PawShield Privacy Policy

⚠️ IMPORTANT — NOT YET LEGALLY REVIEWED

This is a comprehensive draft written by an engineer who knows what data the product actually collects and how it flows. It is not legal advice and has not been reviewed by a lawyer. Before publishing:

1. Have a Canadian privacy lawyer (ideally one who knows PIPEDA + Quebec

Law 25 + CASL) review this end-to-end.

1. Confirm all third-party processor names and data-handling claims

match your actual contracts (Supabase DPA, Cloudflare DPA, SendGrid BAA-equivalent, Twilio DPA).

1. Update jurisdiction (default Ontario) if you incorporate elsewhere.
2. If any EU/UK residents could sign up, you also need GDPR/UK GDPR

compliance — the rights section below covers the major ones but needs a lawyer's eye.

Everything below is a starting point, not a final document.

Last updated: 2026-04-23 Effective date: (set when published)

1. Who we are

PawShield is a smart pet identification service operated by [Legal company name, e.g. "PawShield Inc." or "[Your name] operating as PawShield"] ("PawShield," "we," "us," or "our"). Our registered address is [mailing address] and our primary contact is privacy@pawshieldpet.net.

This Privacy Policy explains what information we collect when you use our products (smart pet tags, the PawShield website, the owner dashboard, the public scan pages) and how we handle that information.

If you have questions about this policy or want to exercise any of your privacy rights, email us at privacy@pawshieldpet.net.

2. Who this policy applies to

Three groups of people interact with PawShield, and we collect different information from each:

2.1 Pet owners (customers)

You create an account, buy one or more physical tags, and set up profiles for your pets. We collect the most information from this group because you're giving us the most — an account, contact details, and pet information you want the service to act on.

2.2 Finders (strangers who scan a tag)

When someone scans a PawShield tag they find in the wild, they see the pet's profile page. They don't need an account. We collect minimal information about them — only what's necessary to notify the owner and document the scan for the owner's records.

2.3 Visitors (people browsing the marketing site)

People visiting pawshieldpet.net without scanning a tag or signing up. We collect basic server logs. Nothing more.

3. What we collect

3.1 From pet owners

When you create an account and use the dashboard, we collect:

Account information:

• Your name (first name at minimum; you choose what to provide)
• Your email address
• Your phone number (optional — only required if you opt in to SMS alerts)
• A password you choose (which we store as a hash — we never see or

store your actual password)

Pet profile information:

• Your pet's name
• Your pet's species (dog, cat, or other)
• Breed (optional)
• Photo of your pet (optional but encouraged)
• Medical notes (allergies, medications, vet contact — optional)
• A custom message shown to finders (optional, e.g. "I'm friendly!

Please call my owner")

Notification preferences:

• Whether you want email alerts
• Whether you want SMS alerts
• Whether you want push notifications to your browser / phone
• Which devices you've enabled push notifications on (browser, user agent,

date you enabled them)

• The cooldown period between alerts

Home location (optional):

• If you choose to set a "home" location for your pet (used to display

"X miles from home" on scan alerts), we store the latitude and longitude coordinates you provide.

Technical data collected when you use the service:

• The IP address you connect from (hashed before storage — we never

keep your raw IP)

• User agent string (your browser + operating system)
• Session cookies required for you to stay signed in
• Timestamps of key actions (sign-up, sign-in, settings changes)

3.2 From finders (strangers who scan tags)

When someone scans a PawShield tag:

• The scan event itself: timestamp, the tag ID that was scanned
• Approximate location: either via GPS (if the finder grants their

browser permission to share it) or via IP-based geolocation (a rough city-level estimate — never a street address)

• Their IP address: hashed before storage, never kept raw
• User agent: the browser + operating system they used to scan

If the finder taps "Pin this spot for [owner name]" after scanning, we additionally collect:

• Precise GPS coordinates of where they were at the moment of the

pin (with their explicit consent via the browser's location prompt)

Finders do not create accounts. We do not otherwise identify them. We do not track them across sessions. We do not build any profile of finders.

3.3 From website visitors

Just standard server-level information that Cloudflare (our hosting provider) collects automatically for security and abuse prevention:

• IP address
• User agent
• Pages visited and timestamps

We don't use Google Analytics, Facebook Pixel, or any advertising tracker.

4. How we use your information

Each piece of data exists for a specific reason. We don't collect data "just in case."

