Privacy Policy

Pet parents trust flüf with deeply personal moments. Privacy, transparency, and reliability are non-negotiable for us, so this policy is written to be genuinely readable. If anything is unclear, just ask: care@flufapp.com.

This policy covers both the flüf website (flufapp.com) and the flüf web app (app.flufapp.com).

1. Who we are

flüf Technology Ltd is the data controller responsible for your personal data. We’re registered in England and Wales, company number 17049219, registered office 66 Paul Street, London, EC2A 4NA.

We’re registered with the Information Commissioner’s Office (ICO). Registration number: ZC187221

Data protection contact: care@flufapp.com.

2. What we collect

On the website: The website itself doesn’t ask you to hand over personal data. It uses only the cookies described in our Cookie Policy.

In the app, when you create an account:

• Your name and email address. By accepting our Terms of Service, you confirm you’re 18 or over. We don’t collect your date of birth.

Your name and email address are the only details we need; without them, we can’t create your account or provide the service. Everything you add about your pet is entirely optional: you choose what goes in the record.

In the app, as you use it:

• Your pet’s profile and record: the details you choose to add, such as species, breed, date of birth, health information, routines, behaviours, milestones, photos, and memories.

A note on photos: photos of your pet sometimes include people too. Please only upload images that include other people with their agreement, and be thoughtful about photos that include children.

• Records of share links you create, including when they were created and revoked.

Automatically:

• Usage data: how the app is used, such as which features are opened and which actions are completed. This is collected through our analytics tool only if you’ve consented through our cookie banner (see our Cookie Policy).
• Technical data needed to keep flüf secure and working, such as login sessions.

A note on pet data: information about your pet isn’t personal data on its own, but because it’s connected to your account, we protect the whole record to the same standard.

We don’t collect special category data about you, and we don’t ask for more than we need.

3. Why we use your data, and our legal basis

Under UK data protection law, we need a lawful basis for everything we do with your data. Here’s the full picture:

Providing the flüf app. Your account, your pet’s record, and sharing. This is the service you signed up for, so our legal basis is the performance of a contract.

Service emails. Login links, reminders, and record confirmations. These are part of providing the service, so the legal basis is the performance of a contract.

Understanding how flüf is used and improving it. Our legal basis is your consent, given through the cookie banner, and you can change your mind at any time.

Keeping flüf secure and preventing misuse. Protecting you and the service. Our legal basis is legitimate interests.

Meeting legal and regulatory obligations, where the law requires it, is a legal obligation.

A note on automated decisions: flüf suggests content and reminders based on the details you’ve added, like your pet’s breed and age. We don’t make any automated decisions about you that have legal or similarly significant effects.

We do not sell your personal data. We don’t use it for advertising. We won’t share it with third parties for their own purposes. And if we ever want to send you marketing emails in future, we’ll ask for your consent first, never by default.

4. When you share your pet’s record

Sharing is one of the things that makes flüf useful, so here’s exactly how it works:

• Only you can start a share. flüf never shares your pet’s record with anyone on its own.
• A share link gives read-only access to the pet information you’ve chosen to include, such as health details, routines, behaviours, and milestones. You can see what a link contains before you share it.
• Your own personal details, like your email address and date of birth, are never included in a share link.
• You set how long a link stays active, and you can revoke it at any moment. Revoking removes access instantly.

5. Who we share your data with

We use a small number of trusted providers to run flüf. Each one processes data only on our instructions, under a data processing agreement, and only in the UK/EU:

• A hosting provider runs the infrastructure behind the website and the app.
• An email service sends our transactional emails, like login links and reminders.
• An analytics tool helps us understand how flüf is used and only runs with your consent.
• A cookie consent tool remembers your cookie preferences.
• Productivity and support tools for our internal operations and support email.

If you’d like to know who our current providers are, just ask: care@flufapp.com.

We may also share data with legal or regulatory authorities where the law requires it.

