Privacy Policy

1. What this covers

This explains what personal data CityPet collects, why, who we share it with, and what rights you have over it. It applies to owners, sitters, and anyone whose details an owner or sitter provides to us (for example, an emergency contact) — see Section 8 for that last group specifically.

2. What we collect

• Account and identity data: name, date of birth, email, phone number, and — for verification — identity documents and liveness/biometric checks, processed on our behalf by our identity verification provider.
• Owner-specific data: address, emergency contact details, entry/alarm instructions, and similar home-access information. Entry and alarm codes and utility shut-off locations are encrypted at rest, on top of our database provider’s own storage encryption, and are only ever shown to a sitter who has accepted a specific booking with you.
• Sitter-specific data: insurance and DBS documents (where provided), Stripe Connect payout account details, and postcode-derived location data used to match you with nearby bookings.
• Booking and payment data: booking history, payment records (processed by Stripe — we never see or store full card details), and visit reports (feeding, toileting, behaviour notes, and photos/videos of each visit).
• Messages: chat between an owner and a sitter tied to a specific booking or expressed interest. This is access-controlled, not end-to-end encrypted — see Section 6.
• Technical data: IP address and device/port information logged at account creation and on every login for a rolling window, and at the point any content is uploaded — retained specifically to support our legal reporting duties (Section 5) and account security, not for general analytics.

3. Why we process it, and on what legal basis

• Performing the contract with you — creating your account, matching owners and sitters, processing bookings and payments.
• Legal obligation — identity and insurance verification, the CSAM detection and NCA reporting duty described in Section 5, and financial record-keeping.
• Legitimate interests — fraud prevention, platform safety (conduct reports, ranking based on cancellation history), and service improvement.
• Consent — where we ask for it specifically (for example, particular notification channels).

4. Who we share it with

We share personal data with the following processors, each acting on our instructions under their own agreement with us:

• Stripe — payment processing and sitter payouts.
• Supabase — our database, authentication, and file storage provider.
• Our identity verification provider — ID and insurance-document verification.
• Sightengine — automated content moderation of uploaded photos/videos.
• The DBS Update Service (gov.uk) — where a sitter gives us their DBS certificate details, we confirm the certificate is current using the government’s free online service. DBS acts as a public authority here, not our processor.
• Twilio — sends notification text messages (to your phone number, if you’ve chosen SMS), and routes a masked call between a sitter and an owner or their emergency contact without either party’s real number being shared with the other.
• Resend — sends notification emails (booking updates, reminders, and similar) to your email address.

[Data processing agreements with each of the above are being finalised — see the internal build spec’s compliance checklist.]

5. Content moderation and mandatory reporting

Every photo and video uploaded to CityPet is automatically scanned before it’s shown to anyone else. CityPet is legally required, as a regulated user-to-user service, to detect and report suspected child sexual abuse material to the National Crime Agency — content matching this is never shown to anyone and is reported as required by law, with no notification to the uploader. Separately, and unrelated to that legal duty, we also block general nudity/inappropriate content as our own content policy; a user affected by that is told their content was removed, without detail that would help circumvent the check.

6. Message privacy

Chat between an owner and a sitter is private by access control — only the two people in that conversation, and CityPet staff where legally necessary or where you report a message, can see it. This is not end-to-end encryption: CityPet could technically access message content under legal compulsion, which is a meaningfully weaker guarantee than true end-to-end encryption, and we think you should know that plainly rather than have it implied.

7. How long we keep it

• Visit report photos/videos and chat photos are retained for 90 days on a rolling basis, extended by a further 90 days if the content is under an active dispute.
• Financial and verification records are kept for the periods required by law. [Exact statutory periods to be confirmed.]
• If you delete your account, your own messages in a shared conversation are anonymised rather than deleted outright, so the other person’s side of the conversation stays intact.

8. If you're an emergency contact, not a CityPet user

An owner may give us your name and phone number as their emergency contact. We hold this only to route a masked call to you if a sitter needs to reach you during an active visit, and to log that the call happened (never the call content, and never either real phone number in that log). You can ask the owner who listed you to update or remove this at any time.

9. Your rights

You can request a copy of your data or ask us to erase it from your account settings — we log every such request and confirm once it’s complete. You also have the right to object to or restrict certain processing, and to complain to the Information Commissioner’s Office if you think we’ve got something wrong.

10. Automated decisions

A narrow set of dispute types (a no-show, a duplicate charge, a missing refund, a cancellation timing disagreement) can be resolved automatically from your account’s own booking data. This is always labelled to you as an automated decision, and you can ask for it to be reviewed by a person.

11. Changes to this policy

Each version of this policy is dated and versioned; your acceptance of a specific version is recorded with a timestamp, and we’ll ask you to re-accept if it changes in a way that matters. See our Terms of Service for the rest of the agreement between us.

12. Contact

[Contact email/address, and our ICO registration reference, to be added here.]