We do not:

• Sell your personal information to anyone
• Use your information for advertising, ever
• Share pet photos for marketing
• Provide data to brokers or analytics firms

5. Our legal basis for handling your data (PIPEDA purposes)

Under Canadian privacy law (PIPEDA and Quebec Law 25), we must identify a specific purpose for each piece of personal information we collect. Here's ours:

• Delivering the service you paid for (displaying your pet's

profile, alerting you to scans). Without this data, there's no PawShield service.

• Legitimate operational interests — security, abuse prevention,

financial record-keeping.

• Consent — specifically for SMS alerts. You opt in explicitly;

you can opt out at any time.

• Legal compliance — retaining some information (e.g. audit logs,

financial records) to comply with tax, consumer-protection, and privacy laws.

6. Who we share your information with

We use a small number of third-party service providers ("processors") to run PawShield. They only receive the specific data necessary for their part of the job. We do not share your data for any other purpose.

Each of these processors has their own privacy practices. We have contracts (Data Processing Agreements) with each that require them to handle your data only for the purposes we instruct.

We do not share data with any other third parties. We have never sold user data and commit to never selling it.

7. What finders can see

When someone scans your pet's tag, they see the public scan page, which includes:

• Your pet's name
• Your pet's photo (if you uploaded one)
• Species and breed (if you provided them)
• Medical notes (if you provided them)
• A call button linked to your phone number (only if you opted in to

SMS — if not, no call button)

• A text-with-photo button (only if SMS opted in)
• Your first name (so finders know who they're helping — e.g. "Call

Sarah")

Finders do not see:

• Your email address
• Your last name (unless you included it in your profile)
• Your home address
• Any other pets you own
• Any scan history

If you mark your pet as lost, the public scan page also shows:

• A prominent "I'M LOST" badge
• The reward amount (if you set one)
• "Missing since [date]" if provided

You control every piece of this. You can update, remove, or edit any of it at any time from your dashboard.

8. Where we store your data

Most of your data lives in our Supabase database, which is hosted by Amazon Web Services. We prefer the ca-central-1 (Toronto) region when available. Some processors (Cloudflare edge, Twilio, SendGrid, and web push services) inherently operate globally and may process your data outside Canada.

8.1 Cross-border data transfers

Some of your data is processed outside Canada. Specifically:

• Cloudflare operates a global network; your request may be served

from a data center in any country

• Twilio and SendGrid are US companies; SMS and email delivery routes

data through US infrastructure

• Web push services are operated by Google (US), Apple (US), and

Mozilla (US)

We require all processors to apply comparable privacy protections to what Canadian law requires. However, data stored outside Canada may be subject to the laws of those countries, including potential government access requests under laws like the US CLOUD Act.

For Quebec residents under Law 25: by using PawShield, you acknowledge these cross-border transfers are necessary to deliver the service. If this is not acceptable, please do not use the service.

9. How long we keep your data

We keep information only as long as necessary for the purpose it was collected for, plus any period required by law.

Deletion

You can delete your account at any time from Settings → Delete Account. When you do, we:

• Delete your owner profile and all pet profiles immediately
• Delete all uploaded photos
• Delete all scan records for your tags
• Delete all push subscriptions
• Delete your authentication credentials
• Reset your physical tags to an unused state (in case you or a future

owner want to re-use them later)

• Retain a hashed record that a deletion occurred (for 7 years, per

PIPEDA record-keeping requirements) — this record does not contain personal information that can be linked back to you

Audit log records pertaining specifically to SMS consent (required under CASL) are retained for 3 years after your last interaction, as required by law.

10. Your rights

10.1 Under PIPEDA (all Canadian residents)

You have the right to:

• Know what personal information we hold about you
• Access that information on request
• Correct inaccuracies
• Withdraw consent for any processing that's based on consent (e.g.

SMS alerts) — note this may affect the service's usefulness

• Challenge our compliance with privacy law by contacting us, and

ultimately by filing a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/)

10.2 Additional rights under Quebec Law 25

Quebec residents additionally have:

• The right to data portability (receive your data in a structured,

commonly-used format) — available on request

• The right to de-indexation in limited circumstances
• The right to be informed when automated decisions affect them —

we do not make automated decisions about you using your personal information (no algorithmic profiling or similar)

10.3 Rights summary (all residents)

To exercise any of these rights, email us at privacy@pawshieldpet.net from the address on your account. We will respond within 30 days. If your request is complex we may need up to 60 days (with notice to you).

