Privacy Policy

PetNimbus ("we," "our," or "us"), operated by GoodShift Private Limited (CIN: U63122BR2026PTC081407), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App") and services.

By accessing or using PetNimbus, you consent to the data practices described in this policy.

1. Introduction

Welcome to PetNimbus, operated by GoodShift Private Limited. We are committed to protecting your privacy and the privacy of your pets.

• Company: GoodShift Private Limited
• Jurisdiction: India
• Compliance: IT Act 2000, IT Rules 2011, Digital Personal Data Protection Act, 2023 (DPDPA)

2. Information We Collect

Personal Information

• Account information (name, email, phone number)
• Profile information (bio, location, date of birth)
• Identity verification documents (for verification feature)

Pet Information

• Pet profiles (name, species, breed, age, gender, weight)
• Pet photos (up to 10 photos per pet)
• Health records (vaccination history, medical certificates)
• Behavior information (temperament, training status)

Usage & Device Data

• Swipe history, match data, and chat messages
• Device model, OS version, and unique identifiers
• Precise GPS coordinates (only when using location features)
• Push notification tokens (FCM device tokens) for delivering appointment reminders and service updates.
• Precise GPS location during active walker sessions (with your consent, for walk tracking only).

3. Financial Hub — Data We Collect & Use

When you use the Pet Financial Hub to track your pet-related expenses, we collect:

• Expense records: Category, amount, date, description, and the pet each expense is linked to.
• Receipt images: If you choose to scan a receipt, the image is uploaded securely to our private cloud storage (AWS S3). Images are accessible only to your account.
• AI-parsed data: Receipt images are processed by OpenAI's API to extract expense details (amount, category, date). This processing uses anonymized data; no personally identifiable information is shared with OpenAI beyond what is visible in the receipt image itself.

Financial records are used solely to provide you with expense summaries and insights within the app. We do not share your financial records with third parties for advertising or any other commercial purpose.

4. Daily Diary & Pet Observations — Data We Collect & Use

When you use the Daily Diary or Pet Observations features, we collect and store the following — all strictly private to your account:

• Daily health observations: Mood (e.g., Happy, Anxious), appetite level, and energy level recorded per pet per day.
• Meal logs: Meal type, description, planned calories, whether the meal was fed, time of feeding, and your notes.
• Exercise logs: Activity type, planned duration, actual duration in minutes, and notes.
• Weight logs: Pet body weight in kilograms, recorded with a timestamp.
• General notes: Free-text observations you write about your pet's day.
• Health alerts: System-generated flags based on your pet's logged data (e.g., AVMA-based health warnings).

This data is used to provide streak tracking, daily care summaries, and health trend insights within the app. It is never shared with other users or third parties.

5. Smart Pet Match — How We Use Your Pet's Data

The Smart Pet Match feature displays a compatibility percentage (%) on adoption and mating listing cards. This score is computed in real-time using:

• Your pet's profile attributes: species, breed, age, temperament, vaccination status, and experience level.
• The listed pet's equivalent profile attributes.
• Your location preferences.

No additional data is collected for this feature. The compatibility score is derived entirely from existing profile information you have already provided and is not stored as a separate permanent record.

6. Vaccination Roadmap — Data We Collect & Use

When you use the Vaccination Roadmap, we collect and store:

• Vaccination records: Vaccine name, date administered, next due date, administering veterinarian's name, and any notes you add.
• Pet birth date: Required to calculate your pet's age in weeks and generate a WSAVA-compliant age-appropriate vaccination roadmap.
• Alert snooze preferences: Your choice to snooze specific vaccination reminders, stored per vaccine per pet.

Communications: If a vaccination's next due date is within 7 days, we may send an automated reminder email to your registered email address. Push notifications are sent when your pet enters a critical vaccination age window (based on WSAVA 2024 guidelines). You can manage all reminder preferences in the app's Notification Settings. Vaccination data is used only for your pet's health management and is never shared with veterinary authorities, insurers, or any third party without your explicit consent.

7. Daily Check-In & Streak Tracking — Data We Collect & Use

The Daily Check-In feature encourages consistent pet care. We collect:

• Completion flags: Whether your pet's daily meals were fed, exercises marked complete, and weight logged.
• Streak history: Up to 90 days of consecutive daily care records to calculate your current and longest care streaks.
• Completion rates: Aggregated weekly and monthly percentages calculated from your diary logs.

