Privacy policy

Who we are

PetLocate (petlocate.uk) is run by Paul Mallon, a sole trader trading as Tindish, based in the United Kingdom. For the purposes of UK data protection law, he is the controller of the personal information described in this policy. In this policy, "we", "us" and "our" mean PetLocate.

For anything to do with your personal information, email privacy@petlocate.uk.

The short version

• We collect only what's needed to reunite pets with their owners and keep the service safe.
• Nothing about you or your pet is shown publicly unless you choose to show it.
• A finder can always reach you through PetLocate, but they never see your contact details unless you decide to share them for that particular case.
• We don't sell your information, and we don't currently show adverts or use advertising or tracking cookies.
• You can see, change or delete your information at any time, and deleting your account deletes your pets too.

What we collect

If you register as an owner

• Account details: your name, email address and password. We store your password only in a scrambled (hashed) form we can't read. If you set up two-factor authentication or a passkey, we store what's needed to check it.
• A profile picture, if you add one: shown only to you, never to finders, professionals or the public. We crop it to a small square and remove its hidden data (such as where it was taken). Replacing or removing it deletes the old one.
• Contact details you choose to add: your town or city, a UK phone number (stored encrypted) and how you'd prefer a finder to contact you.
• Your pets: their name, species, breed, colours, markings, sex, whether they're neutered, date of birth, microchip number, any other ID number you add (such as a leg ring or another tag's number), the messages you write for finders, your vet's contact details, medical notes and photos.
• When your pet is lost: where and when they went missing, and anything else you add to the report.
• Messages: what you send to finders through PetLocate, and what they send you.

If you look up a pet or report finding one

• Lookups: you don't need an account to enter a PetLocate ID, microchip number or other ID number. We record the number entered, the time, and a shortened form of your IP address that can't identify you. We don't work out where you are from it. We never store the full IP address with a lookup.
• Reports to us: if you use "Report a problem", we keep what you tell us, your email if you give it, and a shortened form of your IP address that can't identify you, for a year after we've dealt with the report. We never tell the person you reported who you are. If a report means we need to involve the police or another authority, we may share it with them.
• Found reports and messages: your name, email address, optional phone number, where and when you found the animal, your message, any photo you add, and a shortened form of your IP address. The owner sees your first name, where you found the animal, your message and photo, and your phone number only if you give it. They never see your email address. If the owner reports your message as spam or abuse, we'll review it.

If you apply for a professional account

• Your organisation: its name, type, address, phone number, website and registration number, and your role there. We use these to check you're genuine, by looking at the organisation's website and public listings and checking that your account email is on its domain.
• What you do with it: every pet you look up while signed in, and every pet you record as in your care, with the time. We show the pet's owner your organisation's name, town and phone number, never your own name or email address.

Photos

Photos taken on phones often contain hidden location data showing exactly where they were taken. We remove this, and any other hidden data, from every photo as it's uploaded, and we don't keep the file you uploaded. So a photo of your pet in the garden can't reveal your address. Your pet's photos are only shown to the people your sharing settings allow.

Technical information

Like every website, our server receives your IP address and basic browser information when you visit. Our server's access logs keep only a shortened IP address (the last part removed, so it can't identify you or your home), the page visited without any search details, and your browser type, for a short time, to protect the site against attacks and diagnose faults. We don't use them to track you or build a profile.

Why we use it, and our lawful basis

UK data protection law requires a lawful basis for each use of your information. Ours are:

What we do	Lawful basis
Run your account, store your pets' details, issue PetLocate IDs, and tell you when someone finds or matches your pet	Contract: it's the service you signed up for
Pass a finder's message to an owner, and the owner's reply back	Legitimate interests: getting a lost animal home, which is why the finder contacted us
Match found reports against pets reported lost nearby	Contract for owners; legitimate interests for finders
Check professional accounts, give them the details owners share with professionals, and tell owners which organisations looked up or took in their pet	Legitimate interests: getting found animals home, and letting owners see who has seen what
Send essential emails, such as confirming your address, password resets and alerts about your pet	Contract
Answer questions and feedback you send us, by email or the contact form	Legitimate interests: helping you, and improving PetLocate
Prevent spam, scams, fake reports and misuse, including rate limits and reviewing reported messages	Legitimate interests: keeping owners, finders and animals safe
Keep records needed to deal with legal claims or meet legal obligations	Legal obligation, or legitimate interests

