Version: 1.0 Effective date: 24 September 2026 Last updated: 24 September 2026
This document is published in two languages. The Thai version above is the governing text; this English version is a convenience translation. In the event of a conflict, the Thai version prevails, except where the law of the user's jurisdiction requires otherwise.
1. Introduction and scope
pawVerse (the "App" or the "Service") is a pet care and pet record application that lets you store pet profiles, health records, photos, and day-to-day care tasks and reminders. It is developed and operated by [ชื่อ-นามสกุลผู้พัฒนา], an independent developer acting as an individual (natural person) and not as a company ("we", "us", "our").
This Policy explains how we collect, use, disclose and retain your personal data when you use the App, our website at [https://pawverse.app], or contact our support channels.
Scope. This Policy applies to personal data of natural persons. Information about your pets (name, breed, health history) is not itself personal data of an individual, but because it is linked to your account and may indirectly identify you, we protect pet information to the same standard as your personal data.
Laws we align with
| Law | Applies to |
|---|---|
| Thailand Personal Data Protection Act B.E. 2562 (PDPA) | Users in Thailand and processing carried out in Thailand |
| EU/UK General Data Protection Regulation (GDPR) | Users located in the EEA and the United Kingdom |
| California Consumer Privacy Act as amended by the CPRA (CCPA) | California residents |
Where local law provides greater protection than this Policy, the stronger protection applies.
2. Controller and contact details
| Item | Detail |
|---|---|
| Data controller | [ชื่อ-นามสกุลผู้พัฒนา] — independent developer (natural person) |
| Legal status | Individual; not incorporated as a legal entity |
| Contact address | [ที่อยู่ติดต่อ] |
| Privacy contact | [privacy@pawverse.app] |
| User support | [support@pawverse.app] |
Note: pawVerse is built and maintained by one individual, not a company. Given the scale and nature of the processing, no Data Protection Officer is required under PDPA section 41 or GDPR Art. 37, so none has been appointed; you can contact the developer directly at the address above. Should that change, we will appoint one and announce it.
3. Definitions
- Personal data — information relating to an identified or identifiable natural person.
- Processing — any operation performed on personal data (collection, use, disclosure, transfer, erasure).
- Controller — the party that determines the purposes and means of processing.
- Processor — a party that processes personal data on the controller's instructions, such as a cloud provider.
- Account — your pawVerse user account, linked to an email address or a third-party identity provider.
- User content — data you create or upload to the Service, including pet profiles, photos, tasks and health records.
4. Personal data we collect
4.1 Data you provide
| Category | Details | Required? |
|---|---|---|
| Account data | Email address, password (stored only as a one-way salted hash), email/phone verification status | Required to register |
| Profile data | Display name, phone number (optional), profile photo | Optional |
| Pet data | Name, species, breed, sex, date of birth/age, weight, coat colour, microchip number (optional), photos | Optional but central to the Service |
| Pet health records | Vaccinations, deworming, surgeries, weight history, observed symptoms, vet visit notes | Optional |
| Tasks and reminders | Task category (food, medication, walk, cleaning, appointment, observation, surgery, other), due date, time of day, your time zone, recurrence pattern, reminder lead time | Optional |
| Notification preferences | Which notification types you enable or disable | Optional |
| Support correspondence | Message content, your email address, attached screenshots | Only when you contact us |
Time zone and time of day are needed to compute reminders according to your intent (for example, a 06:00 medication in your local time). We use them solely for scheduling — never to determine your location.
4.2 Data collected automatically
| Category | Details |
|---|---|
| Device data | Device model, OS and version, app version, system language |
| Connection data | IP address, request timestamps, API endpoint called, response status |
| Event and crash logs | Application errors, used for diagnostics |
| Push tokens | Device token used to deliver notifications (collected once you grant notification permission) |
What we do not collect
- We do not collect GPS coordinates or continuous location data.
- We do not access your contacts, calendar, or entire photo library — only the files you explicitly choose to upload.
- We do not store payment card or bank account numbers on our systems. If paid plans are introduced, payments will be handled by the app stores or a payment provider.
- We do not intend to collect sensitive personal data about you under PDPA section 26 or GDPR Art. 9 (such as your own health data, race, religion, or political opinions). Please do not enter such information in free-text fields.
4.3 Data from third parties
If you sign in with Google, Apple or Facebook, we receive the account identifier, name and email address that the provider shares with your permission. We never receive your password for those accounts.
Current status: third-party sign-in is still under development and not yet enabled. This section takes effect when the feature ships.
4.4 Data about other people
If household or shared-care features are introduced, another person's data is collected when they create their own account. You are responsible for informing anyone whose contact details you give us.
