Privacy Policy

01Introduction

This Privacy Policy (the “Policy”) describes how Levelo, Inc., a corporation organized under the laws of the State of Delaware, United States, with its registered office at 16192 Coastal Highway, Lewes, Delaware 19958 (“Company”, “id4.pet”, “we”, “our”, or “us”) collects, uses, stores, processes, discloses, and protects personal information when you access or use the id4.pet mobile application, website at id4.pet, AI systems, veterinary document storage services, digital pet identification tools, Apple Wallet integrations, and related services (collectively, the “Services”).

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree, you must not use the Services. This Policy is incorporated by reference into our Terms & Conditions.

02Quick Summary

This summary is provided for convenience only; the rest of this Policy is controlling.

• What we collect. Account info (name, email), pet profile data, veterinary documents you upload, AI Assistant messages, device and usage data, and limited subscription metadata from Apple/Google.
• Why we collect it. To operate the Services, store your records, power the AI Assistant, prevent fraud, comply with law, and improve our product.
• What we don’t do. We do not sell personal information for money. We do not use your veterinary records or pet photos to train third-party general-purpose AI models without your consent.
• Your control.You can review, correct, export, or delete your data, withdraw consent, and close your Account at any time (Sections 19 and 27).
• Security. We use commercially reasonable safeguards (encryption in transit, access controls, audit logs, vetted subprocessors).
• Where data lives. Primarily on cloud infrastructure located in the United States.
• Children.The Services are not intended for users under 13 years of age.

03Who We Are (Data Controller)

For the purposes of the EU/UK GDPR, the “data controller” of your personal data is:

04Scope of This Policy

This Policy applies to personal information processed in connection with the Services. It does not apply to:

• websites, apps, or services operated by third parties (including the Apple App Store, Google Play, veterinary clinics, or services you reach via links from the Services);
• information about people you upload data about (for example, contact details of your veterinarian); you are responsible for ensuring you have any necessary consents to share that information with us;
• employees, contractors, or job applicants, who receive separate notices.

05Information We Collect

We collect personal information in three ways: (a) information you provide directly, (b) information collected automatically when you use the Services, and (c) information we receive from third parties.

We do notintentionally collect “special categories of personal data” about you (such as your race, religion, or biometrics). Information about your pet’s health is data about an animal, not protected health information under HIPAA, although it may be regulated by other laws.

06Information You Provide

You provide information when you create an Account, build a pet profile, upload veterinary documents or photos, chat with the AI Assistant, contact support, or respond to surveys. You decide what to upload. Please do not upload information you are not authorized to share.

07Information Collected Automatically

When you use the Services, we and our service providers automatically collect information about your device and how you interact with the Services, including:

• device identifiers, model, operating system, app version, language;
• IP address and approximate (city-level) location derived from it;
• diagnostic and performance data, including crash logs, error reports, and latency metrics;
• product analytics events (screens viewed, features used, anonymized or pseudonymized session identifiers);
• cookies, local storage, SDK identifiers, and similar technologies on the website (see Section 12);
• for the website only, referrer URL and browser user-agent.

08Information from Third Parties

We may receive information from:

• Platform Providers (Apple, Google): subscription receipts, refund events, family-sharing eligibility, and limited account identifiers (such as an anonymized user token).
• Authentication Providers: if you sign in with a third-party identity provider, basic profile information (email, name, profile photo) per the scopes you authorize.
• Analytics & Crash Reporting Providers: aggregated usage and stability data.
• Mapping & Place Data Providers: place names, addresses, and business details when you search nearby services.

09How We Use Information

We use personal information to:

• provide, operate, maintain, and personalize the Services;
• create and manage your Account and pet profiles;
• store, organize, and surface your veterinary records and reminders;
• operate AI Assistant features and generate responses to your prompts;
• process subscriptions, prevent fraud, and handle refunds with platform stores;
• communicate with you about service updates, security alerts, and support;
• send marketing or promotional messages where you have consented or where permitted by law (you can opt out at any time);
• detect, investigate, and prevent fraud, abuse, or security incidents;
• diagnose technical problems and improve performance and reliability;
• improve the Services in aggregate or anonymized form (we do not use your identifiable veterinary records or pet photos to train third-party general models without your consent);
• comply with legal obligations and enforce our Terms & Conditions.

10Legal Bases for Processing (GDPR)

If you are located in the EEA, the United Kingdom, or Switzerland, we process your personal data on one or more of the following legal bases:

• Performance of a contract(Art. 6(1)(b) GDPR) — to provide the Services you requested.
• Legitimate interests(Art. 6(1)(f) GDPR) — for example, to secure the Services, prevent fraud, perform analytics, and improve the product, where our interests are not overridden by your rights.
• Consent(Art. 6(1)(a) GDPR) — for optional features such as precise location, marketing emails, certain cookies, or use of optional AI features that transmit content to model providers.
• Legal obligation(Art. 6(1)(c) GDPR) — to comply with applicable laws, regulations, or court orders.
• Vital interests(Art. 6(1)(d) GDPR) — in rare cases, to protect a vital interest of you or another natural person.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

