Privacy Policy
Last updated: May 3, 2026 · Effective date: At App Store launch
This Privacy Policy describes how Nlongvity (a sole proprietorship registered in Norway, "we", "us", "our"), operating the PawPal mobile application ("PawPal", "the service"), processes personal data. We are the data controller for the personal data we process about you.
This policy is written to comply with the EU General Data Protection Regulation (GDPR), as incorporated into Norwegian law via the Norwegian Personal Data Act of 15 June 2018 (personopplysningsloven). The Norwegian Data Protection Authority (Datatilsynet) is our supervisory authority.
1. Who we are
Nlongvity, sole proprietorship
Norway
Contact: privacy@nlongvity.com
General contact: hello@nlongvity.com
We have not appointed a Data Protection Officer (DPO) because Article 37 of GDPR does not require it for our scale and processing activities. We will appoint one if our processing reaches the threshold requiring it.
2. What personal data we process and why
| Category | Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Account | Email, name (optional), hashed password | Provide the service, authenticate access | (b) Performance of contract | While account active + 30 days |
| Pet profile | Name, species (dog/cat), breed, date of birth, photo, weight | Provide core service | (b) Performance of contract | While account active |
| Pet health logs | Vet visits, medications, vaccinations, allergies, symptoms, weight history, memories, milestones, notes, optional photos | Provide core service | (b) Performance of contract | While account active |
| Reminders | Reminder type, title, due date, recurrence, completion state, notes | Send notifications you opt into | (b) Performance of contract | While account active |
| AI-generated content | Pet bio (generated from pet profile), pet passport text | Provide differentiator features | (b) Performance of contract | While account active; user-regeneratable |
| Subscription state | Plan tier, entitlement status, subscription store events | Manage premium access | (b) Performance of contract | While account active + 5 years (financial records) |
| Push notification tokens | Expo push tokens, device identifier | Deliver notifications you opt into | (a) Consent | Until you disable notifications or delete account |
| Usage data | Feature interactions, session timestamps, device type, OS version, app version, locale | Improve the service | (f) Legitimate interest in service improvement | 24 months |
| Crash and error logs | Stack traces with personal identifiers stripped | Diagnose technical issues | (f) Legitimate interest in service stability | 90 days |
| Email contact | Email address, message subject metadata | Send transactional and (with consent) marketing emails | (b) Contract for transactional, (a) Consent for marketing | While account active |
| Vet PDF exports | A one-page summary you generate from your own data; never stored on our servers, only generated client-side and shared via your device | N/A — generated on-device | N/A | Not retained server-side |
We do not process special category data (Article 9 GDPR) about you. Pet health data is not personal health data of a human and is not classified as special category under GDPR.
We do not sell personal data.
We do not run third-party advertising in PawPal.
We do not accept commissions or referral payments from veterinary clinics or pet product vendors. Subscription fees are our only revenue source.
We do not use your pet data, photos, logs, or AI bio inputs/outputs to train our own AI models or any third-party AI models. Inputs sent to AI sub-processors (Anthropic) are processed only to fulfill the immediate request and are not retained by them for model training.
3. Sub-processors and international transfers
We share personal data with the following sub-processors, strictly to provide the service. We have data processing agreements (DPAs) in place with each.
| Sub-processor | Purpose | Data shared | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | Database, auth, storage, edge functions, realtime | All user data | EU (Frankfurt, AWS) | EEA — no transfer needed |
| Anthropic PBC | AI pet bio generation (Claude) | Pet profile fields (name, species, breed, age, locale) | United States | Standard Contractual Clauses (SCCs) |
| Apple Inc. | iOS app distribution, in-app purchases, push notifications (APNs) | Per Apple's privacy policy | United States | SCCs |
| Google LLC | Android app distribution, in-app purchases, push notifications (FCM) | Per Google's privacy policy | United States | SCCs |
| RevenueCat, Inc. | Subscription entitlement management | Anonymous subscriber ID, entitlement state, store transaction events | United States | SCCs |
| Resend, Inc. | Transactional email delivery (password reset, account events) | Email address, email subject and body content | EU (Ireland, AWS) | EEA — no transfer needed |
| PostHog Inc. | Product analytics (when enabled in v1.0.1+) | Anonymized usage events; no pet content | EU (Frankfurt) | EEA — no transfer needed |
| Functional Software Inc. (Sentry) | Error and crash tracking (when enabled in v1.0.1+) | Sanitized stack traces, no PII | EU | EEA — no transfer needed |
| Expo (650 Industries, Inc.) | Push notification delivery via Expo Push Service | Push token, notification payload | United States | SCCs |
Where personal data is transferred to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission per Article 46(2)(c) GDPR. Where additional protection is warranted (per the Schrems II ruling and EDPB recommendations), we apply technical safeguards including encryption in transit and at rest.
You can request a list of current sub-processors and DPA copies by writing to privacy@nlongvity.com.
4. Pet photos and uploaded content
PawPal lets you upload photos of your pet, vet documents, and memory captures. These are stored in encrypted Supabase Storage buckets, scoped to your user account. Other users cannot access your uploads.
Pet photos uploaded for the pet passport are stored in a public-read bucket so the passport card can be shared, but file paths are non-guessable and tied to your user ID prefix. Health-related uploads (vet documents, symptom photos) are stored in private buckets with owner-only access enforced by Row-Level Security policies.