5. Purposes and legal bases
| # | Purpose | Data used | PDPA basis | GDPR basis |
|---|---|---|---|---|
| 1 | Create and maintain your account, authenticate you, keep you signed in | Account, profile | s.24(3) contractual necessity | Art. 6(1)(b) |
| 2 | Deliver core features — pet profiles, photos, health records | Pet, health, media | s.24(3) | Art. 6(1)(b) |
| 3 | Compute and deliver task reminders at the time you set | Tasks, time zone, push token | s.24(3); consent for push | Art. 6(1)(b) + OS-level consent |
| 4 | Security, abuse prevention, fraud detection | Connection and device data | s.24(5) legitimate interest | Art. 6(1)(f) |
| 5 | Diagnose faults and improve reliability | Event logs, crash logs, aggregated usage | s.24(5) | Art. 6(1)(f) |
| 6 | Respond to support requests | Contact details, message content | s.24(3)/(5) | Art. 6(1)(b)/(f) |
| 7 | Marketing emails, newsletters, surveys | Email, name | Consent (s.19) — withdrawable at any time | Art. 6(1)(a) |
| 8 | Comply with law, court orders and regulators | As legally required | s.24(6) | Art. 6(1)(c) |
| 9 | Establish, exercise or defend legal claims; enforce our Terms | As necessary | s.24(5) | Art. 6(1)(f) |
We do not
- sell or rent personal data to third parties for their own marketing;
- make solely automated decisions producing legal or similarly significant effects (GDPR Art. 22);
- train artificial-intelligence models on your user content unless you give separate, explicit consent.
If we ever intend to process your data for a new, incompatible purpose, we will notify you and obtain consent first.
6. Cookies and similar technologies
The App uses on-device storage to keep you signed in (authentication and refresh tokens), remember settings such as notification toggles and the first-launch flag, and cache data for faster rendering. Our website uses strictly necessary cookies, and uses analytics cookies (Google Analytics) only after you choose "Accept" on the cookie banner. You can change this at any time from the "Cookie settings" link in the website footer or in your browser settings. Clearing app data or uninstalling the App removes locally stored data.
7. Disclosure and transfers
7.1 Processors acting on our behalf
| Type of provider | Role | Data involved |
|---|---|---|
| Cloud infrastructure (Google Cloud Platform) | Runs our backend; stores media in a private storage bucket | Account, pet data, photos |
| Database provider (MongoDB Atlas) | Stores structured records | Account, pets, tasks, health records |
| Push provider ([ชื่อผู้ให้บริการ Push]) | Delivers notifications to your device | Device token, notification payload |
| Analytics and crash reporting ([ชื่อผู้ให้บริการ Analytics]) | Aggregate usage statistics and crash reports | Pseudonymous device identifiers, crash data |
| App stores (Apple App Store / Google Play) | Distribution and payments, if any | Data the stores collect under their own policies |
All processors are bound by data processing agreements permitting processing only on our documented instructions.
7.2 Legal disclosure
We may disclose data in response to a court order, subpoena or other lawful request, or where necessary to prevent serious harm to a person's life or safety. We review the lawfulness of every request and notify you where legally permitted.
7.3 Change of operator
The controller is currently the developer as an individual. If the developer later incorporates a company, hands the Service over to another operator, or transfers related assets, your data may be transferred to that successor, who will be bound by protections no weaker than this Policy. We will give you at least 30 days' prior notice by email or in-app announcement so you can export your data or close your account if you prefer not to be transferred.
7.4 International transfers
Our infrastructure may be located outside Thailand. Cross-border transfers are made under appropriate safeguards required by PDPA sections 28–29 and GDPR Chapter V — an adequacy decision, or Standard Contractual Clauses combined with technical measures such as encryption.
8. Data retention
We keep personal data only as long as necessary for the purposes described. After the retention period we delete, destroy or anonymise it.
| Data | Retention period | Reason |
|---|---|---|
| Account and profile data | For the life of the account, plus 30 days after a deletion request (recovery grace period) | Protects against accidental deletion |
| Pet data, health records, tasks, reminders | Same as the account | Bound to the account |
| Media files in private storage | Deleted within 90 days of permanent account deletion, or of your deleting the record that referenced the file | Storage clean-up cycle |
| Records you delete yourself | Marked deleted immediately; permanently removed within 30 days | Supports recovery and schedule integrity |
| Access and security logs | 90 days to 12 months | Security investigation and computer-crime law obligations |
| Crash logs | 12 months | Recurring-defect analysis |
| Push device tokens | Until you disable notifications, uninstall, or the token expires | Required to deliver reminders |
| Support correspondence | 24 months after closure | Quality assurance and audit |
| Tax records (if paid features exist) | 5 years | Thai Revenue Code — the developer files as an individual taxpayer |
| Consent and withdrawal records | 5 years after withdrawal | Demonstrating PDPA compliance |
| Data relevant to a dispute or claim | Until the matter and any limitation period ends | Legal claims |
Exceptions. We may retain data longer where required by law, by a regulator's order, or during a dispute, and may retain anonymised data indefinitely for statistics.
