Privacy Policy — Petzara

Last updated (Portuguese original): 10/16/2026

Legal notice

This Policy describes how the operator of the Petzara platform ("we", "our" or the "operator") processes personal data in connection with the software-as-a-service (SaaS) product offered to pet service businesses. It does not replace legal advice. The operator's full corporate identification (legal name, CNPJ (Brazilian company registration number) and address) will be published on this page when available; until then, you can request information through the contact channel listed in section 14.

This Policy is aligned with Brazilian Law No. 13,709/2018 (General Data Protection Law — LGPD).

1. Controller and data protection officer (DPO)

1.1 The controller of the personal data processed on behalf of the operator of the Petzara Platform is the Petzara operator itself, to the extent that it determines the purposes and means of processing.

1.2 The data protection officer (DPO), once appointed, may be contacted at the email listed in section 14. Until an appointment is made public, LGPD-related requests may be sent to the contact channel listed in section 14.

1.3 Businesses that use Petzara to process data about their clients and pet owners may act as controllers or processors with respect to those data subjects, as the case may be. These Users are responsible for providing appropriate notices and legal bases to their data subjects.

2. Scope: who the data subjects are under this Policy

2.1 This Policy mainly applies to the processing of data about:

• Platform Users (administrators and team members of businesses);
• on an ancillary basis, data about end customers, pet owners and animals that the business records in Petzara (for example, in appointments or records).

2.2 The public availability page linked to the business's URL does not require the pet owner to log in; Petzara does not collect identified personal data from visitors on that screen beyond what the browser and usual providers process (see section 8). Subsequent contact may take place through WhatsApp or another external channel, and the content of that conversation is outside the control of this Policy.

3. Personal data we may process

Depending on the features used, we may process the categories below.

3.1 Account and authentication data (Users)

• Identification: name, business name, email address, phone number;
• authentication: password hash, email verification tokens, password recovery tokens, Google identifier when social login is used;
• session: access token (JWT) and refresh token (for example, in an httpOnly cookie);
• relationships: role (administrator or team member), reference to the account holder (owner), department, invitations;
• preferences: theme, calendar sort order, public URL, URL activation, simultaneous service limits, working hours settings and similar.

3.2 Subscription and payment data (SaaS)

• Subscription identifiers and status with the payment provider used: Google Play (purchase token, order number, product, plan and, when the purchase uses a Google Play free period, the offer identifier and the end date of that period) or Stripe (customer, subscription); current period, trial period, billing dates, status (active, in trial, past due, canceled, etc.).

We do not process the full credit card number on our application servers; payment processing is carried out by Google Play or Stripe, depending on the provider used for the purchase.

3.3 Operational data entered by the business

• Clients: name, email, phone number, address (street, number, unit, neighborhood, city, state, postal code), notes;
• Pets: name, species, breed, size, date of birth, notes, optional link to a client;
• Appointments: animal and owner details (name, phone number), services, amounts, date and time, status, staff member responsible;
• Finances: entries (description, amounts, categories, dates, payment methods, links to appointments, depending on use);
• Notifications generated by the Platform.

3.4 Communication and support data

• Messages sent through authenticated support channels (name, email, subject, content);
• records of transactional emails (account confirmation, invitations, password reset), sent through an email provider.

3.5 Technical and security data

• Error and performance records through tools such as Sentry (may include technical device and browser data, IP address in incidents, stack traces);
• server and traffic logs at the infrastructure level, where applicable;
• information needed for fraud prevention and account security.

4. Purposes of processing

We process personal data to:

1. Register, authenticate and manage accounts of administrators and team members;
2. Provide and operate Petzara's features (calendar, records, finances, notifications, public availability page);
3. Bill and manage subscriptions (including the trial period, when offered), through Google Play or Stripe;
4. Communicate with the User (transactional email, support);
5. Comply with legal obligations and respond to legitimate requests from authorities;
6. Protect rights, prevent fraud and ensure the security of the Platform;
7. Improve the stability and quality of the service (error diagnostics with Sentry and related technical data);
8. Comply with this Policy and the Terms of Use.

5. Legal bases (LGPD)

Depending on the case, we rely on the following legal bases, under Article 7 of the LGPD:

Where consent is required (for example, for optional, non-essential communications), it will be requested prominently.

