Privacy Policy

Last updated: 4 September 2026  ·  Effective: 13 August 2026

1. Introduction

Pawlio ("we", "us", "our") is a mobile application that connects pet owners with pet care providers — grooming salons and veterinary offices — and helps manage bookings and pet profiles. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Romanian data protection law.

Data controller: Pawlio  ·  Contact: support@pawlio.ro

2. Information We Collect

Pet owners (clients):

• Name and profile photo
• Email address and/or phone number
• Pet information (name, breed, size, notes, photos, and microchip number if you provide it)
• Pet health information you choose to provide — including a vaccination expiry date and a vaccination proof photo, and, for veterinary bookings, the visit reason, symptom notes, and any symptom photos you submit. Note that a vaccination proof image may contain your own personal data (for example, your name on a certificate).
• Booking details and history
• Subscription and purchase information, if you subscribe to Pawlio Plus (processed by Stripe, or by Apple's App Store for purchases made on iOS)

Providers (grooming salons / veterinary offices):

• Business name, location, and contact details
• Services, pricing, and availability
• Staff profiles and business hours
• Subscription and purchase information (processed by Stripe, or by Apple's App Store for purchases made on iOS)

Collected automatically:

• Device information and identifiers (including push-notification token)
• Approximate or precise location, where you grant permission
• Usage data, log data, and crash/performance diagnostics

3. How We Use Your Information

• Create and manage your account
• Enable and manage bookings between clients and providers
• Send booking confirmations, reminders, and service notifications
• Provide customer support
• Improve, secure, and troubleshoot the app
• Comply with legal obligations

4. Legal Bases for Processing

We process your personal data under the following GDPR legal bases:

Purpose	Legal basis (GDPR Art. 6)
Account creation and bookings	Performance of a contract (Art. 6(1)(b))
Reminders and service notifications	Performance of a contract / legitimate interest (Art. 6(1)(b)/(f))
App improvement, security, diagnostics	Legitimate interest (Art. 6(1)(f))
Marketing communications (if any)	Consent (Art. 6(1)(a))
Legal and tax obligations	Legal obligation (Art. 6(1)(c))

5. Data Sharing & Processors

We do not sell your personal data. We share it only as necessary:

• With providers, to fulfil the bookings you make (and with clients, for provider accounts). Where a provider requires proof of vaccination, your pet's vaccination status and proof photo are shared with that provider for the booking.
• With the service providers below, who process data on our behalf under data-processing agreements
• Where required by law or to protect the rights and safety of users

Processor	Purpose	Transfer mechanism
Supabase	Database, authentication, storage	EU hosting / SCC
Firebase (Google)	Push notifications, crash & performance reporting	SCC
Stripe	Subscription billing on Android and web (Pawlio Plus and provider plans)	SCC
Apple (App Store)	In-app purchase & subscription billing on iOS	SCC
Zoho Mail (EU)	Transactional & support email	EU hosting
Apple / Google	Sign-in authentication	SCC
Google Calendar (optional; provider-connected)	Two-way calendar sync — reads busy times and writes appointment details to the provider's own calendar	SCC / Google API Services User Data Policy

Google Calendar (optional, provider accounts). If a provider connects their Google Calendar, Pawlio accesses the calendars they choose in order to (a) read busy times so we do not offer clients slots the provider is unavailable for, and (b) write their confirmed Pawlio appointments — including the client's name, pet, service, time and any notes — as events on those calendars. We request only the calendar.events and calendar.calendarlist.readonly scopes, store the access token encrypted, never read calendars the provider has not mapped, and stop all access when they disconnect. Pawlio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. International Transfers

Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCC) or an equivalent safeguard to ensure your data receives an adequate level of protection.

7. Data Retention

We retain your personal data for as long as your account is active. When you delete your account, your personal data is permanently erased, except where we are required to retain certain records (for example, billing records) to comply with legal obligations.

8. Your Rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate or incomplete data (Art. 16)
• Request erasure of your data (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)

You can access and correct most of your data directly in the app, and you may delete your account at any time in Settings → Delete Account. For any other request, contact support@pawlio.ro.

9. Security

We use encryption in transit, access controls, and other technical and organisational measures to protect your personal data. No method of transmission or storage is completely secure, but we work to protect your information at all times.

10. Children's Privacy

Pawlio is not intended for persons under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app. Continued use of the app after the changes take effect constitutes acceptance of the updated policy.

12. Contact & Complaints

For any question about this policy or to exercise your rights:
Email: support@pawlio.ro

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro, or with your local data protection authority.