Backups. Deleted data may persist in encrypted backups for up to 90 days before being overwritten in the normal backup rotation. It is not used for any other purpose during that period.
9. Security measures
Consistent with PDPA section 37 and GDPR Art. 32, we apply:
- Encryption in transit — all app-to-server traffic uses TLS.
- Encryption at rest — database and object storage are encrypted at the cloud provider level.
- Hashed passwords — stored with a one-way salted hash; not even the developer can read your password.
- Private media storage — pet and profile photos live in a non-public bucket. Access requires a temporary signed link valid for approximately one hour, issued only to the owner of the file, so a leaked link expires on its own.
- Least-privilege access control — backend access is limited to the developer and anyone they authorise in writing, with access logging.
- Per-user isolation — every API request verifies ownership before returning data.
- Ongoing review — access reviews, patching, and dependency monitoring.
Limitation. No system is completely secure. Please use a strong, unique password, do not reuse it elsewhere, do not share your account, and sign out on shared devices. To report a vulnerability, contact [privacy@pawverse.app]; we will not pursue legal action against good-faith researchers who avoid causing harm.
10. Your rights
10.1 Under the PDPA (Thailand)
Right to be informed (s.23); access and obtain a copy (s.30); data portability (s.31); object to processing (s.32); erasure or destruction (s.33); restriction of use (s.34); rectification (s.35–36); withdraw consent at any time (s.19); and lodge a complaint with the PDPC (s.73).
10.2 Under the GDPR (EU/UK)
Rights of access, rectification, erasure, restriction, objection, portability, and not to be subject to solely automated decision-making (Arts. 15–22), plus the right to complain to your local supervisory authority.
10.3 Under the CCPA/CPRA (California)
The right to know categories, sources, purposes and recipients; to delete and to correct; to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as defined by the CCPA, and we have never sold the personal information of consumers under 16; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
10.4 How to exercise your rights
Email [privacy@pawverse.app] from or quoting the address on your account, stating which right you wish to exercise. We may request additional information to verify your identity before acting, so that we do not disclose your data to someone else.
| Jurisdiction | Response deadline |
|---|---|
| Thailand (PDPA) | Within 30 days of receipt |
| EU/UK (GDPR) | Within one month, extendable by up to two further months for complex requests |
| California (CCPA) | Acknowledge within 10 business days; respond within 45 days, extendable by a further 45 days |
Exercising your rights is free of charge unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse it with reasons. You may complain to a supervisory authority at any time.
Current status: the App does not yet provide in-app "export my data" or "delete my account" buttons, so please use the email channel above. We will process your request within the deadlines stated and will announce the in-app controls when they ship.
11. Children's data
- Thailand: where a user is under 20 and not emancipated by marriage, consent must be given by the person with parental authority under PDPA section 20; for users under 10, the holder of parental authority consents on their behalf.
- EU/UK: users must be at least 16, or the lower age set by the relevant member state (minimum 13).
- United States: we do not knowingly collect data from children under 13 (COPPA).
If we learn that we hold a minor's data without valid consent, we will delete it without delay. Parents who believe their child has provided data should contact [privacy@pawverse.app].
12. Data breach notification
If a personal data breach occurs we will: (1) contain and assess it immediately; (2) notify the PDPC and any relevant EU/UK supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (PDPA s.37(4); GDPR Art. 33); (3) notify affected users without undue delay, with remediation guidance, where the breach poses a high risk to their rights and freedoms (GDPR Art. 34); and (4) record the incident, its cause and the remedial action taken.
13. Changes to this Policy
We may update this Policy as the Service or the law changes. Ordinary updates are published in the App and on our website with a revised "last updated" date. Material changes — new purposes, new recipients, or extended retention — will be notified at least 30 days in advance by email or in-app notice, and we will obtain fresh consent where the law requires it. Previous versions remain available at [https://pawverse.app]/legal/privacy/archive.
14. Contact and complaints
- Privacy: [privacy@pawverse.app]
- Support: [support@pawverse.app]
- Controller: [ชื่อ-นามสกุลผู้พัฒนา] (natural person) — postal address [ที่อยู่ติดต่อ]
If you are dissatisfied with our response, you may complain to: the Personal Data Protection Committee (PDPC), Thailand — https://www.pdpc.or.th; your local EU supervisory authority; the UK ICO — https://ico.org.uk; or the California Privacy Protection Agency / California Attorney General.