This data is tied to your account and is never shared with other users or third parties. It is used only to motivate consistent pet care and display your progress within the app.

8. B2B2C Appointment Services — Data We Collect & Use

When you book or use any professional pet service through PetNimbus (vet, groomer, walker, trainer, boarding, daycare, NGO), we collect and process the following data:

Booking Data

• Appointment details: Service type, business name, scheduled date and time, status.
• Pet health snapshot: Species, breed, age, vaccination status, health conditions — captured at booking time and shared with the service provider.
• Service intake form responses: Feeding instructions, behavioral notes, medical conditions, medications — provided by you and shared with the service provider only.
• Payment transaction data: Order ID, payment status, amount. Actual card/UPI data is processed by Razorpay (PCI DSS compliant); we do not store card numbers.

Service-specific Data

• Vet appointments: Clinical notes (diagnosis, treatment, prescriptions) entered by the attending vet after your visit. Stored in your appointment record and synced to your pet's vet records.
• Walker sessions: GPS route data captured during the walk session. Shown to you as a walk report. Stored for 30 days then deleted.
• Boarding: Care sheet data (feeding schedule, medications, behavioral preferences, emergency contact) provided by you for the duration of the stay.
• All service types: Appointment rating and optional comment submitted by you after the appointment.

How We Use This Data

• To facilitate booking confirmation and payment processing.
• To provide the service provider with the information they need to care for your pet.
• To generate your appointment history and pet care records in the app.
• To send appointment reminders and status updates via push notification and email.
• To calculate trust-based indicators used internally for service provider safety (see below).

Consumer Trust System

PetNimbus maintains an internal trust profile for each consumer based on appointment history (completion rate, no-show count, cancellation rate). This information is shared ONLY with service providers at the time of booking to ensure safety and is NEVER shown to other consumers, on your public profile, or used for any purpose other than platform safety.

Business User Data

Business accounts on PetNimbus (the separate petnimbus-business system) have their own data collection scope including: business owner identity (KYC documents), staff accounts, appointment records, payout history, and review responses. Business data is stored separately from consumer data. If you are a business user, the Privacy Policy applicable to your account is the same policy updated to reflect business-specific data types listed in this section.

KYC Documents (Business Only)

Identity verification documents (Aadhaar, PAN, Driving Licence, Passport) uploaded by businesses during verification are stored in a private AWS S3 bucket. These documents are accessible only via time-limited presigned URLs (valid 15 minutes). They are NEVER publicly accessible and are used only for identity verification purposes.

9. How We Use Your Information

Primary Purposes:

• Matching service - find compatible pets for mating or adoption
• Enable chat between matched users
• Verify identities and prevent fraud
• Personalize recommendations and provide customer support

10. Information Sharing

With Other Users: Public profile info is visible. Contact info is shared only after a mutual match.

Third-Party Service Providers / Sub-Processors: PetNimbus engages the following sub-processors strictly for the purposes stated. Each operates under a written agreement and meets the security and confidentiality standards mandated by the DPDP Act 2023.

