Privacy Notice

This notice explains what personal data Pawport processes, why, and the rights you have. It covers this website (pawport.app) and the Pawport account experience (configuring a pet, requesting quotes, booking, uploading documents, messaging, and reviews). It describes what the product actually does today; where a fact depends on a pending company decision it is shown in [brackets].

1. Who we are

Pawport is operated by [COMPANY LEGAL NAME], [LEGAL FORM], registered office [REGISTERED OFFICE ADDRESS], registered under [COMPANY REGISTER AND REGISTRATION NUMBER] ("Pawport", "we", "us"). For privacy questions or to exercise your rights, email [PRIVACY CONTACT EMAIL].

2. The pre-login site

Browsing the public pages (the landing, corridor and breed guides, the cost pre-check, and the learn articles) does not require an account. When product analytics is enabled, we keep an anonymous per-browser identifier in your browser's local storage to understand the pre-login funnel (which guides and steps people use); it is not tied to your name and is not used for advertising. Analytics is off until it is configured, and this notice will name the analytics provider and its region here when it is: [ANALYTICS PROVIDER, REGION, AND RETENTION TO BE CONFIRMED AT REVIEW].

3. Signing in

Sign-in is passwordless. We email you a magic link that is valid for a short period and can be used once; sign-in tokens and session tokens are stored hashed, so the plain values exist only in the email we send you and in your browser. Signing in sets a first-party session cookie (pawport_session for pet owners, pawport_supplier_session for transporters) that keeps you signed in. These are strictly necessary and set no advertising or cross-site trackers.

4. Configuring a pet and requesting quotes

To match you with transporters we process the pet profile you build (species, breed, size and travel-relevant traits), your move (origin, destination, dates, and preferences), and your contact details. This is used to compute eligibility and to broadcast your request to matched, vetted transporters so they can quote. Legal basis: steps taken at your request prior to a contract, and our legitimate interest in operating the marketplace (GDPR Art. 6(1)(b) and (f)).

5. Booking, payment, and escrow

When you accept a quote we take payment and hold it in escrow, releasing it to the transporter after delivery is confirmed. Card payment is processed by our payment provider (Stripe); we do not store your full card number. We keep the booking, the amounts, and an immutable ledger of the escrow movements as the financial record of the transaction. Legal basis: performance of the contract, and compliance with our legal and accounting obligations.

6. Documents you upload

Travel documents you upload (for example a vaccination record or health certificate) are stored in private object storage and are readable only through short-lived signed links. We derive deterministic validity checks from the dates you enter against your route's rules. An optional feature that reads a document to pre-fill those dates is off until it is configured; when it is enabled, this section will state what is sent to it. Documents can contain data about you and your veterinarian; we process them solely to help you assemble a compliant move.

7. Messaging and reviews

Messages you exchange about a move are stored so you and your transporter (and, where needed, a Pawport coordinator) can see the thread. A review you leave after a completed, paid move is published with the move's route, travel mode and transporter; reviews come only from real bookings.

8. Who processes data for us

We rely on a small set of providers acting on our instructions: payment processing (Stripe), transactional email (Resend, with Brevo as a failover), cloud application hosting, our database, and object storage for uploaded documents. [FULL PROCESSOR LIST WITH LOCATIONS AND SAFEGUARDS TO BE CONFIRMED AT REVIEW.] We do not sell personal data, we run no advertising, and we do not use your data to train models.

9. International transfers

A pet move is cross-border by nature, and some providers may process data outside your country. [TO BE COMPLETED WITH THE CONFIRMED PROCESSOR LIST: processing locations and, for any transfer outside the EEA or UK, the safeguard relied on (adequacy decision or Standard Contractual Clauses).]

10. How long we keep data

• Magic-link tokens: short-lived and single use.
• Sessions: until they expire or you sign out.
• Bookings, ledger entries, and reviews: retained as the record of the transaction, [RETENTION PERIOD TO BE CONFIRMED].
• Uploaded documents: [DOCUMENT RETENTION PERIOD TO BE CONFIRMED].
• Account data: for the life of the account, then as required by law.

11. Your rights

Where the GDPR or UK GDPR applies, you have the right to access, correct, and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Write to [PRIVACY CONTACT EMAIL]. You can also complain to a supervisory authority; the lead authority is [SUPERVISORY AUTHORITY, PER PLACE OF ESTABLISHMENT].

12. Children

The service is for adults arranging the transport of their own animals and is not directed at children.

13. Changes and contact

We update this notice when the product's data flows change, and the date above with it. Privacy: [PRIVACY CONTACT EMAIL]. General: [GENERAL CONTACT EMAIL]. Postal: [COMPANY LEGAL NAME], [REGISTERED OFFICE ADDRESS].