Privacy Policy

1. Introduction

Welcome to Bondly — your personal assistant for managing your pet's health and care.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and what rights you have in connection with the processing of your data.

2. Data Controller

The data controller is SMART-TRADE Wojciech Kalemba, ul. Dywizjonu AK Jeleń 7A, 00-712 Warszawa, Poland, tax ID (NIP) 7922143987, the operator of the Bondly app, available at bondly.pet and in the App Store and Google Play.

For data protection matters, you can contact us at: hello@bondly.pet or in writing at the controller's address.

The controller has not appointed a Data Protection Officer.

3. Data We Collect

3.1. User Account Data

• Email address (required for login)
• Name (optional)
• Profile photo (optional)
• Password (encrypted, not accessible to us)

3.2. Pet Profiles

• Pet's name
• Species and breed
• Date of birth / age
• Sex
• Microchip number (optional)
• Pet photos (optional)
• Weight history

3.3. Health Data

• Vaccination records (type, date, serial number, veterinarian, clinic)
• Veterinary visit history (date, diagnosis, treatment, costs)
• Medications (name, dosage, schedule, administration history)
• Parasite protection (products, dates administered)
• Medical notes

3.4. Events and Reminders

• Calendar events (appointments, walks, feeding)
• Notification settings
• Event history

3.5. Daily Routines

• Routine templates (feeding schedules, walks)
• Task completion status
• Fulfillment history

3.6. Sharing Data

• Pet profile sharing invitations
• Access permissions
• Roles (owner, co-owner, caregiver)

3.7. Technical Data

• Push notification tokens
• Device platform (iOS/Android)
• Application version
• Crash reports (Crashlytics)
• Anonymous usage events (Firebase Analytics)

3.8. Subscription Data

• Bondly Pro subscription status (active / inactive, plan type)
• Your RevenueCat user identifier, linked to your account once logged in
• Transaction data provided by the App Store / Google Play (e.g. purchase date, renewal date, product identifier)

We do not store and do not have access to your payment card data — payments are handled exclusively by Apple and Google.

3.9. Badges, Points and Daily Reward

• Badges earned and the date each was earned
• Points total and level
• Streak and the dates the daily reward was claimed
• Progress counters (e.g. number of weight entries recorded, articles read)
• Your daily reward reminder setting
• Streak freezes (how many you hold and when they were used)
• Referral program: your referral code, how many people used it, the code you joined with and whether the referral counted. The referrer only sees numbers, never who used their code

This data is calculated automatically from your activity in the app. It is visible only to you; we do not share it with other users or partners and do not use it for marketing profiling. You can switch the feature off anytime in your profile in the app (Badges and points) — we then stop collecting this data.

Once a day we compute aggregate badge statistics (e.g. what share of carers hold a badge) to show how rare a badge is. They contain numbers only, with nothing that could identify anyone.

4. Purpose of Processing

We collect data exclusively to:

• Enable use of the app and its features
• Manage user and pet profiles
• Store and organize pet health data
• Send notifications about events and reminders
• Share information with selected users
• Ensure security and data protection
• Diagnose technical issues and improve app quality
• Display advertising content from Bondly and app partners (e.g. pet and veterinary brands) — non-personalised, or, with your consent, personalised based on your pets' data (section 6.3)
• Send advertising push notifications — only with your consent (section 6.3)
• Document consents given and withdrawn
• Run the badges, points and daily reward programme

5. Legal Basis

We process your personal data based on:

• Contract performance (Art. 6(1)(b) GDPR) — provision of app services: account, pet profiles, pet health data, reminders, sharing, Bondly Pro subscription
• Consent (Art. 6(1)(a) GDPR) — personalising advertising content based on your pets' data and advertising push notifications (section 6.3)
• Legitimate interest (Art. 6(1)(f) GDPR) — security and app improvement, crash diagnostics, displaying non-personalised advertising content, aggregated campaign statistics, documenting consents, and establishing, exercising or defending legal claims

6. Who We Share Data With

6.1. External Services

Firebase (Google LLC)

• Firebase Authentication — account management
• Cloud Firestore — app database
• Firebase Storage — photo storage
• Firebase Crashlytics — crash reports
• Firebase Analytics — anonymous usage data
• Server location: EU
• Privacy policy: https://firebase.google.com/support/privacy

Expo Services

• Expo Notifications — push notification delivery
• Expo Updates — app updates

RevenueCat (RevenueCat, Inc.)

• Manages in-app subscriptions and purchases (Bondly Pro)
• Receives: your user identifier (your Firebase UID once logged in, otherwise an anonymous identifier), transaction data provided by the App Store / Google Play, and subscription status
• Has no access to your payment card data — this is processed exclusively by Apple and Google
• Privacy policy: https://www.revenuecat.com/privacy

Apple Inc. / Google LLC

• Process payments for the Bondly Pro subscription through the App Store / Google Play, in accordance with their own privacy policies

6.2. Sharing With Other Users

Your pet's data may be shared with other users only when you explicitly invite them to share the pet's profile. You can revoke access at any time.

6.3. Advertising Content and Personalised Offers

Without your consent we show advertising content that is the same for all users. We do not use data about your pets to select it.

With your consent (“Personalised offers”) we select advertising content based on the following information about your pets:

• species, breed and sex of the animal,
• age of the animal (calculated from its date of birth),
• current weight of the animal (as a range, e.g. 10–20 kg),

and the app language.