• Amazon Web Services (AWS) — Cloud hosting and S3 object storage. Region: Asia-South-1 (Mumbai). Data processed: all application data at rest.
• Razorpay — Payment processing for Android subscriptions (recurring), B2B2C appointment deposits, NGO donations, and consumable purchases on Android. RBI-licensed Payment Aggregator, PCI DSS Level-1 certified. Data processed: order ID, amount, status; no card numbers are stored by PetNimbus.
• Apple Inc. (App Store / StoreKit) — Processes in-app purchases and subscription payments on iOS. Apple receives transaction data (purchase amount, subscription status, product identifier, device identifier) per their privacy policy at apple.com/privacy. Apple IAP refunds are processed by Apple, not PetNimbus.
• 2Factor.in — OTP and SMS delivery for phone verification and sign-in. Data processed: phone number and one-time passcode.
• Firebase Cloud Messaging (FCM) — Push-notification delivery (chat messages, new matches, appointment reminders, vaccination alerts). Data processed: device FCM token and notification payload.
• Firebase Analytics / Crashlytics — Aggregate usage analytics and crash reporting. Data processed: anonymised event data and crash stack traces.
• Resend — Transactional email delivery (account confirmations, appointment reminders, grievance acknowledgements, vaccination reminders). Data processed: email address and email content.
• Google Cloud Vision API — Automated image moderation and OCR for user-uploaded photos, pet images, profile pictures, and business images for safety and abuse prevention. Data processed: image pixels only, with no account identifiers attached.
• OpenAI — AI processing for Nutrition Plan generation and Financial Hub receipt parsing. Data processed: the specific pet profile attributes or receipt image required by the user for the requested feature, as a one-off API call; OpenAI does not store data for training under PetNimbus's API agreement.
• Sentry — Error and crash monitoring. Data processed: sanitised stack traces and error metadata; no personal-data payloads are sent.
• Google Maps Platform — Address autocomplete and map rendering for location features. Data processed: search query text and viewport coordinates.
• Upstash Redis (or equivalent managed Redis) — Server-side caching, session token storage, rate limiting, and distributed cron-lock coordination. Data processed: short-lived cache entries keyed by user or session identifier (no raw PII stored). Region: Asia-South-1 (Mumbai) or equivalent.
• Tesseract OCR (self-hosted) — Fallback OCR engine for receipt parsing, operated within PetNimbus's own infrastructure with no external data transfer.

No sub-processor outside the list above has access to your personal data. We will NEVER sell your personal information or share data for advertising without consent.

11. Data Security

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Secure storage in AWS S3 with access controls.
• JWT tokens with bcrypt password hashing.
• Your Responsibility: Keep your phone number and OTP secure. Don't share sensitive info in chats.

12. Your Rights as a Data Principal

Under the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and the Digital Personal Data Protection Act 2023 (DPDP Act 2023), you have the following rights with respect to your personal data:

• Right to access information about personal data (DPDP Act Section 11): Request a summary of personal data being processed, the processing activities undertaken, and the identities of Data Fiduciaries and Data Processors with whom your data has been shared.
• Right to correction and erasure (DPDP Act Section 12): Correct inaccurate or incomplete personal data; update outdated personal data; request erasure of personal data that is no longer necessary for the original purpose (subject to legal retention overrides stated in Section 13).
• Right of grievance redressal (DPDP Act Section 13): Raise a grievance with the designated Grievance Officer (see Section 18).
• Right to nominate (DPDP Act Section 14): Nominate another individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.
• Withdrawal of consent (DPDP Act Section 6(4)): Withdraw consent previously given. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal and does not override processing undertaken on other legal bases (e.g., compliance with tax laws).
• Deemed withdrawal of consent (DPDP Act Section 16): If you terminate your account or become inactive in a manner that, under applicable law, amounts to a deemed withdrawal of consent, PetNimbus shall stop processing your personal data for the consented purposes, subject to legal retention exceptions.
• DPDP Act Section 9 — Processing of children's personal data: PetNimbus does not knowingly process the personal data of any individual under 18 and applies the safeguards required by Section 9 of the DPDP Act 2023. See Section 14 (Children's Privacy) of this Privacy Policy.

How to exercise your rights: Email privacy@petnimbus.com from your registered email address with the subject line "DPDP Rights Request" and state which right(s) you wish to exercise. We may request identity verification before acting on the request, will acknowledge within 24 hours, and will resolve within 15 calendar days per IT Rules 2021 Rule 3(2).

12A. Automated Jobs & Scheduled Processing

PetNimbus runs the following automated background jobs ("cron jobs") on a schedule. Each job processes only the personal data categories listed in Section 2 and solely for the purpose stated. All schedules are in India Standard Time (IST, Asia/Kolkata).

