breeder / seller / volunteer / staff).
• Pet profile & medical: species, breed, age, sex, microchip ID, vaccination history, prescriptions, lab results, surgical notes, allergies, dietary needs, behaviour notes.
• Location: coarse geolocation for provider-matching and SOS/welfare workflows; precise location only with explicit per-session consent.
• Bookings & commerce: service appointments, hostel stays, marketplace orders, payment metadata (we do not store full card numbers; payment processors handle PCI scope).
• Role-specific credentials: for vets, clinics, breeders and labs we collect council/registration numbers, GSTIN/PAN, premises proof and licence documents for KYC and trust signals.
• Communications: in-app chat, support tickets, call logs (when you call our support line), reviews and ratings.
• Device & usage: IP, device model, OS, app version, crash logs, page/feature analytics (first-party only).
• Welfare reports: photos, descriptions and location of stray, injured or distressed animals submitted to our NGO/SOS workflow.

4. Lawful bases under the DPDP Act

We process personal data only on the following lawful bases recognised by the DPDP Act 2023:

• Consent - freely given, specific, informed, unambiguous and capable of withdrawal at any time, captured at signup and per sensitive action (e.g. sharing a medical record with a third-party vet).
• Legitimate use - for example to perform a booking you initiated, to issue a vaccination reminder you opted into, to comply with a legal obligation, or for medical emergencies involving the pet's life.

5. Consent & withdrawal

Consent requests are presented in clear language at the point of collection in English and supported Indian languages. You may withdraw consent for any specific processing from in-app settings or by emailing privacy@fluffypet.in. Withdrawal does not affect the lawfulness of processing before withdrawal and may limit features (e.g. you cannot share a medical record with a vet without sharing consent).

6. Your rights as a Data Principal

Under the DPDP Act 2023 you have the right to:

• access a summary of personal data we process about you;
• correct, complete or update inaccurate or incomplete data;
• erase data no longer required for the purpose it was collected;
• nominate another individual to exercise rights in case of death or incapacity;
• raise a grievance with our Grievance Officer (§13) before approaching the Data Protection Board of India.

We respond to verified requests within 30 days. Identity verification is required to prevent unauthorised disclosure.

7. Sharing with third parties

FluffyPet does not sell personal data. We share data only with:

• Veterinarians, clinics, hostels, providers and labs - only the records you explicitly share for a booking or referral, on a per-share consent basis with an audit trail.
• Payment processors (e.g. Razorpay, Stripe-India equivalents) for transaction execution; we receive only metadata.
• Insurers - only when you initiate a claim or a policy purchase, and only the data fields the insurer needs.
• NGOs and welfare partners for SOS reports you submit; reporter contact data is shared only if you opt in.
• Sub-processors for hosting, email, SMS, analytics and customer support, under written contracts requiring DPDP-equivalent safeguards.
• Authorities when compelled by valid legal process; we publish an annual transparency note.

8. Cross-border transfers

Personal data is primarily processed on infrastructure located in India. Where a sub-processor operates from a country outside India, transfers are made only to jurisdictions not restricted by the Central Government under the DPDP Act and under contractual safeguards.

9. Retention

We retain data only for as long as needed:

• Account & pet profile - for the life of the account, then 90 days.
• Medical records - minimum 7 years after the last interaction (clinical record-keeping norms).
• Transaction records - 8 years (Companies Act and tax record requirements).
• Support tickets - 24 months.
• Analytics & device logs - 13 months, then aggregated/anonymised.
• Welfare reports - until case closure plus 24 months.

10. Security

We use encryption in transit (TLS 1.2+), encryption at rest (AES-256) for medical and identity fields, role-based access controls and database row-level security, audit logs for every record access, environment isolation and the principle of least privilege for staff access. We aim to align operational practices with ISO/IEC 27001. No system is perfectly secure; we will notify the Data Protection Board and affected data principals of personal data breaches without undue delay as required by law.

11. Children

FluffyPet services are intended for users aged 18 and above. We do not knowingly create accounts for children. Where a parent or guardian uses FluffyPet for a household pet and a child interacts with the service, processing is conducted under verifiable parental consent and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, in accordance with §9 of the DPDP Act.

12. Cookies & analytics

We use first-party cookies and local storage for session management, preferences and aggregated analytics. We do not use third-party advertising trackers or cross-site behavioural profiling. You can clear cookies from your browser at any time.

13. Grievance Officer

In line with DPDP Act §8(10) and the IT (Intermediary Guidelines & Digital Media Ethics Code) Rules 2021:

Officer

Grievance Officer, FLUFFYPET CARE PRIVATE LIMITED

Email

grievance@fluffypet.in

Address

4C-RAM, Sitakunj Apartment, Ranchi University, Ranchi 834008, Jharkhand, India

Acknowledgement SLA

Within 72 hours

Resolution SLA

Within 30 days of receipt

14. Updates & versioning

We will publish material changes on this page and notify active users by email or in-app banner with at least 14 days' notice. Continued use after the effective date constitutes acceptance of the revised policy. Prior versions are archived on request.