Privacy policy
This policy explains how PetFoodRate collects, uses, and protects your personal data. Designed to comply with EU GDPR, UK GDPR, and the California Consumer Privacy Act (CCPA).
Who we are
PetFoodRate is an independent international pet food rating service operating at petfoodrate.com. You can contact us at contact@petfoodrate.com.
What we collect
The mobile app keeps pet profiles, favorites, and histories on your device. Camera frames used for barcode scanning are not saved or sent. When the Supabase runtime is configured, the app creates or reuses a pseudonymous Supabase session at launch to authenticate product analysis requests and notifications, community synchronisation, and operational telemetry when accepted by the server. The session exists even when server-side telemetry is disabled; that kill switch prevents operational events from being accepted and stored, but does not prevent session creation. If you choose to contribute, we also collect the review, correction, report, or product photos you explicitly submit. The website may process technical data such as IP address, browser, approximate country, and pages visited. Scanning and product scores are free. The iOS food dossier is optional and unlocked by a one-time Apple purchase when available. PetFoodRate does not receive payment card data.
Food dossier and Apple purchases
Dossier criteria, budgets and up to ten saved sets of criteria stay on your device. A PDF is created locally and leaves the app only through the sharing action you choose; its temporary copy is removed when sharing closes. Apple processes the one-time purchase and provides the verified entitlement through StoreKit. We do not send receipts or Apple transaction identifiers to our server. Minimal operational events may record opening, preview outcome, purchase attempt and result, restore outcome, saving and completed export, linked to the pseudonymous session. They contain no budget, pet profile, product identity or report text. Raw operational events are retained for 30 days, non-individual aggregates for 395 days. Deleting app data removes saved dossiers, but does not cancel the purchase held with your Apple Account. Restore Purchases lets you recover that entitlement with the same Apple Account.
Community content
Community contributions are linked to the pseudonymous Supabase session, but the existence of a session does not mean that you submitted content. Contributions are collected only when you explicitly queue them for upload and are moderated before public display. Other users can report content and block its author. Product photos are stored in Supabase Storage. We use this data only to operate, secure, and moderate the community features.
AI-assisted product analysis
After you explicitly confirm a contribution for an unknown product, two or three product photos are stored in private PetFoodRate storage. The server may transmit those photos to the OpenAI Responses API to extract information printed on the packaging. Requests use store: false, but this is not a zero-retention guarantee: depending on the account controls and applicable safety checks, OpenAI abuse-monitoring logs may retain content for up to 30 days by default, and images may be retained for safety review when a risk is detected. OpenAI does not assign the PetFoodRate score and cannot publish a product. The deterministic PetFoodRate engine calculates the score, and human validation is required before catalogue publication.
Affiliate clicks
When an affiliate link is opened from the iOS app, our collector records routing and attribution metadata: the PetFoodRate service identifier, product and brand identifiers, selected merchant and affiliate programme identifiers, resolved destination, match or redirect outcome, automated bot classification, and timestamp. Approximate country, referrer, and browser user agent are explicitly stored as null for these iOS clicks. Website affiliate clicks may include those technical fields for fraud prevention and aggregate measurement.
How we use it
To operate the site and its features (scoring, personalised recommendations, alerts), to improve the ingredient database and scoring algorithm through aggregated usage analytics, to respond to your enquiries, and to comply with legal obligations. We do not sell personal data.
Legal basis
We process your personal data on the basis of consent (for analytics cookies and marketing communications), legitimate interest (for site operation and fraud prevention), and legal obligation (where required by law).
Who we share data with
Trusted service providers that help us operate PetFoodRate include Supabase for community authentication, database, and private photo storage, Cloudflare for website hosting, Resend for email, and OpenAI as a potential processor of two or three product photos for label extraction, under applicable data processing terms. Opening an affiliate destination creates a normal network request to the merchant and affiliate network, which may process standard connection data under their own privacy terms. Our iOS affiliate collector does not retain country, referrer, or browser user agent for that click. We never sell personal data.
Your rights
Under GDPR and applicable privacy laws, you can request access, correction, deletion, restriction, portability, or objection. In the app, open My Animals, then Account and privacy, to delete the pseudonymous Supabase account, directly linked personal records, unreferenced temporary uploads, and local PetFoodRate data. Sealed product evidence, sanitised images, and catalogue data may remain after dissociation from the author as explained under Retention. You can also write to support@petfoodrate.com; we respond within 30 days.
Retention
Community data remains linked to the pseudonymous account while it is active or until moderation requires earlier removal. In-app deletion removes the account, directly linked raw operational events, local PetFoodRate data, and unreferenced temporary photos. Sealed product evidence, sanitised images, and data already integrated into the catalogue may be retained after dissociation from the author under the contribution terms accepted before upload, to preserve catalogue integrity and traceability. That durable evidence is retained while it supports an active catalogue reference or the verification of a disputed contribution. It is dissociated from the author on account deletion. No automatic deletion period is currently configured; requests concerning unnecessary evidence are reviewed via support@petfoodrate.com. Non-individual operational aggregates are retained for up to 395 days, and OpenAI processing is subject to the separate period described above. Website audience measurements are anonymised according to the cookie policy.
International transfers
Our servers are located in the EU and the US. When data is transferred between regions, we use Standard Contractual Clauses and additional safeguards as required by GDPR.
Complaints
If you feel your data rights have not been respected, you can complain to your local data protection authority. In the EU/UK, that is usually your national DPA. In France: the CNIL (cnil.fr). In the UK: the ICO (ico.org.uk).