For personalising offers we do not use information about animal health or about your use of Bondly's health features, in particular data on vaccinations, medications, veterinary visits, diseases, allergies or deworming, or any other information you enter in connection with your animal's health.

With a separate consent (“Offer notifications”) we send advertising push notifications.

Legal basis. The legal basis for processing personal data to personalise advertising content is Art. 6(1)(a) GDPR — consent. Advertising push notifications are additionally sent in compliance with the prior consent requirement under Art. 398 of the Polish Electronic Communications Law.

Partners do not receive your personal data. Personalisation takes place exclusively within Bondly's systems. A partner receives only aggregated campaign statistics (number of impressions, clicks and dismissals), which are not provided in a way that allows the partner to identify users. Partners do not receive information about the characteristics of the audience. We do not create audiences of fewer than 20 people. Links in ads do not contain your account identifier. Once you go to a partner's website, the partner's privacy policy applies.

Profiling. Personalising offers constitutes profiling within the meaning of Art. 4(4) GDPR. This profiling serves solely to choose which advertising content may be shown to the user. It is not used to make decisions producing legal effects concerning the user or similarly significantly affecting them, and it does not constitute automated decision-making within the meaning of Art. 22 GDPR.

Right to object to direct marketing. Where we process your personal data for direct marketing purposes, including profiling related to such marketing, you have the right to object to such processing at any time (Art. 21(2) GDPR). You can object in the app under Settings → Privacy & offers or by writing to hello@bondly.pet. Once you object, we will stop processing your data for this purpose.

Retention. We use data to personalise offers until you withdraw consent, object, or delete your account. Records documenting the granting, change and withdrawal of consent (type of consent, text version, date, source, platform, app version) are kept for 6 years from the last consent-related event — including after account deletion — based on our legitimate interest in demonstrating lawful processing and in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR). After this period the records are deleted.

Withdrawing consent is possible at any time under Settings → Privacy & offers, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.

6.4. What We Don't Do

• ❌ We don't sell your data
• ❌ We don't track your location
• ❌ We don't integrate with social media
• ❌ We don't share personal data with advertising partners
• ❌ We don't use your pet's health data for advertising

6.5. Transfers Outside the European Economic Area

Some of our providers (Google LLC, RevenueCat, Inc., 650 Industries, Inc. — Expo) are based in the United States, so your data may be transferred outside the EEA. Such transfers are based on the European Commission's adequacy decision (EU-US Data Privacy Framework) for recipients certified under it, or on standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to hello@bondly.pet.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Connection encryption (HTTPS/TLS)
• Password encryption (Firebase Authentication)
• Firebase security rules (access only to own data)
• Token-based authorization
• Regular backups
• User-level access control

8. Your Rights (GDPR)

In accordance with GDPR, you have the following rights:

8.1. Right of Access

You can obtain information about what data we process and receive a copy thereof.

8.2. Right to Rectification

You can correct or update your data in profile settings.

8.3. Right to Erasure (“Right to be Forgotten”)

You can delete your account and pet profiles at any time. All associated data will be permanently deleted from our systems, except for the record of consents given and withdrawn, which we keep for the period stated in section 6.3.

8.4. Right to Data Portability

You can request export of your data in a structured format (JSON).

8.5. Right to Restrict Processing

You can request restriction of processing your data under certain circumstances.

8.6. Right to Object

You can object to processing of your data based on legitimate interest (Art. 21(1) GDPR). You can object to direct marketing, including related profiling (Art. 21(2) GDPR), at any time — see section 6.3.

8.7. Right to Withdraw Consent

You can withdraw your consent to personalised offers and advertising push notifications at any time in the app under Settings → Privacy & offers, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.

8.8. Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority if you believe that the processing of your data violates GDPR provisions.

9. Data Retention

We store your personal data:

• Account data — until account deletion
• Pet profiles — until pet profile deletion
• Health data — until pet profile deletion
• Events — until deleted by the user
• Badges, points and streak — until the account is deleted
• Data used for personalised offers — until consent is withdrawn, you object, or the account is deleted
• Consent records — 6 years from the last consent-related event (also after account deletion)
• Ad impression and click statistics — until the account is deleted; aggregated campaign statistics do not allow users to be identified
• Backups — up to 30 days after deletion (for security)

10. Children's Data

The application is intended for adults (18+). If you are a parent or legal guardian and discover that your child has provided us with personal data without your consent, please contact us to delete such data.

11. Cookies and Tracking Technologies

The Bondly mobile app does not use cookies, advertising identifiers (IDFA/GAID) or other tracking technologies for advertising purposes. Personalised offers (section 6.3) are based solely on data about your pets stored in Bondly, without tracking your activity in other apps or websites.

We only use local data storage (AsyncStorage) to remember app settings and login sessions.

The bondly.pet website does not use cookies for advertising purposes. Session cookies necessary for the website to function may be used.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes via:

• Notification in the app
• Email to your address
• Update to the “Last updated” date at the top of this document

We recommend regularly reviewing this Privacy Policy.

13. Contact

If you have questions about this Privacy Policy or want to exercise your rights, please contact us:

• Email: hello@bondly.pet
• Form: “Feedback” section in the app

We will respond to your inquiry within 30 days.