11AI Assistant & Automated Processing

The AI Assistant uses automated systems, large language models, and related artificial-intelligence technologies. You acknowledge and agree that:

• prompts, uploaded photos, and other content you submit to the AI Assistant are processed by our infrastructure and may be transmitted to third-party AI-model providers under contractual confidentiality and data-protection commitments;
• outputs may be incomplete, inaccurate, or biased, and you should not rely on them for medical, legal, or other professional decisions;
• we may retain prompts and outputs to provide chat history, generate session summaries, prevent abuse, and improve safety;
• we do notpermit our AI-model providers to use your identifiable prompts or pet photos to train their general-purpose models without your consent, to the extent supported by those providers’ APIs;
• we may use aggregated or anonymized data, and a small sample of moderated conversations, to evaluate and improve the quality and safety of the Services.

We do not use the AI Assistant to make decisions producing legal effects on you or significantly affecting you in a similar way (no “solely automated decisions” under Art. 22 GDPR).

12Cookies & Similar Technologies

Our mobile app does not use HTTP cookies, but it does use device storage and SDK identifiers for similar purposes (session management, analytics, crash reporting). Our website may use cookies and similar technologies as follows:

Where required by law, we will request your consent before placing non-essential cookies. You can manage cookie preferences in your browser at any time. Note that disabling cookies may impact the functionality of the website.

13Advertising & Analytics

The free version of the Services may include advertisements, sponsored content, affiliate placements, and promotional campaigns. We and our advertising and analytics partners may use cookies, SDKs, device identifiers, and similar technologies to:

• measure the performance of marketing campaigns;
• understand how the Services are used and improve them in aggregated or anonymized form;
• provide non-personalized or contextually relevant promotional content.

We do not knowingly serve targeted advertising to users under the age of 16. Premium subscribers receive an ad-free experience.

14How We Share Information

We share personal information only as described below.

• With your direction. When you share a pet profile or digital ID page with another person, the information you choose to include is visible to them.
• With service providers and subprocessors. Vendors that help us run the Services (cloud hosting, storage, email delivery, payment-event processing, customer support, analytics, crash reporting, AI model providers, mapping and place data) under written agreements that restrict their use of the data to providing the contracted services.
• With the Platform Providers. Subscription transactions are handled by Apple and Google under their own privacy policies.
• For legal reasons. If required by law, subpoena, court order, or governmental request, or to protect our rights, property, or safety, or those of our users or the public.
• In a business transfer. In connection with a merger, acquisition, reorganization, financing, sale of assets, bankruptcy, or similar transaction, subject to standard confidentiality protections.
• With aggregated or de-identified data. We may share aggregated or de-identified statistics that do not identify any individual.

We do not sell your personal information for money.We do not share your personal information for cross-context behavioral advertising. See Section 21 for California-specific disclosures.

15Service Providers & Subprocessors

The categories of service providers we currently use include:

A current list of named subprocessors is available on request to privacy@id4.pet.

16International Data Transfers

We are based in the United States and our infrastructure providers are primarily located in the United States. If you are accessing the Services from outside the United States, your information may be transferred to, processed, and stored in the United States or other jurisdictions that may have data-protection laws different from those in your country.

Where we transfer personal data of EEA, UK, or Swiss residents outside the EEA, UK, or Switzerland, we rely on appropriate safeguards, including:

• the European Commission’s Standard Contractual Clauses (Module 2 / Module 3) and the UK International Data Transfer Addendum or IDTA, as applicable;
• additional contractual, technical, and organizational measures (such as encryption in transit and at rest, access controls, and audit logging);
• participation by certain providers in the EU-U.S. Data Privacy Framework and related frameworks where applicable.

You may obtain a copy of the safeguards used for cross-border transfers by contacting privacy@id4.pet.

17Data Retention

We retain personal information for as long as reasonably necessary to provide the Services and for the purposes described in this Policy. The actual retention period depends on the category of data and applicable legal obligations. Indicative retention periods:

After the applicable retention period, we either delete the data or de-identify it so it can no longer be linked to you.

18Data Security

We implement commercially reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• encryption of data in transit (TLS) and at rest where supported;
• role-based access control and the principle of least privilege;
• audit logging, monitoring, and intrusion detection;
• regular security reviews and dependency patching;
• secure software development practices;
• data-processing agreements with our subprocessors.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a security breach affecting your personal data, we will notify you and any required supervisory authority in accordance with applicable law.

19Your Privacy Rights

Depending on where you live, you may have one or more of the following rights with respect to your personal information:

• Access — obtain confirmation that we process your data and a copy of it;
• Rectification — correct inaccurate or incomplete information;
• Erasure — request deletion (subject to legal exceptions);
• Restriction — ask us to limit processing in specific circumstances;
• Portability — receive a copy in a structured, machine-readable format;
• Objection— object to processing based on our legitimate interests or for direct marketing;
• Withdraw consent — where processing is based on consent;
• Lodge a complaint with your local data-protection supervisory authority;
• Automated decision-making— the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you (we do not currently make such decisions).