6. Sharing data with third parties

We may share data with providers acting on our behalf or as part of the service infrastructure:

We require contracts or clauses ensuring data is processed in accordance with the LGPD, to the extent applicable (including sub-processor operations).

7. International data transfers

Some providers (such as Google (including Google Play and Google Analytics), Meta, Stripe, Sentry or Resend) may process data on servers located outside Brazil, including in the United States or the European Union.

In these cases, we adopt the measures provided for in the LGPD (Articles 33 to 36), such as standard contractual clauses, certifications or other compatible safeguards, and we inform data subjects of this possibility in this Policy.

8. Cookies, local storage and similar technologies

8.1 We use cookies that are strictly necessary for the session, including an httpOnly cookie for the refresh token (security and domain settings depend on the environment, for example .petzara.app in production).

8.2 The access token may be stored in the browser's local storage (localStorage or similar) to keep the User signed in.

8.3 Use of "Sign in with Google" is subject to Google's cookie and privacy policies.

8.4 On the company website (petzara.app) we may use third-party audience measurement and advertising tools — Google Analytics 4 (Google) and Meta Pixel (Meta Platforms) — to understand how the site is used (page views, clicks on "create account", "WhatsApp" and "Google Play") and to measure campaigns. These tools are only loaded after you consent in the cookie banner ("Accept"). If you click "Decline", they are not loaded. Your choice is saved in the browser's local storage and can be changed at any time under "Cookie preferences" in the site footer. Legal basis: consent (Article 7, I, of the LGPD). Data collected by these tools is also processed under Google's and Meta's policies and may be processed outside Brazil (see section 7).

8.5 The system (app.petzara.app) and the Android app do not use advertising cookies for marketing profiling.

9. Information security

We take reasonable technical and organizational measures, such as:

• HTTPS communication in production;
• password hashing;
• short-lived access tokens with controlled renewal;
• rate limiting on sensitive operations (for example, checkout);
• error monitoring and restricted infrastructure access.

No system is completely secure. In the event of a security incident that may pose a risk to data subjects, we will notify the authorities and those affected when required by law.

10. Data retention

10.1 We keep data for as long as necessary to fulfill the purposes described, in compliance with legal retention periods (tax, civil, etc.).

10.2 Accounts that do not subscribe at the end of the free trial switch to read-only mode, and their data (registration, clients, pets, appointments and finances) remains stored for as long as the account exists — there is no automatic deletion for lack of a subscription. The User may, at any time, export data (for example, appointments as CSV or XLSX, in Settings; other data upon request through the channel in section 14) or request deletion of the account (under Settings › Delete account or through the channel in section 14).

10.3 After an account is closed, we may retain data for an additional period to comply with legal obligations, resolve disputes or regularly exercise rights.

10.4 Logs and technical security data may be retained for shorter or longer periods, according to internal policy and the law.

11. Data subject rights (LGPD)

Under Article 18 of the LGPD, data subjects may request:

• confirmation that processing exists;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
• portability, where applicable;
• deletion of data processed based on consent, subject to legal exceptions;
• information about data sharing;
• withdrawal of consent, where the basis is consent.

11.1 Requests may be made through the contact channel in section 14. We may request information to verify identity.

11.2 Some requests can be handled directly by the User on the Platform itself (editing records, exporting appointments and deleting the account). Data processed by Stripe or Google may also require a request made directly to those providers.

11.3 Data subjects may file a petition with Brazil's National Data Protection Authority (ANPD).

12. Automated decisions

Petzara currently does not make decisions based solely on automated processing that significantly affect data subjects without human review. If features of this kind are introduced, this section will be updated.

13. Children and adolescents

The Platform is intended for business owners and professionals. We do not direct our services to children. Data about minors may only appear as part of the records entered by the business (for example, a pet owner who is a minor); in those cases, the controller with respect to the minor is the business, which must comply with Articles 14 and 20 of the LGPD.

14. Contact

To exercise your rights or ask questions about privacy or this processing:

• Email: suporte@petzara.app
• Support on the Platform: authenticated form under Support, when available

15. Changes to this Policy

We may update this Policy to reflect legal changes or changes to the Platform. The date at the top will be revised. Material changes may be communicated by email or through a notice in the application.

16. Relationship with the Terms of Use

This Policy supplements the Terms of Use. In the event of a conflict regarding data processing, the provisions of this Policy prevail on privacy matters, unless the law provides otherwise.