Privacy Policy

1. Introduction

Petverse is a pet care companion app for dog parents and their households. This policy explains what personal data we collect when you use the Petverse iOS app or visit petverseapp.com, why we collect it, who we share it with, and the rights you have over it.

Petverse is operated by MISTRAL SPARK LIMITED, a company registered in the United Kingdom. We are the data controller for the personal data described below. You can reach us at ai@sumletter.com.

Because your dog's profile, photos, health logs, and walk routes are tied to your account, we treat data about your dog as your personal data too, and protect it the same way.

2. Which laws apply to you

Petverse is run from the United Kingdom, so your data is protected by the UK GDPR and the Data Protection Act 2018. Mistral Spark Limited is the data controller.

If you use Petverse from the European Economic Area, the EU GDPR applies to you as well, and you can deal with your own national data protection authority.

Marketing email and cookies are also covered by the Privacy and Electronic Communications Regulations (PECR) in the UK. Our AI features follow the transparency expectations of the EU AI Act. Wherever these laws differ, we apply whichever gives you the stronger protection.

3. Data we collect

Account information

• Your email address and display name (from sign-up or your Apple/Google account).
• Your profile photo, if you choose to add one.

Pet data

• Your dog's name, breed, birthday, weight, and other profile details.
• Photos of your dog and household.
• Health logs, medications, vet appointments, and incident reports.
• Walk routes, GPS traces, walk durations, and activity history.
• Meals, training sessions, mood, water and sleep entries.

User-generated content

• Photos and notes you upload.
• Voice recordings made through the in-app voice agent or dictation.
• Chat messages you send to Pet Pal, our AI assistant.
• Posts and replies you share in community features.

Technical data

• Device identifier, device model, operating system version, and app version.
• Crash reports and error logs.
• Product analytics and session replays. Text inputs are masked in replays, so we never see what you type.

Location

If you start a walk and grant location permission, we collect precise location to record the route. You can revoke this permission at any time in iOS Settings. Without location, walk tracking will not work, but the rest of the app will.

4. How we use your data

We use your data to run the app and improve it, always for a specific reason with a lawful basis behind it. Under the UK and EU GDPR, those bases are:

5. AI, voice, and automated decisions

Petverse uses AI to power Pet Pal, our assistant, and the voice features. Here is exactly how your data moves.

• Text chats with Pet Pal are sent to a third-party large language model provider, which generates a reply and returns it to you.
• Voice dictation, the continuous voice agent, and read-aloud use third-party speech and voice providers to turn your audio into text, or text into speech.

No training on your data. Our AI providers process your content only to answer you. Under our agreements with them, they do not use your chats, voice recordings, photos, or other content to train their own models.

Voice recordings. Your audio is used to give you the feature and your saved history, nothing else. We do not build a voice clone or a biometric profile of you. Recordings are deleted when you delete the related entry or your account (see How long we keep data).

No automated decisions about you. We do not make decisions that produce legal or similarly significant effects about you by purely automated means (UK and EU GDPR Article 22). Pet Pal and every AI feature are assistive only.

AI is labelled, and it can be wrong. AI features are marked as AI in the app, in line with the transparency expectations of the EU AI Act. AI output can be incomplete or out of date, and it is general information only, not veterinary advice. Always consult a qualified vet for medical concerns (see our Terms).

6. Service providers

We use a small number of trusted service providers to run Petverse. Each is bound by a data processing agreement and only handles data needed for their role. The categories are:

• Cloud database, authentication, and file storage hosting (EU region).
• AI providers for text chat, speech-to-text, the voice agent, and read-aloud.
• Real-time voice transport for the in-app voice agent.
• Identity providers for Sign in with Apple and Sign in with Google.
• Push notification delivery (Apple).
• Product analytics, session replay, and error tracking (EU region).
• Transactional email delivery.

We keep a current named list of these providers and will share it on request. Email ai@sumletter.com and we will send it over.

We do not sell your personal data, and we do not share it for cross-context behavioural or targeted advertising.

7. Sign in with Google or Apple

When you sign in with Google or Apple, the provider shares a stable account identifier, your email address, and your display name with us. Apple users may choose to hide their email, in which case Apple gives us a private relay address. We do not receive your password or access to anything else in your Google or Apple account.

8. Children

Petverse is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

9. How long we keep data

We keep your data while your account is active. When you delete your account, we hard-delete your profile, dogs, photos, logs, and authentication record. Most data is removed immediately; cold backups and a small number of upstream caches (for example, Apple identity revocation) are purged within 30 days.

Voice recordings are kept only as long as needed to give you the feature and your saved history, and are deleted with the related entry or your account. Walk routes and location traces are stored as part of your activity history and are removed when you delete the walk or your account.

10. Your rights

Under the UK GDPR and Data Protection Act 2018, and the EU GDPR if you are in the EEA, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Erase your data (see Account deletion below).
• Receive a portable copy of your data.
• Restrict or object to certain processing.
• Withdraw consent where consent is the legal basis.

Email ai@sumletter.com to exercise any of these rights. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data, or, if you are in the EEA, to your local data protection authority (find yours through the European Data Protection Board, edpb.europa.eu).

11. Account deletion

You can delete your account directly from the app: open Settings, tap Delete account, and confirm. The deletion is permanent and irreversible. Your dogs, logs, photos, voice recordings, chat history, and authentication record are removed. Most data is deleted immediately. A small subset (Apple identity revocation, edge function cleanup queues, encrypted cold backups) finishes within 30 days.

12. International transfers

Your data is primarily stored in the EU. Some AI providers may process content in the United States or other jurisdictions. Where data leaves the UK or EEA, we rely on the UK International Data Transfer Agreement or EU Standard Contractual Clauses to safeguard it.

13. Security

• All traffic is encrypted with TLS in transit.
• Data is encrypted at rest by our hosting provider.
• Database access is gated by Postgres row-level security policies, so users can only read their own (and their household's) rows.
• Authentication uses signed JWT tokens with short expiry.
• Secrets and API keys are stored server-side only and never shipped in the app.

14. Cookies and tracking on the website

Under the Privacy and Electronic Communications Regulations (PECR), we only place cookies that are strictly necessary, which do not need your consent. The petverseapp.com marketing site sets no tracking or advertising cookies. Authentication cookies are set only on the auth flow itself (for example, accepting a caregiver invite) and are strictly necessary. Product analytics and session replay run on this website only if you accept them in the banner, and you can decline without losing any part of the site.

Counting visits without cookies. Separately from that banner, we keep a simple count of how many times each page is viewed. This happens on our server, so it sets no cookie, reads nothing from your device, and runs no tracking script. We record the page, the website you arrived from (the domain only, never the full link), and the country your request came from. We do not store your IP address or your browser details: they are turned into a one-way scrambled code using a secret that changes every day, so the code cannot be turned back into you and cannot follow you from one day to the next. The result is a visitor count and nothing else, with no profile attached to it. Our legal basis is our legitimate interests in understanding which pages are useful (Article 6(1)(f)), and because nothing is stored on or read from your device, PECR does not require your consent for it.

15. Changes to this policy

We will update the “Last updated” date at the top of this page when this policy changes. For material changes we will notify you in-app or by email before they take effect.

16. Contact

Petverse is operated by MISTRAL SPARK LIMITED, a company registered in England and Wales (Companies House no. 16874200).

Email: ai@sumletter.com