6. Where your data is stored

Your data is stored and processed in the UK and EU. If any provider ever needs to process data outside the UK, we’ll only allow it with appropriate safeguards in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long do we keep your data

We only keep your information for as long as we need it to provide the service, meet our legal obligations, or resolve any issues.

Your account and your pet’s records. We keep these while your account is active. If you delete your account, we keep your data for 30 days in case you change your mind or deleted it by mistake. After that, your personal data and your pet’s records are permanently deleted, unless we’re legally required to keep certain information.

Usage analytics. We keep usage analytics for up to 12 months to help us improve flüf. After that, the data is deleted or permanently anonymised, so it can no longer be linked to you.

Support conversations. If you contact us, we keep support conversations for up to 12 months after your query is resolved. After that, they are securely deleted, unless we need to keep them longer to comply with the law or resolve an ongoing dispute.

Legal obligations. If we’re legally required to keep certain information, for example, to comply with applicable laws or respond to legal requests, we’ll keep it only for as long as required. Once that period ends, we’ll securely delete or anonymise it.

8. How we protect your data

We take reasonable and proportionate steps to protect your data from unauthorised access, loss, or misuse, including encryption in transit, access controls, and data processing agreements with every provider. No online system is completely secure, but we treat your data the way we’d want ours treated.

9. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you.
• Correct anything inaccurate.
• Delete your data (“right to erasure”). You can do this yourself in the app, or ask us.
• Restrict or object to certain processing.
• Take your data with you (“data portability”).
• Withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these, email care@flufapp.com. We’ll respond within one month free of charge. If a request is especially complex, the law lets us take up to two further months, and we’ll tell you if that’s the case. In the rare event a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we’ll always explain why.

10. If something’s not right: complaints

We have a formal process for handling data protection complaints, as required by the Data (Use and Access) Act 2025.

If you have a concern about how we’ve handled your data, you can raise it however suits you. The easiest way is to email care@flufapp.com with “Data protection complaint” in the subject line. We’ll treat it as a complaint and handle it the same way.

What happens next:

• We’ll acknowledge your complaint within 30 days of receiving it (our aim is much sooner).
• We’ll look into it properly and without unnecessary delay, and keep you updated if it takes time.
• We’ll tell you the outcome, what we found, and what we’ve done about it.

You also have the right to complain to the ICO at any time: ico.org.uk/make-a-complaint or 0303 123 1113. We’d appreciate the chance to help first, but that’s entirely your choice.

11. Children

flüf is for adults. You must be 18 or over to create an account, and we don’t knowingly collect data from anyone under 18. If you believe someone under 18 has given us their data, let us know, and we’ll delete it.

12. Cookies

We use cookies and similar technologies to keep flüf working and, with your consent, to understand how it’s used. Full details, including how to change your preferences at any time, are in our Cookie Policy.

13. Changes to this policy

We may update this policy as flüf grows. If we make a material change, we’ll tell you, for example by email or a notice in the app. The date at the top always shows the current version.

14. Contact

care@flufapp.com

Appendix A: Our current providers

This is the list of providers we use to run flüf, what each one does, and where they process data. We keep this list current. Last reviewed in July 2026.

• Railway hosts the infrastructure behind the flüf app. Data processed in the EU (Netherlands) region.
• Resend sends our transactional emails, like login links and reminders. Data processed in the EU.
• Mixpanel product analytics helps us understand how the app is used. Only runs with your consent. Data processed in the EU.
• Google Analytics website analytics. Only runs with your consent. Data processed in the US — Google is certified under the UK–US Data Bridge.
• Cookie preferences are remembered by flüf’s own cookie banner using a first-party cookie stored in your browser. There is no separate third-party consent tool, and your preference is not sent to another provider.
• Google Workspace for our internal operations and support email. Data processed in Google’s global data centres, including the US, under Google’s Cloud Data Processing Addendum and the UK–US Data Bridge (Google is certified under the Data Privacy Framework and its UK Extension).

Every provider on this list processes data only on our instructions, under a data processing agreement.