If you turn on phone alerts on a device, we keep the address your browser's push service gives us for that device, the keys to encrypt alerts to it, and a short label such as "iPhone", so you can see where alerts are on. We use them only to send you alerts. Turn alerts off on that device or remove it in your settings, or delete your account, and they're deleted. The push service may also tell us the address no longer works, and we delete it then.

We send emails about your account and your pets: a welcome email when you join (which you can reply to with questions or feedback), alerts when someone may have found your pet, and messages about your account. We don't send marketing emails. If that ever changes, we'll only send them if you've opted in, and you'll be able to opt out at any time.

Matching lost and found reports is automated: we compare species, colours and location to suggest possible matches. A suggestion is only ever passed to the owner to look at. No decision with legal or similarly significant effects is made about anyone automatically.

You don't have to give us any information, but we can't create an account without a name, email address and password, or pass on a found report without a way to reply to you.

Who can see your information

• The public: nothing, unless you choose. You decide, detail by detail, whether anything about your pet is shown publicly, and you can make some details visible only while your pet is missing. Your own name, email address and address are never shown publicly. Your phone number isn't either, unless you choose to show it while your pet is missing; it comes down when you mark them as home, or sooner if you stop it.
• Finders: when someone enters your pet's PetLocate ID, microchip number or other ID number, they see only what you've chosen to make visible, and can send you a message through us. Your contact details are only shared with a finder if you choose to release them for that case.
• Other owners sharing a number: ring and tag numbers aren't unique, so if a finder enters one that more than one pet has, the finder sees what each owner has chosen to make visible, and each owner gets the message. No owner sees anything about the others.
• Vets, rescues and dog wardens: organisations we've checked by hand can have a professional account. When one looks up your pet, it sees only the details you've chosen to show to professionals (and anything public). Every one is listed on your pet's page, and we email you (at most once a day for each organisation). If one records your pet as in its care, you get its name and phone number, and you can choose to share your pet's medical notes and vet details with that organisation only while your pet is there. Your own contact details are never shared with them.
• Us: we only look at your information when we need to, for example to help with a problem you've raised, review a report of misuse, or keep the service running.

Anything you do choose to make public can be seen, copied and kept by anyone, including search engines. If you later make it private again, we remove it from our site, but we can't remove copies made elsewhere. We'll remind you of this before you make anything public.

Who we share it with

We don't sell or rent your information. We share it only with:

• Hetzner Online, which hosts our servers and database in the European Economic Area.
• IONOS, which provides our email service, to send you emails and receive the ones you send us.
• Your browser's push service (Google for Chrome, Edge and Android; Apple for iPhone, iPad and Safari; Mozilla for Firefox; Microsoft for some Windows apps), only if you turn on phone alerts. It passes our alerts to your device. Each alert is encrypted so the push service can't read it, and never includes your pet's name or any details.
• postcodes.io, a free UK postcode service. If you give a postcode when you report your pet missing, we send it the postcode alone, with nothing to identify you, to find the area for matching. If you search the lost pets board by postcode, we send it only the first half (like LS8), and don't keep what you searched for.
• OpenStreetMap, for the map on the lost pets board. It loads only if you choose to open the map. Your browser then fetches the map pictures from OpenStreetMap, which sees your IP address, as any website does. We send it nothing about you or any pet.
• Other people using PetLocate, only as described above and only as you choose.
• The police, courts or other authorities, if the law requires us to, or where it's necessary to protect someone's safety or prevent fraud.
• A buyer or successor, if PetLocate is ever transferred to another organisation, who would have to keep honouring this policy.

