Privacy policy

1. Data controller

The controller of your personal data is Mizuu (full identifying details in the legal notice). For any privacy query or exercise of rights: legal@mizuu.pet.

Mizuu has not formally appointed a Data Protection Officer (DPO) — the current activity does not fall within any of the three cases under Article 37 of the UK GDPR. If the scale requires it in the future, one will be appointed and their contact details published here.

2. Data we process

The data varies depending on the type of relationship you have with Mizuu. This is the exhaustive list of categories that may be collected:

2.1. Basic account (every registered user)

• Email, full name, password (hashed with Argon2id, never in the clear), optional avatar.
• Role (family, shelter, veterinary clinic, service professional or admin), sign-up date, email verification status, the statement that you are 16 or older, and the date you accepted the terms and this policy.
• Google identifier if you sign in with “Continue with Google” (Google Sign-In): we only receive your name, email, photo and an identifier; never your Google password.
• Refresh tokens (hashed with SHA-256, never in the clear), FCM push tokens if you accept notifications.

2.2. Contact details and optional location

• Phone and WhatsApp (encrypted at rest with AES-256-GCM).
• Approximate postal address (street, city, county, postcode). Encrypted at rest.
• Geographic coordinates of your home (latitude/longitude) if you choose to receive geographic alerts or want to show your location when offering to foster.

2.3. Data to apply for an adoption

If you apply as a candidate to adopt a pet, we also collect:

• DNI/NIE number (encrypted at rest) and photos of both sides of the document (stored encrypted and with access links that expire in minutes).
• Data about your home (type, m², garden, hours left alone, children, other pets).
• Previous experience with animals and motivation to adopt.
• Graphic electronic signature (SVG) — generated by you on screen and reusable.

This data is only seen by the shelter you apply to and the Mizuu team, which safeguards the contract as a platform. The photo of your DNI is not shown to the shelter: they only see “DNI verified” and the last four digits.

2.4. Pets and their activity

• Data of each pet: name, species, breed, age, weight, neutering, microchip, allergies, health conditions, diet.
• Pet photos.
• Digital passport with permanent number WP-XXXXXX.
• Clinical history (vaccinations, vet visits, treatments), location history (shelter/foster/hospital), walk history with GPS route, walk events (poos/wees).
• Friendships between pets ("pet friends") initiated by their respective owners.
• NFC tags linked to the collar.

2.5. Neighbourhood rescue module data

• Real-time GPS position during an active session.
• Sighting notes, optional photos, text messages from the virtual walkie-talkie and voice notes (audio of 30 seconds at most). Voice notes from rescues and walks are turned into text with an OpenAI service (see §5 and §6).

All this data is deleted automatically when the rescue session closes (pet found or cancellation): the photos and audio are deleted from MinIO and the database records are deleted in cascade. They are not kept long-term.

2.6. Commercial and payment data (shop and vets)

• Shipping addresses for physical orders.
• IBAN or PayPal email (encrypted) if you are a veterinary clinic receiving payments through Mizuu.
• Mizuu does not store bank card data. The payment process is handled by Stripe directly on its PCI-DSS environment.

2.7. Technical data

• Client IP (logged in logs and audit events).
• Browser User-Agent.
• Device identifiers for push notifications.
• Strictly necessary cookies and a cookie-free visit count from Cloudflare Web Analytics (see Cookie policy). Today we don't use statistics or advertising cookies.

2.8. Internal communication data

• Chat conversations with shelters and vets. Encrypted at rest with AES-256-GCM.
• Internal notes the shelter adds about candidates (not visible to the candidate).
• Reviews and ratings of veterinary clinics.

2.9. Service professionals (dog walkers, pet sitters, groomers, trainers, daycares and pet hotels)

• Public profile data: name or business name, photo, area, services, prices, hours, description, reviews and whether you are a professional or a private individual.
• For the “Verified” badge: photo of your identity document (encrypted, only seen by the Mizuu team). If you upload it, the liability insurance policy for the separate “With liability insurance” badge.
• To get paid: the data Stripe Connect asks for to verify your identity and your bank account (KYC). Stripe collects and stores it; Mizuu only sees whether the verification is complete.
• Bookings, messages with families, service check-in and check-out codes, and invoices.

2.10. Veterinary clinics and their team

• Clinic and team data (name, email, role and permissions of each person), subscription and billing (via Stripe or Google Play).
• The data of the clients and patients that the clinic manages in Mizuu Clínica (calendar, history, invoices, reminders) belongs to the clinic: there the clinic is the controller and Mizuu acts as processor (art. 28 GDPR), under the data processing agreement. The same goes for the data a shelter manages about its volunteers, foster homes and applicants.