You may delete any uploaded content at any time from within the app. Deleted content is removed from active storage immediately and from backups within 90 days.
5. Notifications and reminders
PawPal sends two categories of notification:
Local notifications (scheduled on-device): reminders for vaccinations, medications, grooming, and other routines you set. These are scheduled by your device and delivered locally; the schedule data leaves your device only as part of normal account sync to enable cross-device continuity.
Remote push notifications (delivered via Apple APNs / Google FCM via Expo Push Service): time-of-day prompts (e.g. weekly check-in), milestone unlocks, year-in-review availability. These require your push notification permission. You can disable them at any time in your device settings or in PawPal Settings → Notifications.
Push tokens are deleted immediately when you disable notifications or delete your account.
6. AI-generated content disclosure
PawPal uses Anthropic's Claude AI to generate a personalized pet bio from your pet's profile (name, species, breed, age, locale). The bio appears on your pet's passport card.
You should know:
- Pet profile data sent to Anthropic is processed only to generate the bio and is not retained by Anthropic for training
- Generated bios are not human-reviewed by Nlongvity before being shown to you
- AI may produce content that does not match your pet's real personality or contains minor inaccuracies; you can regenerate the bio at any time
- We do not use AI to generate medical advice, diagnoses, or treatment recommendations
- The vet PDF export is a structured summary of data you yourself logged — it is not AI-generated commentary
This disclosure is provided in accordance with the Norwegian Marketing Control Act (markedsføringsloven) requirement that information about AI-generated content be clearly disclosed where relevant to consumer decision-making.
7. Pet wellness disclaimer
PawPal is a record-keeping and reminder tool. PawPal is not a veterinary service, does not provide veterinary advice, and does not replace consultation with a licensed veterinarian. Breed-specific guidance content provided in the app is general information based on widely available references and is not tailored medical advice for your specific pet.
If your pet shows signs of illness, injury, or distress, contact a licensed veterinarian.
8. Your rights under GDPR
You have the following rights, exercisable free of charge by contacting privacy@nlongvity.com:
- Right of access (Article 15 GDPR) — receive a copy of personal data we hold about you
- Right to rectification (Article 16) — correct inaccurate data
- Right to erasure (Article 17, "right to be forgotten") — delete your personal data; see also section 11 of this policy and /pawpal/delete-account
- Right to restriction of processing (Article 18) — limit how we process your data in specific circumstances
- Right to data portability (Article 20) — receive your data in a structured, machine-readable format. PawPal provides this directly via Settings → Export my data
- Right to object (Article 21) — object to processing based on legitimate interest, including profiling
- Right not to be subject to automated decision-making (Article 22) — PawPal does not make automated decisions producing legal effects on you. AI-generated bios and reminder suggestions are not automated decisions; you control all your data.
We respond to requests within 30 days. If we refuse a request, we will explain why and inform you of your right to complain to the supervisory authority.
You may also complain to the Norwegian Data Protection Authority:
Datatilsynet
Postboks 458 Sentrum
0105 Oslo, Norway
Phone: +47 22 39 69 00
postkasse@datatilsynet.no
www.datatilsynet.no
9. Security
- All data is encrypted in transit using TLS 1.2 or higher
- Data at rest is encrypted using industry-standard encryption
- Row-Level Security policies enforce per-user data isolation at the database layer
- Production access is restricted to authorized personnel and audit-logged
- We follow OWASP secure development practices
- Sensitive operations (account deletion, data export) require fresh re-authentication
If a personal data breach occurs that risks your rights and freedoms, we will notify the Norwegian Data Protection Authority within 72 hours and notify you without undue delay if the breach poses a high risk, per Articles 33 and 34 GDPR.
10. Children
PawPal is not intended for users under 18. The Norwegian Personal Data Act sets the age of digital consent at 13, but our terms require users to be 18 or older because the service involves subscription payments and account-level legal commitments. We do not knowingly process data from anyone under 18. If you believe a minor has provided us data, contact privacy@nlongvity.com and we will delete it.
11. Data retention and deletion
Personal data retention periods are listed in the table in section 2. After account deletion:
- Personal data is deleted within 30 days
- Backups are deleted within 90 days
- Anonymized aggregate analytics may be retained indefinitely
- Financial records (invoices, receipts, subscription transaction logs) are retained for 5 years per Norwegian Bookkeeping Act (bokføringsloven §13)
To delete your account, see /pawpal/delete-account.
12. Marketing communications
We send two types of email:
Transactional email — required to operate the service (account verification, password reset, billing receipts, security alerts, app updates). You cannot opt out of these while your account is active. Legal basis: contract performance.
Marketing email — newsletters, product announcements, promotional content. We send these only with your prior consent (opt-in at signup or in Settings). Each marketing email contains a one-click unsubscribe link. Legal basis: consent. This complies with the Norwegian Marketing Control Act §15 (markedsføringsloven §15).
13. Changes to this Privacy Policy
We may update this policy. Material changes will be notified via email and an in-app banner at least 30 days before they take effect, unless the change is required by law or addresses a security risk. Continued use of the service after the effective date constitutes acceptance.
Changes that broaden how we process your data require your fresh consent.
14. Contact
For privacy questions or to exercise your rights:
privacy@nlongvity.com
For general inquiries:
hello@nlongvity.com
Nlongvity (sole proprietorship)
Norway