Privacy notice
Draft for launch. The operator's legal name and contact details must be completed, and this notice reviewed by a qualified adviser, before FIP Together is offered publicly.
Who we are
FIP Together (“we”) is operated by [operator name, address]. Contact: [privacy contact email]. We are the data controller for personal data processed through the service.
What we collect and why
- Account data (email, name, password hash managed by our authentication provider): to provide your account. Legal basis: contract.
- Cat and treatment records (profiles, prescriptions you enter, dose records, health journal, appointments): to provide the service you asked for. Legal basis: contract.
- Uploaded documents: veterinary reports may contain your name, address or clinic staff names. Stored privately and only shown to you. Legal basis: contract.
- Notification data (push subscription endpoints, preferences, delivery log): to send reminders you enabled. Legal basis: contract / consent for push permission.
- Donations: payment amounts and Stripe references. Card details are handled by Stripe, never by us. Legal basis: contract and legal obligation (accounting).
We collect only what the service needs. We do not sell data, show ads, or use your records to train AI models.
Who processes data for us
- Supabase: database, authentication and file storage (EU region recommended).
- Vercel: hosting.
- Resend: reminder emails, if you enable them.
- Stripe: payment processing for optional donations.
- Your browser's push service (e.g. Apple, Google, Mozilla): delivering notifications.
Retention
We keep your records while your account exists. When you delete your account, your records and files are deleted from our live systems immediately and from backups within the provider's backup retention period. Donation records are retained as required by accounting law.
Your rights
Under the GDPR you can access, correct, export, delete, restrict or object to processing of your data, and complain to your data-protection authority. You can export all data and delete your account yourself from Settings.
Security
Encrypted HTTPS connections, database row-level security so each record is only visible to its authorised users, private storage with short-lived signed download links, and an audit history of medication record changes.