1. Who we are
PetPort.cloud is operated by NHD Lifestyle Pvt. Ltd., a company incorporated in India and headquartered in Vadodara, Gujarat. For the purposes of India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), NHD Lifestyle Pvt. Ltd. acts as the Data Fiduciary for personal data processed through PetPort, and you (or the pet parent on whose behalf data is entered) are the Data Principal.
This policy applies to every PetPort surface: the Pet Parent app (Expo, iOS and Android — the only Pet Parent client), the Vet Clinic / Pet Business / Shelter web ERPs and their staff companion apps, our Super Admin console, and public pages such as a pet's lost-pet QR profile or a memorial tribute page. Where a public page (e.g. a scanned tag profile) is viewed by someone without a PetPort account, this policy still governs how any data they submit — such as a “found this pet” contact message — is handled.
2. Data we collect
We collect only what is needed to run the features you use. Depending on which product you use and which consent toggles you leave on, this can include:
Account & contact information
Name, phone number, email address, household/family member details, authentication data (OTP, passkey or Google sign-in identifiers via Better Auth), and business details (company name, GST/registration info, verified role) for clinic, business and shelter accounts.
Pet health & identity records
Vaccination history, medical records and diagnoses, prescriptions and medication schedules, weight and growth logs, breed information, blood group (for the donor registry), and the pet's Pashu Aadhaar / tag identity used for lost-pet alerts.
Photos & documents
Pet photographs, uploaded medical documents, insurance policy documents and claim attachments, and any file you upload to your pet's Lifebook or timeline. Files are uploaded directly to Google Cloud Storage (asia-south1, Mumbai) via short-lived pre-signed URLs and served through Google Cloud CDN.
Location data
Approximate or precise location when you report a lost pet or respond to a “found” alert, check in at a pet-friendly place, or use a clinic/business/shelter's address-based features. We do not track your background location; it is captured only at the moment you use a location-based feature.
Payment & billing data
Subscription plan, billing cycle and transaction status. Card, UPI and bank details are collected and processed directly by our payment processor, Razorpay — PetPort stores only the payment reference, amount (in paise) and status returned by Razorpay, never your full card or bank credentials.
Communications data
Appointment reminders, lead alerts and (where you opt in) promotional messages sent via the Meta WhatsApp Cloud API; transactional and marketing email sent via Resend; and in-app notifications. We keep delivery/read status for these messages.
Consent & access records
Every consent you grant or withdraw, and every accept/reject decision on a record a clinic or groomer adds to your pet, is written to an append-only consent log. A separate append-only log records who accessed your data and why, viewable by you as “Who has accessed my data.”
Usage, device & cookie data
App/device information, crash diagnostics (Sentry), product usage analytics (PostHog), and essential cookies for session, locale and security purposes. See “Cookies & tracking” below.
3. How we use your data — and your granular controls
PetPort's “My Data” screen lets every pet parent see and toggle each purpose we process data for, one at a time, with plain-language descriptions. In line with the DPDP Act, optional purposes are never pre-checked — you opt in deliberately, and can withdraw at any time with no effect on the core service. A small set of purposes are required to operate your account at all (marked below); withdrawing those means closing your account instead.
Required for the platform to function
Letting a verified clinic or groomer add records to your pet (subject to your per-record verification — see Invariant 4 below); letting a business verify records you entered yourself; and utility WhatsApp messages such as appointment reminders and lead alerts.
Optional — you choose
PetPort product updates and newsletters; offers from verified partner businesses; promotional WhatsApp messages; sharing pet data with insurance partners to generate quotes; personalized shop recommendations; participating in community features such as lost-pet alerts and memorial tributes; anonymized usage analytics; letting verified breeders find your pet for mating enquiries; contributing anonymized data to veterinary research; and anonymized rabies/vaccination data shared with government public-health partners (see our public Transparency Log).
4. Our obligations under the DPDP Act, 2023
As Data Fiduciary, PetPort processes personal data only for the specific, clearly stated purpose you consented to (purpose limitation), collects only what that purpose requires (data minimisation), and gives you clear notice in your own language before processing begins wherever practicable.
Consent requests are specific and unbundled — you can accept one purpose and decline another — and no optional consent is ever pre-checked on your behalf. You can withdraw any optional consent as easily as you gave it, from the “My Data” screen, and withdrawal takes effect immediately.
Where a clinic, groomer or other business wants to add a record to your pet's file, that record stays in a pending state until you verify or reject it — no third party can write to your pet's record without your review (Invariant 4).
5. Your rights as a Data Principal
Subject to the DPDP Act and its rules, you have the right to:
Access a summary of your data
Request a summary of the personal data we hold and the processing activities carried out on it, and request a full machine-readable export (“Download my data”) — we prepare this as a package and email you a secure download link, typically within 24 hours.
