Politica de confidențialitate

1. Who we are

This Privacy Policy explains how ZOOMIES S.R.L. ("Zoomies", "Company", "we", "us", "our"), a company registered in Romania, collects, uses, shares and otherwise processes your personal data when you use the Zoomies mobile app, our websites (zoomies.ai, shelters.zoomies.ai), and related services (together, the "Service").

We are the data controller for the personal data described here.

• Legal entity: ZOOMIES S.R.L.
• Registered office: Str. Chindiei nr. 22–24, Et. 1, Ap. 2, Sector 4, 040185 Bucharest, Romania
• Sole registration code (CUI): 50994046
• Trade Register no.: J2024046998008 (EUID ROONRC.J2024046998008)
• Data-protection enquiries: hello@zoomies.ai · Privacy / children: privacy@zoomies.ai

We comply with the EU General Data Protection Regulation (GDPR), Romanian Law no. 190/2018, and applicable e-privacy rules.

You have the right to lodge a complaint at any time with your local data-protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP) (www.dataprotection.ro). A list of EU/EEA authorities is available on the European Data Protection Board website.

2. The data we collect

We collect the following, depending on how you use the Service.

Account & identity. Email address, name, username, gender, date of birth, country and city, phone number (optional), profile picture, language preference, and the consent choices you make. When you sign in with Google, Apple or Facebook, that provider shares your email and name with us. Your password is handled by our authentication provider (Google Firebase) and is never stored by us.

Your pet's profile. Species, breed, name, age, gender, photo, a selected "voice", microchip ID (if you add it), diet and health notes you enter, vaccination/sterilisation status, and the behavioural profile and insights we generate. Although most of this describes your pet (not a person), free-text fields may contain your own personal data, so we treat them as personal data.

Photos, videos and audio you submit for analysis. When you ask Zoomies to analyse your pet's behaviour, you upload photos, video, and/or audio (e.g. a bark recording). Your first name, form of address, and gender are sent together with a video so the assistant can address you. See §4 for how this media is processed and stored.

AI analysis results. The behavioural analysis we produce — including a description of the scene (which may describe your home environment), identified behaviours, emotional/instinct indicators, our five-axis scores, action plans, triggers, and an approximate location/region you provide.

Chat with the assistant. The messages you send to the in-app AI assistant and its replies.

Purchases & subscriptions. When you subscribe, we receive and store payment identifiers and receipts — Stripe customer/subscription IDs (web) and Apple/Google transaction IDs and receipts (in-app) — and subscription status. We do not collect or store your card number; card payments are handled directly by Stripe, Apple, or Google.

Device & technical data. A push-notification token, your device platform (iOS/Android), app version, and your IP address (collected automatically when your device connects to our servers).

Location. If you search for nearby pet services, your device's location (latitude/longitude) is used to find places near you. We store only a coarsened (~1 km) version in our search logs.

Shelters & organisations. If you apply via our shelters site or are invited to an organisation, we collect the name, email, phone, country, and any message you provide — even before you create an account.

App analytics & advertising (mobile, with your consent). If you consent (including via Apple's App Tracking Transparency prompt on iOS), our app shares limited event data — including your user ID, email, and purchase value — with advertising/analytics partners (Meta, TikTok on iOS, and Google) to measure and improve our marketing. You can decline or withdraw this at any time (see §8 and our Cookie & Tracking Notice). We keep Firebase Analytics disabled.

We do not intentionally collect special categories of data (race, health, beliefs, etc.) about you, and the Service is not directed to children (see §11).

3. Why we use your data, and our legal bases

Purpose	Legal basis (GDPR Art. 6)
Create and manage your account; authenticate you	Performance of a contract
Provide behaviour analysis, pet profiles, action plans, the chat assistant and voice features	Performance of a contract
Process subscriptions, payments and receipts; prevent payment fraud	Contract; legal obligation (tax/accounting); legitimate interests (fraud prevention)
Send service/transactional messages (e.g. analysis ready, account changes)	Contract
Send marketing communications	Consent (you may withdraw at any time)
Mobile advertising/analytics SDKs and any future website analytics/cookies	Consent
Nearby pet-services search	Consent / performance of a contract
Keep the Service secure, debug, and prevent abuse	Legitimate interests
Improve and develop the Service using aggregated/de-identified data	Legitimate interests
Comply with legal obligations and respond to lawful requests	Legal obligation

Where we rely on legitimate interests, we have balanced them against your rights; contact us for details of that assessment.