You can do the following without contacting us:

• See your data — everything in your dashboard is the data we hold

about you in that table

• Update your profile — Settings page
• Update your pet profiles — Dashboard → pet → Edit
• Turn off alerts — Settings → Notifications
• Delete your account — Settings → Delete Account
• Stop SMS — reply STOP or ARRÊT to any of our messages

11. Security

We take reasonable steps to protect your information, including:

• Encryption in transit — all traffic between you and PawShield

uses HTTPS (TLS 1.2 or higher)

• Encryption at rest — your data in our database is encrypted by

our cloud provider

• Password hashing — we use bcrypt (via Supabase Auth) with a

strong work factor. We never see your actual password.

• Row-level security (RLS) — database access is scoped per user;

you can only see your own data

• Service-role separation — sensitive operations use a separate

admin credential stored only on our server

• Rate limiting and bot protection — on every sensitive endpoint
• IP address hashing — we never store raw IP addresses; they're

hashed with SHA-256 before writing to the database

• Audit logging — sensitive actions are logged for forensics
• Vendor vetting — all third-party processors are established

providers with their own compliance frameworks

No system is perfectly secure. If we ever discover a breach that meaningfully risks your data, we'll notify you directly, notify the Privacy Commissioner of Canada, and publish a notice on our website within 72 hours of discovery, as Canadian law requires.

12. SMS specifically (CASL compliance)

Because SMS is regulated separately in Canada under the Canadian Anti-Spam Legislation (CASL), we want to be explicit:

• SMS is strictly opt-in. The default is off. You have to

affirmatively toggle it on in your settings.

• We log each opt-in event with a timestamp, the phone number, a

hashed IP address, and your user agent, as proof of consent. This record is required under CASL for 3 years.

• Every SMS we send identifies PawShield as the sender and includes

an unsubscribe mechanism.

• To opt out: reply STOP, UNSUBSCRIBE, or in French ARRÊT to

any message. Your phone number is instantly removed from SMS sends at both our layer and the carrier's.

• Standard message rates apply — your mobile carrier may charge

you for SMS depending on your plan. PawShield does not charge for SMS itself.

• Frequency: you receive an SMS only when someone scans your pet's

tag (and the cooldown period has passed). Typically zero SMS per month for most owners; potentially multiple per hour during a lost pet event.

13. Push notifications

Similar in spirit to SMS but different in technology:

• Push is also opt-in — you have to tap "Turn on alerts" and grant

your browser permission

• We send an encrypted payload to Google, Apple, or Mozilla's push

service, which delivers it to your specific device. The push service knows a push was sent but not what was in it.

• To turn off: your browser settings, your device settings, or Settings

→ Push alert devices → Remove

• We do not send promotional push notifications. Push is only used for

scan alerts and account notifications.

14. Cookies and tracking

We use the minimum set of cookies required for the service to function:

• Authentication cookies — keep you signed in between visits
• Session cookies — maintain your activation flow state

We do not use:

• Advertising cookies
• Cross-site tracking cookies
• Analytics cookies from third-party networks (Google Analytics, etc.)
• Social-media tracking pixels (Facebook, TikTok, etc.)

If we add any privacy-respecting analytics in the future (e.g. Cloudflare Web Analytics, Plausible), we'll update this policy.

15. Children's privacy

PawShield is intended for adults (age of majority in your province — 18 in Ontario and most provinces; 19 in BC, NB, NS, NFL; 18 in Quebec). Pets can belong to children, but the account holder must be an adult.

We do not knowingly collect personal information from children under

1. If we learn that we have, we will delete the account and the data

promptly. If you believe we may be processing information about a child, contact us at privacy@pawshieldpet.net.

16. Changes to this policy

We may update this Privacy Policy as the product evolves or as the law changes. When we make material changes:

• We will update the "Last updated" date at the top
• We will notify you by email (to the address on your account) at

least 30 days before the change takes effect, if the change is significant

• Continuing to use the service after the effective date means you

accept the changes. If you don't accept, you can close your account.

Small clarifying changes (typo fixes, new processor that inherits the same role, etc.) may not trigger notification but will always be reflected in the "Last updated" date.

17. Contact us

Privacy questions or requests

Email: privacy@pawshieldpet.net

Postal mail:

PawShield — Privacy Officer
[Your mailing address]
[City, Province  Postal Code]
Canada

Filing a complaint

If you're unhappy with our response to a privacy request, you can file a complaint with:

Office of the Privacy Commissioner of Canada 30 Victoria Street Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 https://www.priv.gc.ca/

Quebec residents: Commission d'accès à l'information du Québec https://www.cai.gouv.qc.ca/

This policy is written to be readable. If any term is unclear, email privacy@pawshieldpet.net and we'll explain. We believe you should understand what happens with your data, not just check a box.