Our hosting and email providers act only on our instructions and under contracts that require them to protect your information. Your information is stored in the UK and the European Economic Area, which the UK recognises as giving equivalent protection. If that ever changes, we'll use the legal safeguards UK law requires and update this policy.

If a microchip number isn't registered with us, we point the finder to the official UK microchip databases. We don't pass any information to those databases ourselves.

How long we keep it

Information	How long
Your account and your pets	Until you delete your account. Deleting it removes your account, your profile picture, your pets and their photos straight away.
Missing pet reports	Deleted 6 months after they're made, or when your pet is marked as home if that's later. Where your pet went missing is removed as soon as you mark them as home.
Messages from finders, and found reports	Deleted 6 months after they're sent. For a found report, your contact details and photo go sooner: 30 days after you found the animal, when we stop checking it against new missing pets. That includes the copy we passed to any owner, unless they've replied to you: then the rule below applies instead.
A finder's contact details	Removed 30 days after the case is closed.
Lookup records (approximate location and shortened IP address), including which organisation looked, for professional lookups	12 months.
Professional accounts and records of pets in an organisation's care	Until the account is deleted. Withdrawn or turned-down applications stay with the account until then, so we can see what we decided before.
A record that a pet got home (the date, whether the owner or a vet or rescue recorded it, and whether a finder had reached the owner through PetLocate), used only to count reunions	Kept. If the pet or your account is deleted, the link to the pet is removed, leaving only the date.
Our record of moderation decisions (for example a page taken down or an account suspended): which record, what we did, when, and any note we made	2 years, so we can deal with appeals and repeated misuse.
Server access logs	Up to 14 days.
Backups	Up to 30 days. Deleted information can remain in a backup until that backup expires, but it's never restored back into the service.
Emails and contact form messages you send us (the form sends us an email; we don't store it anywhere else)	As long as needed to deal with them, and no more than 2 years.

We may keep information longer if we need it to deal with a legal claim or a report of misuse, and only for as long as that takes.

Cookies

We only use cookies that are strictly necessary for the site to work, so we don't need to ask for your consent and you won't see a cookie banner. We don't use analytics, advertising or tracking cookies, and no third party sets cookies through our site.

Name	What it's for	How long
petlocate-session	Keeps you signed in as you move between pages, and remembers form errors	2 hours of inactivity
XSRF-TOKEN	Protects forms against cross-site request forgery	2 hours of inactivity
remember_web_…	Keeps you signed in on this device, only if you tick "Keep me signed in"	Up to 400 days, or until you sign out
petlocate_preview	Lets invited testers see the site before launch	Until you close your browser

Your choice of light or dark appearance is saved in your browser's own storage on your device. It never leaves your device.

Keeping it safe

Everything is sent over an encrypted connection. Passwords are hashed, phone numbers are encrypted, and photo location data is removed. Access to our systems is restricted and protected, and we keep our software up to date. No system is perfectly secure, but if a breach ever puts your information at risk, we'll tell you and the Information Commissioner's Office as the law requires.

Your rights

Under UK data protection law you have the right to:

• Access the information we hold about you, and get a copy.
• Correct anything that's wrong. You can change most of it yourself in your account.
• Delete your information. You can delete your account yourself at any time in your settings.
• Restrict how we use your information while a concern is looked into.
• Object to us using your information on the basis of legitimate interests.
• Data portability: receive the information you gave us in a common, machine-readable format.

To use any of these rights, email privacy@petlocate.uk. It's free, and we'll reply within one month. We may need to confirm who you are first, so that we don't give your information to someone else.

Children

You need to be 16 or over to create an account. Anyone can look up a PetLocate ID or microchip number, and if someone under 16 reports finding a pet, we use their details only to pass on their message and reply to them.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change significantly affects how we use your information, we'll email registered owners before it takes effect.

Contact and complaints

Questions or concerns about your information: privacy@petlocate.uk. We'd like the chance to put things right first, but you can complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113.