Account and profile
Email address, authentication data, name, profile name and type, profile image, language, platform, app version and session identifiers.
Last updated: 14 October 2026
Privacy at Petlio
Petlio organises pet profiles, health and insurance details, Nests or households, appointments, permissions, bookings and contacts with pet carers, dog schools and veterinary practices.
This policy applies worldwide to the Petlio iOS and Android apps, the Petlio web app, the public website and directly related services. External services also apply their own privacy notices.
Petlio does not sell personal data and does not use it for personalised advertising or cross-service tracking.
1
Controller and contact
Controller
Stefan Bess – TeKOcloudHerzog-Albrecht-Straße 36
93083 Obertraubling
Germany
2
Personal data Petlio processes
The exact data depends on your profile type and the features you use. Data comes from you, participating users, your device, app stores and the providers listed below.
Nest, members and permissions
Nest name, memberships, roles, invitations, join requests, shared email addresses and read/write permissions.
Pet and health details
Pet name, species, breed, date of birth, sex, identifiers, photos, weight, diary, food, insurance, vaccinations, medication, parasite protection, allergies, conditions and notes.
Calendar, bookings and providers
Appointments, reminders, booking requests, preferred and alternative times, status, cancellations, reviews, comments and business contact, location and availability details.
Location and device features
Precise or approximate location after system permission, addresses, map areas and camera or photo-library access when you use these features.
Notifications
Push token, installation identifier, notification type, content, status, time and notification preferences.
Subscriptions and purchases
Product ID, transaction, purchase and premium status, expiry, platform and Petlio user ID. Petlio does not receive complete payment-card or bank details.
Support and contact
Request, description, email address, optional name, account and profile identifiers and voluntarily attached PNG/JPG screenshots.
Technical, usage and error data
IP address, device, operating system, browser, app version, pseudonymous identifiers, usage events, error messages, stack traces, cache and offline data.
Health information about a pet is not automatically health data about a person. Because it may reveal information about users, households or care relationships, Petlio protects it as personal data.
3
Purposes and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the service | Registration, login, profiles, Nests, pets, calendar, bookings, permissions and synchronisation. | Performance of a contract; Article 6(1)(b) GDPR where applicable. |
| Requested device features | Location, camera, photo library and push notifications after system permission. | Contract and consent; Article 6(1)(a) and (b) GDPR where applicable. |
| Security and reliability | Abuse prevention, error analysis, technical logs and access controls. | Legitimate interests in secure operation; Article 6(1)(f) GDPR where applicable. |
| Product analytics | Pseudonymous app starts and usage events through Firebase Analytics. | Legitimate interests where permitted; otherwise consent required by applicable privacy or device-storage law. |
| Legal obligations | Retention, legal claims and lawful requests from authorities. | Legal obligations and permitted establishment or defence of claims. |
4
Service providers and recipients
Supabase
Authentication, database, Realtime, Storage and Edge Functions for account, profile, Nest, pet, appointment, booking, permission and notification data. The primary region is eu-central-2 in Zurich, Switzerland. Access controls and Row Level Security restrict access. Supabase privacy.
Google Firebase Analytics and Cloud Messaging
Analytics processes pseudonymous usage and technical events. Ad Storage, Ad User Data and personalisation signals are disabled; iOS does not use IDFA. Analytics currently starts when the app starts and Petlio does not yet provide an in-app switch. Cloud Messaging processes installation IDs, push tokens and delivery data. Firebase privacy.
Google Maps and Google Places
Search terms, addresses, map area, location, IP address and device data may be sent to Google for maps, location search, address checks and external search results.
Error tracking
The Sentry SDK sends production reports to the self-hosted tracking.tekoserver.cloud endpoint, not Sentry Cloud. Data includes app version, platform, error message and stack trace.
Apple App Store and Google Play
The stores process purchases and payments. Petlio associates a transaction with an account and profile and validates it server-side through Supabase. Apple and Google process store and payment data under their own terms.
Email and contact form
Feedback and support are sent by SMTP to info@petlio.de. The public form processes topic, email, optional name and message. A pseudonymous rate-limit identifier derived from the IP address is kept for no more than ten minutes.
