Privacy Policy

Buppet is the controller of the personal data processed on the buppet.online platform. Requests, questions and privacy demands can be sent to equipbuppet@gmail.com, which also serves as the channel for our data protection officer (DPO).

• Sign-up and profile: name, email, phone, account type (pet owner or business), Brazilian tax ID (CPF or CNPJ), date of birth, gender/pronouns (optional), bio, photo/avatar and, for businesses, trade name, legal name, category, address, postal code, city, neighborhood and opening hours.
• Your pets' data: name, species/breed, sex, date of birth, weight and photos.
• Content you publish: posts, photos, videos, comments, likes, reviews, coupons, chat messages and adoption listings.
• Interactions: profiles you follow, profiles that follow you, reports made or received, interactions with offers and notifications.
• Approximate location: city, neighborhood and coordinates obtained from your postal code (used to show nearby businesses and services).
• Payments: subscribed plan, subscription status and the customer identifier created by Stripe. We do not store your full card details.
• Technical and usage data: IP address, device type, browser, operating system, pages and resources accessed, date and time of access, and the device token used to send push notifications.

We do not request sensitive data (such as health, religion or biometrics). Please do not include this kind of information in posts, comments or messages.

• Performance of a contract: creating and maintaining your account, showing your profile, delivering the feed, enabling chat, following profiles, publishing content, processing subscriptions and coupons.
• Compliance with a legal obligation: keeping access logs and tax records when the law requires it.
• Legitimate interest: security, fraud and abuse prevention, content moderation, product improvement and aggregated usage metrics.
• Consent: push notifications and marketing communications, which you can turn off at any time in the profile or device settings.

We use only what is needed for the service to work: session cookies (they keep you signed in) and local storage in the browser (light/dark theme and preferences). For audience metrics we use Vercel Analytics, which works in an aggregated way and without advertising cookies. We do not display third-party ads or sell tracking space.

The highlights block and the suggestions use city, neighborhood and approximate distance calculated from your postal code to show businesses in your region. Businesses choose what is visible on their public profile: full address, only neighborhood/city or hidden address — and they can hide email and phone.

We do not track your location in the background or while you use the app. Region information comes from the address you enter during sign-up or in your profile.

• Public: posts, profile photo, name, bio, pets (with photos), reviews and any data a business chooses to display.
• Restricted: your email, phone and address — shown only according to your privacy settings (and, for businesses, according to the visibility they choose).
• Chat messages are visible only to the participants of the conversation; our team may access them when there is a report or a legal order.
• Your payment data and documents sent for verification are not shown to other users.

We do not sell personal data. We share the minimum necessary with service providers (processors) that run the platform:

• Supabase — database, authentication and storage of photos, videos and documents.
• Vercel — hosting of the website and app, plus aggregated access metrics.
• Stripe — card and PIX payment processing and subscription management.
• Brevo — transactional emails (account confirmation, password recovery, notices).
• Push services (Google/Mozilla/Apple) — delivery of notifications to the device, when you enable this feature.

We may also share data to comply with a court order, a request from a competent authority or a legal obligation, and in the event of a corporate reorganization, always with notice and keeping this Policy.

Some of these providers process data on servers outside Brazil (mainly the United States and the European Union). In these cases, the transfer relies on contractual clauses and security measures adopted by the providers themselves, as permitted by the LGPD.

• Account and content data: while the account is active.
• After you delete your account: we remove the profile, posts and uploaded files; residual backup copies are deleted within 90 days.
• Access logs: kept for 6 months, as required by art. 15 of the Internet Civil Rights Framework.
• Payment and tax data: for the periods required by law (usually 5 years).
• Reports, blocks and security records: kept for as long as needed to prevent fraud and comply with legal obligations.

You may request, at any time and at no cost: confirmation of processing, access to your data, correction of incomplete or outdated data, anonymization/blocking/deletion of unnecessary or excessive data, portability, information about sharing, withdrawal of consent and objection to processing carried out without your consent.

Many adjustments you can make yourself in the app (edit profile, privacy, notifications, delete account). For the others, write to equipbuppet@gmail.com stating your request and the account email: we reply within 15 days. You may also complain to the Brazilian Data Protection Authority (ANPD).

We adopt technical and administrative measures to protect your data: encrypted connections (HTTPS), passwords stored as hashes, role-based access control, session verification, audit logs and restrictions on which team members can see each piece of information. No system is 100% fail-proof — if a relevant incident occurs, we notify you and the ANPD, as required by law.

Buppet is intended for people aged 18 or older. Accounts for teenagers between 16 and 18 may only be used with the authorization and supervision of a legal guardian. If we identify an account of a child or teenager without that supervision, the account is removed.

We may update this Policy to reflect new features or legal changes. The last updated date is at the top of the page and, for relevant changes, we notify you inside the app. Continued use after the update means you agree to the current version — if you disagree, you may delete your account.

Privacy and data protection: equipbuppet@gmail.com. See also the Terms of Use of the platform.