4. How AI analysis works, and what happens to your media

To analyse your pet's behaviour we use third-party AI providers. Here is exactly what happens:

• Photos and audio are processed in memory and are not stored by our AI service after the analysis completes.
• Video may be stored in our Google Cloud Storage (in a folder specific to you) so you can revisit an analysis. It remains until you or we delete it (see §7). You can delete videos from the app, and all your videos are deleted when you delete your account.
• To produce an analysis, your media and the related pet/behaviour text are sent to one or more AI providers — Google (Gemini), OpenAI, and/or Anthropic. Which provider handles a given request can vary depending on availability and load-balancing, so we treat all three as recipients of analysis data. Text-to-speech "voice" replies are generated by ElevenLabs.
• We log AI request/response text (not your media files) to Langfuse, an observability provider, to monitor quality and cost.

These providers process your data on our behalf as sub-processors under data-processing terms.

4a. Automated processing and AI-generated outputs

The core of the Service is automated: our AI generates your pet's behavioural profile, five-axis scores, action plans and chat replies without a human reviewing each result. These outputs are informational and may be inaccurate or incomplete — they are not professional, veterinary or medical advice (see our Terms of Service). We do not use this automated processing to make decisions that produce legal or similarly significant effects about you as a person. You can contact us to query or object to this processing (see §8).

5. Who we share data with

We do not sell your personal data. We share it with: service providers / sub-processors who run the Service for us (see §6); payment providers (Stripe, Apple, Google); your App Store / Play provider and mobile network operator to allow you to install and run the App; authorities or third parties where required by law, to enforce our terms, or to protect rights, safety and security; and, in a corporate transaction (merger, acquisition or asset sale), subject to this Policy. Organisation/shelter staff who manage a pet you are linked to may see that pet's profile and analyses.

6. Sub-processors

A current list is maintained internally and available on request:

• Google — Firebase Authentication, Firebase Cloud Messaging (push), Google Cloud Platform (hosting, database, media storage, messaging), Google Places (nearby search), Google Gemini (AI analysis).
• OpenAI and Anthropic — AI analysis (image and text).
• ElevenLabs — text-to-speech voice generation.
• Langfuse — AI observability (request/response text).
• Stripe — web subscription payments.
• Apple and Google — in-app purchases.
• Twilio SendGrid — transactional email.
• Meta and TikTok — app advertising/analytics (only with your consent).

7. How long we keep your data

We keep your personal data for as long as your account is active, and then delete it when you delete your account, except where we must keep certain records longer to meet legal obligations. By law we keep basic customer records (contact, identity, transaction data) for up to the statutory period for tax/accounting purposes under Romanian law.

Deleting your account. You can delete your account from the app's profile settings or at zoomies.ai/delete-account. This permanently deletes your account, pet profiles, behaviour analyses, photos and videos, action plans, chat history, and payment data held in our systems. Deleting your account does not cancel an active App Store or Google Play subscription — cancel that in the relevant store first.

8. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). Withdrawing advertising/analytics consent is available via your device settings (including iOS App Tracking Transparency) and in-app controls.

To exercise any right, contact hello@zoomies.ai. We respond within one month. You also have the right to lodge a complaint with ANSPDCP (www.dataprotection.ro) or your local EU data-protection authority.

9. International transfers

Some of our providers (including AI providers, Stripe, and certain Google services) process data outside the European Economic Area, including in the United States. Some of our own infrastructure also runs in US regions. Where we transfer your data outside the EEA, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can request a copy of the relevant safeguards by contacting us.

10. How we protect your data

We use encryption in transit (HTTPS/secure WebSockets), managed authentication (Firebase), access controls, and reputable cloud infrastructure (Google Cloud). No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities of a breach where required.

11. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us data, contact us at privacy@zoomies.ai and we will delete it.

12. Changes to this Policy

We may update this Policy. We will post the new version here with an updated "Last updated" date and, for material changes, notify you in the app or by email.

13. Contact

ZOOMIES S.R.L. — Str. Chindiei nr. 22–24, Et. 1, Ap. 2, Sector 4, 040185 Bucharest, Romania — hello@zoomies.ai