5
Sharing and other recipients
- Nest members see shared data according to their role and permissions.
- Pet data can be shared by section with veterinary practices or care profiles, including read or write access.
- Active provider profiles may appear publicly in search and maps with business contact, location and availability details.
- Booking, contact and invitation participants receive the information needed for the feature.
- Authorities, courts or other bodies receive data only when legally required or for permitted legal claims.
6
International data transfers
Supabase’s primary region is Switzerland, which the European Commission recognises as providing adequate protection. Apple, Google and subprocessors may process data in the United States and other countries.
Each data flow from the EU/EEA must be assessed separately to determine whether an adequacy decision or contractual safeguards apply. UK data is subject to separate UK transfer rules; other regions apply their respective local requirements. This policy does not claim a blanket certification or guarantee for every recipient.
7
Retention and deletion
- Account data is generally stored for the life of the account. Pet, Nest, calendar, booking and permission data remains until deletion, the purpose ends or the account is deleted.
- Push tokens are replaced when updated and removed for the current device on logout or account deletion. Analytics and error data follow retention periods configured in the respective systems.
- Support emails and deletion requests are retained only as long as necessary for handling, evidence or legal obligations. Statutory retention duties remain unaffected.
- Local storage includes
petlio_cache,offline_queue,petlio_settings, the Supabase session and Firebase installation data. The cookie and storage notice provides details.
Delete your account
Delete your account under Settings → Account → Delete account or submit a request through the contact form. The app removes the current push token, starts server-side deletion, clears user-related local data and signs out of Supabase. Cancel an Apple or Google subscription separately in the relevant store account.
Cookies8
Your privacy rights
Petlio offers every user the following baseline rights, regardless of residence and subject to lawful exceptions:
- Access and confirmation of processing.
- Correction of inaccurate or incomplete data.
- Deletion, restriction and objection to processing.
- Data portability where technically and legally available.
- Withdrawal of consent for future processing.
- Information about recipients and a complaint to a competent authority.
Use the contact form or email developer@petlio.de. We may request additional information to verify identity.
9
Regional information
EU/EEA and Germany
The GDPR applies and, for access to devices in Germany, the TDDDG may also apply. The controller’s usual authority is the Bavarian Data Protection Authority.
Switzerland
Swiss data protection law provides rights including access, correction and deletion. Complaints may be made to the Federal Data Protection and Information Commissioner.
United Kingdom
Where the UK GDPR and Data Protection Act 2018 apply, rights include access, correction, deletion, restriction, portability and objection. You may complain to the Information Commissioner’s Office. Petlio does not claim to have appointed a UK representative.
United States
Where US state privacy rights apply, you may request access, correction, deletion and a copy of data and may opt out of certain processing. Petlio does not sell personal data or share it for cross-context behavioural advertising. Sensitive data is used only for requested functionality and security. These voluntarily offered rights do not state that a statutory threshold has been met. The California Privacy Protection Agency explains California rights and thresholds.
Canada
Under applicable federal or provincial law you may request access and correction and complain first to Petlio and then to the competent privacy authority.
Brazil
Where the LGPD applies, rights include confirmation, access, correction, anonymisation, blocking or deletion of unlawful data, recipient information, portability, withdrawal and review of solely automated decisions. Complaints may be made to the ANPD.
Australia and New Zealand
Applicable law may provide access and correction rights. After contacting Petlio, complaints may be made to the OAIC or New Zealand Office of the Privacy Commissioner.
10
Security, minors and changes
Data security
Petlio uses encrypted transmission, authentication, role- and permission-based access, Row Level Security, server-side validation and technical error analysis. No system is absolutely secure.
Required information
Email and authentication data are required for a personal account. A pet photo, precise location and support attachment are optional; only dependent functions are unavailable without them.
Automated decisions
Petlio does not make solely automated decisions with legal or similarly significant effects and does not profile users for personalised advertising.
Minors
Petlio is not directed at children. Minors should use Petlio only with the consent required from a parent or guardian where they live.
Changes
Petlio updates this policy when features, providers or law change. Material changes are communicated appropriately in the app or through available contact details.