• Subscription expiry reminder (daily, 09:00 IST) — identifies subscriptions nearing their end date and sends renewal reminders via push notification and email.
• Breeding outcome follow-up (daily, 10:00 IST) — follows up on recent mating interactions to prompt outcome recording.
• Certificate cleanup (daily, 00:00 IST) — marks expired health and vaccination certificates as EXPIRED in user records.
• Monthly nutrition-token reset (1st of each month, 00:00 IST) — resets monthly AI nutrition-plan token allowances for each subscription tier.
• Diary meal reminder (daily, 08:00 IST) — prompts users to log morning meals for each active pet.
• Diary weight check-in (daily, 08:30 IST) — prompts users to log weekly weight readings where due.
• Diary evening reminder (daily, 20:00 IST) — prompts users to log exercise and mood observations at the end of the day.
• Vaccination age-window nudge (daily, 09:30 IST) — scans pets entering new WSAVA vaccination age milestones and sends proactive reminders.
• Vaccination reminder + missing-core-vaccine escalation (daily, 09:00 IST) — sends due-date reminders for upcoming vaccinations and escalates persistently missed core vaccines.
• Daily Diary AVMA health scan (daily, 21:00 IST) — analyses recent diary entries for AVMA-guideline health-alert patterns (sustained anorexia, sudden weight loss, repeated lethargy) and generates in-app health alerts where thresholds are met.
• Appointment reminder (every 15 minutes) — scans CONFIRMED appointments in the 2-hour-before window and sends reminder push notifications.
• Appointment support chat auto-close (hourly) — closes inactive post-appointment support conversations after the 48-hour SLA window elapses.
• Visit inquiry expiry (hourly, at :15) — expires NGO / shelter visit enquiries that have not been actioned within 7 days.
• Event reminder (daily, 09:00 IST) — sends push notifications for upcoming pet events and community activities.
• Weekly summary (Sundays, 09:00 IST) — compiles and sends each user's weekly pet care summary email.
• Stale order cleanup (every 5 minutes) — marks PENDING Razorpay orders older than 30 minutes as FAILED (abandoned checkout).
• Rejected document cleanup (scheduled) — permanently deletes KYC or health certificate uploads that failed verification, after the rejected-document retention period elapses (default 30 days).
• Grace-period account cleanup — permanently deletes user accounts where the user has initiated deletion and the 30-day grace period has elapsed.

These jobs run within PetNimbus's own infrastructure on AWS (Mumbai region). No personal data is transmitted to external services by these jobs beyond the sub-processors disclosed in Section 10.

13. Data Retention

• Active Users: Data retained while account is active.
• Inactive Users: Account remains active even after 30 days of inactivity, though old period data (expired super likes) may be cleaned up.
• Account Deactivation: 30-day grace period before permanent deletion. After 30 days, all data is permanently deleted.
• Legal Retention: Transaction records are kept for 7 years (Income Tax Act).
• Appointment records and booking data: Retained for 3 years from appointment date (required for tax and dispute resolution purposes).
• Walker GPS route data: Deleted 30 days after the walk session.
• KYC documents (business accounts): Retained as required by applicable law, minimum 7 years.

14. Children's Privacy

PetNimbus is NOT intended for users under 18 years of age. We do not knowingly collect information from minors.

15. International Data Transfers

Your data is primarily stored in India. If transferred internationally (e.g., to AWS regions), we ensure adequate safeguards per Indian data protection laws.

16. Cookies & Tracking

We use essential cookies for authentication and security, and analytics (Firebase) to understand app usage. You can disable non-essential tracking in app settings.

The PetNimbus business dashboard uses localStorage to store the business JWT session token. This is cleared when you log out. No cross-site tracking cookies are used on the business dashboard.

17. Changes to Privacy Policy

Material changes will be notified through in-app notifications or email. Continued use after changes indicates acceptance.

18. Grievance Officer & Contact Us

In accordance with the Information Technology Act 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the Consumer Protection Act 2019, and the DPDP Act 2023, PetNimbus has designated a Grievance Officer:

• Name: Grievance Officer, GOODSHIFT Private Limited
• Grievance Email: grievance@petnimbus.com
• Privacy Matters / DPDP Rights: privacy@petnimbus.com
• General Support: support@petnimbus.com
• Postal Address: 302, BLOCK-C, MOTI BHAVAN, NEAR RBI ROAD, SALIMPUR, Patna Collectoriate, Phulwari, Patna – 800001, Bihar, India
• Acknowledgment SLA: Within 24 hours of receipt.
• Resolution SLA: Best effort within 15 calendar days per IT Rules 2021 Rule 3(2).