20How to Exercise Your Rights

You can exercise most rights directly in the app or website (for example, edit profile fields, delete a pet profile, delete a chat, or close your Account). For other requests, or if you cannot access the in-app controls, contact us at privacy@id4.pet. Please include:

• your name and the email address associated with your Account;
• a description of your request;
• any information needed to verify your identity.

We will respond within the time required by applicable law (generally within 30 days, extendable where permitted). We may decline or partially fulfil requests if we are unable to verify your identity, if the request is manifestly unfounded or excessive, or where a legal exception applies. Where we decline, we will explain why and inform you of your right to complain to a supervisory authority. You will not be discriminated against for exercising your rights.

21California Privacy Rights (CCPA/CPRA)

This section provides additional disclosures for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”).

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information (as defined by CCPA): identifiers (e.g., name, email, IP address); customer records (e.g., contact info, payment metadata); commercial information (e.g., subscription history); internet or other electronic network activity (e.g., usage data, device identifiers); geolocation data (city-level from IP, or precise only with your consent); audio/visual information (uploaded photos, documents); inferences drawn from the foregoing (e.g., preferences); and user-generated content (AI Assistant chats, notes).

Categories of Sources

We collect this information directly from you, automatically from your device, and from third parties such as Apple, Google, and analytics providers, as described in Sections 6–8.

Business Purposes for Collection

We collect personal information for the business purposes described in Section 9 (Providing and improving the Services, security, compliance, communication).

Sale and Sharing of Personal Information

We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under the age of 16.

Sensitive Personal Information

We do not use or disclose “sensitive personal information” (as defined by CCPA) for purposes other than those permitted under Cal. Civ. Code § 1798.121(a) (i.e., the purposes for which it was collected, plus narrowly tailored business purposes).

Your California Rights

• Right to know what personal information we collect, use, and disclose;
• Right to delete personal information we collected from you;
• Right to correct inaccurate personal information;
• Right to opt outof the “sale” or “sharing” of personal information (although we do neither);
• Right to limit use and disclosure of sensitive personal information (we already limit it as noted above);
• Right to non-discrimination for exercising your rights.

To exercise your California rights, email privacy@id4.pet with the subject line “California Privacy Request”. You may use an authorized agent; we will require proof of authorization and verification of your identity. We honor the Global Privacy Control signal as an opt-out of any sale or sharing where applicable.

22European Users (GDPR / UK / Swiss)

If you are in the EEA, the United Kingdom, or Switzerland, the GDPR (or the UK GDPR or the Swiss FADP, as applicable) applies to our processing. The Company is the data controller. Our legal bases are described in Section 10, and your rights are described in Section 19.

You have the right to lodge a complaint with the data-protection supervisory authority of the EU member state of your habitual residence, place of work, or place of the alleged infringement. In the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ICO). In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

23Other Regional Privacy Rights

If you are in Brazil (LGPD), Canada(PIPEDA), or another jurisdiction with applicable privacy legislation, you may have rights similar to those described in Sections 19 and 21. Contact privacy@id4.pet to exercise them.

24Children’s Privacy

The Services are not directed to children under the age of 13 (or under the applicable minimum age in your jurisdiction, e.g., 16 in some EEA countries). We do not knowingly collect personal information from such children without verifiable parental consent. If we learn we have collected personal information from a child in violation of applicable law, we will delete it as soon as reasonably possible. If you believe a child has provided us with personal information, please contact privacy@id4.pet.

25Do Not Track & Global Privacy Control

Most browsers offer a “Do Not Track” (DNT) signal that you can enable. Because there is no industry consensus on how to respond to DNT signals, our website does not currently respond to them. We do honor the Global Privacy Control (GPC)signal as a valid opt-out of the sale or sharing of personal information where applicable, as described in Section 21.

26Marketing & Push Notifications

We may send you product announcements, tips, and marketing communications by email, push notification, or in-app message, where you have consented or where permitted by law. You can opt out at any time by:

• using the unsubscribe link in any marketing email;
• disabling push notifications in your device settings;
• adjusting communication preferences in the app or website.

Even after opting out, you will continue to receive transactional or security messages necessary for the operation of the Services (e.g., password reset, billing receipts, security alerts).

27Account & Data Deletion

You can delete your Account at any time from the in-app settings, which will erase or anonymize your personal information except where we are required or permitted to retain it (for example, for tax records, fraud prevention, dispute resolution, or legal obligations).

You may also email privacy@id4.pet or visit our public Account-deletion page when available. Deletion typically takes effect within 30 days; backup copies are removed within an additional 60 days. Apple subscribers can also use the data-deletion link surfaced by the App Store.

28Third-Party Services & Links

The Services may contain links to, or integrations with, third-party websites, apps, or services, including Apple Inc., Google LLC, mapping providers, and external veterinary or pet-related sites. We are not responsible for the privacy practices or content of these third parties. We encourage you to review their privacy policies before interacting with them.

29Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by updating the “Last Updated” date above, sending an email, or displaying an in-app notice) before the changes take effect. Continued use of the Services after the effective date of an updated Policy constitutes acceptance of the changes. If you do not agree, you must stop using the Services and close your Account.

30Contact & Data Protection Officer

If you have questions, concerns, or requests regarding this Policy or how we process your personal information, please contact us: