Privacy policy

Who we are

Bos.Dog is software that dog boarding facilities use to run their business. It is operated by [legal entity name], [registered address] (“we”). Questions about this policy and requests about your data go to [email protected]. [Name of grievance officer / data protection contact.]

Two kinds of data, two roles

• Facility accounts. When you sign up, run a facility or work at one, we decide how your account data is used. We are the controller (the “data fiduciary” under India’s DPDP Act).
• Clients of a facility. Dog parents, their dogs, stays, care logs, photos and invoices are entered by the facility and belong to it. The facility is the controller; we process that data on its behalf and only to provide the service. If you are a dog parent, contact your facility first. We will help them answer you.

What we collect

• Account details from Google sign-in: name, email address and profile photo.
• Facility details: name, address, phone, tax registration, prices, staff and their roles.
• Client records the facility adds: names, phone numbers, email and postal addresses, emergency contacts, identity documents where the facility asks for them, dog profiles, vaccination and health notes, care logs, photos, bookings, invoices and payments.
• Technical data: IP address and browser details, used for security and rate limiting.
• Usage data on our website and the staff app, described under Cookies and analytics.

We do not see or store card numbers. Paid plans are billed by our payment provider.

Why we use it

• To provide the service you or your facility signed up for (contract).
• To keep accounts secure and prevent abuse (legitimate interest).
• To send service messages such as staff invitations, account notices and daily updates (contract).
• To understand how the product is used and improve it (legitimate interest, or consent where the law requires it).
• To keep financial records as tax law requires (legal obligation).

We do not sell personal data and do not use it for advertising.

AI features

Report cards, daily summaries and voice notes are drafted by AI models from Anthropic and OpenAI. We send them only the care details needed for the draft. Under our agreements with them, they do not use this data to train their models.

Who we share it with

We use the providers below to run the service. Each processes data only on our instructions.

Some of these providers are outside your country. Where the law requires it, transfers rely on standard contractual clauses or an equivalent safeguard. We may also disclose data when the law requires us to.

Cookies and analytics

• Essential cookies keep you signed in, remember your facility and language, and keep the parent portal session. These are always on.
• On our marketing pages and in the staff app we use Google Analytics and Microsoft Clarity to see how pages are used. They are not loaded for visitors in the European Economic Area, the United Kingdom or Switzerland, on the parent portal, on shared report cards, updates and invoices, or on facility booking pages.

How long we keep it

• Account and facility data: for as long as the account is open, then deleted within [90] days of closure.
• Client records: until the facility erases them or closes its account.
• Invoices: for the period tax law requires, even after a client is erased. An erased client’s name stays only on invoices already issued.
• Backups: up to 30 days, then overwritten.

Your rights

Depending on where you live, you can ask to see, correct, export or erase your personal data, object to or restrict some uses, and withdraw consent. Facility owners can download their facility’s data from Settings and erase a client’s personal details from the client’s profile. For anything else, write to [email protected]. We answer within 30 days. You can also complain to your data protection authority (in the UK, the ICO; in India, the Data Protection Board).

Security

Data is encrypted in transit. Access is limited by role inside each facility. Shared links use unguessable tokens. Backups are kept [offsite, encrypted]. If a breach affects your data, we will tell you and the authorities as the law requires.

Children

The service is for businesses and is not meant for anyone under 18.

Changes

We will post changes here and tell account owners by email before material changes take effect. See also our terms of service.