Correct or erase your data
Correct inaccurate or incomplete personal data directly in the app, or request erasure of data no longer needed for the purpose it was collected for. Note that quota-exceeding content on the Free tier is blurred and locked, never silently deleted — see our Terms of Service.
Withdraw consent, any time
Withdraw any optional consent from the “My Data” screen without affecting the lawfulness of processing carried out before withdrawal.
Nominate someone
Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity, as provided under the DPDP Act.
Grievance redressal
Raise a grievance with our Grievance Officer (details below) and receive a response within the timeline required by law. If you are not satisfied, you may escalate your complaint to the Data Protection Board of India.
Close your account
Request account deletion at any time. We soft-delete your account for 30 days (in case of accidental requests or fraud investigation) and then irreversibly anonymize the remaining personal identifiers, while append-only logs required for audit and legal compliance are retained in anonymized form.
6. Who we share data with
We do not sell personal data. We share data only with the following categories of recipients, and only as needed to provide the service or where you have consented:
Verified clinics, groomers, boarding facilities, trainers and shelters
Only for pets you have connected to that business, and only after your verification of any record they add (Invariant 4).
Payment processing — Razorpay
To process subscription payments and UPI Autopay mandates. Razorpay is a PCI-DSS compliant payment processor operating in India.
Messaging & email — Meta WhatsApp Cloud API, Resend
To deliver reminders, alerts and (where you opt in) marketing messages by WhatsApp and email.
Cloud infrastructure — Google Cloud Platform, Neon, Upstash, Vercel
For database hosting (Neon PostgreSQL, asia-south1 Mumbai), file storage and CDN (Google Cloud Storage/CDN, asia-south1), caching/queueing (Upstash Redis, Mumbai) and application hosting (Vercel, Expo EAS).
AI processing — Anthropic Claude API, Google Vertex AI (Gemini)
To power PetBot's breed identification and probabilistic health-suggestion features. As required by Invariant 16, PetBot never provides a diagnosis — only general, educational suggestions with an explicit “consult a vet” disclaimer.
Government & research partners
Only fully anonymized, aggregated data (for example rabies-vaccination coverage statistics), only where you have opted in to the relevant consent category, and only ever published on our public Transparency Log.
Legal & safety
Where required to comply with a legal obligation, court order or lawful request from a government authority, or to protect the rights, property or safety of PetPort, our users or the public.
7. Cross-border data processing
Our primary database, file storage and cache are hosted in the asia-south1 (Mumbai) region. However, some of our processors — notably Google Vertex AI, Anthropic's Claude API, Meta's WhatsApp Cloud API and Vercel's edge network — operate infrastructure that may process data outside India as part of their global service delivery.
The DPDP Act permits such transfers except to countries specifically restricted by the Central Government. We only send the minimum data each processor needs to perform its function (for example, PetBot sends only the specific query and relevant pet context, not your full profile).
8. Data retention
We retain personal and pet data for as long as your account is active and for a reasonable period after account deletion (30-day soft-delete window) as described above. Financial records (invoices, ledger entries) are retained for the period required by Indian tax and accounting law.
Append-only records — consent events, data-access logs and ledger entries — are never updated or deleted (our database enforces this with triggers), and are retained to meet audit and legal-evidence requirements even after an account is anonymized.
9. Children's data
PetPort accounts are intended for adults (18 years or older) who are responsible for a pet, or for authorized staff of a registered business. We do not knowingly collect personal data directly from children. Where a household account includes a family member who is a minor, the account-holder adult is responsible for that minor's use and for any consent given under the DPDP Act's provisions for processing children's data. If you believe a minor has created an independent account, please contact us so we can take appropriate action.
10. Security
We use encryption in transit (TLS) and at rest, role-based access control, tenant isolation at the database layer, and rate limiting on every API to reduce abuse. Payment data never touches our servers in raw form — it is handled directly by Razorpay.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by the DPDP Act and its rules.
11. Cookies & tracking
Our web portals use essential cookies for session authentication and to remember your chosen language (the NEXT_LOCALE cookie), and, where you do not opt out, analytics cookies via PostHog and error monitoring via Sentry to help us fix bugs and understand feature usage in aggregate. Our mobile apps do not use browser cookies but use equivalent local storage for the same purposes.
12. Changes to this policy
We may update this Privacy Policy from time to time as our products, processors or the law evolves. We will post the revised policy here with an updated “last updated” date, and where a change is material we will notify you in-app or by email before it takes effect.
13. Grievance Officer & contact
For any privacy question, data-rights request, or grievance under the DPDP Act, please contact our Grievance Officer: NHD Lifestyle Pvt. Ltd., Vadodara, Gujarat, India — info@petport.cloud. We aim to acknowledge every grievance promptly and resolve it within the timelines prescribed by law.