3. Purposes of processing and legal basis

3 bis. Application scoring and AI summaries (art. 22 GDPR)

When you apply to adopt, Mizuu calculates an indicative score of how well you fit the animal, based on what you tell us in your form (home, hours alone, experience, other pets, children) and on what the shelter says the animal needs. Sometimes an AI summary of the application is also generated to save the shelter time. In Mizuu Clínica, AI can summarize a pet's history for the vet.

None of these tools decides on its own. The score and the summaries are only a guide: the decision to accept or reject an adoption is always made by a person at the shelter, and the diagnosis is always made by the vet. You can ask for a person to review your case, give your point of view and challenge the decision by writing to the shelter or to legal@mizuu.pet.

4. Retention periods

• Active account: while you keep the account open + minimum legal period (6 years for tax and accounting records under UK law — HMRC / Companies Act 2006).
• Closed account: immediate deletion of email, name, phone number, address, social networks, photo, password, ID document, signature, adoption template, sent messages, reviews, friendships, basket, notices and sponsorships. Pet profiles, applications, walks and visits are kept under the name «Deleted account», with no contact details, so as not to break each animal's history. Invoices, orders and payments: 6 years (applicable commercial and tax law). Signed adoption contracts: up to 5 years (applicable statutory limitation period).
• ID document data: while your adoption form remains active. Deleted when using the ID-deletion endpoint or when deleting the account.
• Security log (audit_events): 24 months. It lets us defend ourselves against reports of disguised sales or complaints from adopters.
• Neighbourhood rescue data: ephemeral — completely deleted when the session closes.
• Chat messages: while the conversation is open. If it closes, they are kept for 1 year for traceability and then anonymised.
• General technical logs (access, errors): 90 days.

5. Recipients and data processors

Your data is only shared with third parties when strictly necessary to carry out the service you have requested. The main data processors are:

• Cloudflare (CDN and tunnel) — all HTTPS traffic passes through its network.
• Stripe Payments Europe (payments and Stripe Connect): receives name, email and amount of each payment; for professionals and shelters that get paid, it also asks for identity verification and bank account data. Card details never reach us.
• Sendcloud (physical shipping) — receives the recipient's name + postal address.
• Resend / Drift Labs (email) — receives the recipient's email address and the content of the email.
• Google Firebase / FCM (push) — receives the device token and the notification content. In the Android app, Firebase Crashlytics (crash diagnostics) receives an installation ID, the device model and version and the technical crash log; it does not receive your name or email.
• Cloudflare Web Analytics (cookie-free visit count): receives the page visited, the browser and performance data, without identifying you. Cloudflare also hosts the photos and files (R2 storage, cdn.mizuu.pet).
• Anthropic (artificial intelligence) — receives the image of the veterinary record that you manually upload when using the scan function. No model is trained with your data (zero-retention).
• Bigbuy (when the food subscription is enabled) — receives order data and address.
• OpenAI (voice note transcription): receives the audio of the voice notes you record during a rescue or a walk to return the text. According to its API terms, it doesn't use that data to train its models.
• Google: Google Sign-In if you choose “Continue with Google” (it confirms your name, email and photo to us) and Google Play Billing when a clinic pays its subscription from the Android app. For Google Play payments, Google acts as an independent controller: it issues its own invoice and applies its own privacy policy.
• Shelters and professionals: when you apply for an animal or book a service, the shelter or professional receives the data needed to look after you (name, contact, form or booking details). Each one is responsible for what they do with it afterwards.

Each processor has its own data processing agreement (DPA) signed with Mizuu, with confidentiality clauses and a security obligation.

6. International transfers

Some providers are established outside the European Economic Area (mainly Cloudflare, Anthropic, OpenAI and Google, in the US). These transfers are covered by:

• The International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• The EU-US Data Privacy Framework when the provider has joined it (this is the case for Cloudflare, Google, OpenAI and Anthropic as of the date of this version).

7. Your rights

At any time you can exercise the following rights:

• Access: full download of your data from Settings → Privacy → Download my data.
• Rectification: from your profile or by writing to [email protected].
• Erasure (art. 17 GDPR): from Settings → Delete my account or by email. We delete your personal data right away and keep, without your name, only what the law requires us to keep (art. 17.3 GDPR and art. 32 LOPDGDD).
• Objection and restriction of processing.
• Portability: the “Download my data” file comes in a standard format (JSON) that you can take to another service.
• Withdraw consent at any time without affecting the lawfulness of prior processing.
• Not to be subject to solely automated decisions (art. 22 GDPR): see §3 bis.
• Lodge a complaint with the ICO — Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

To exercise any right outside the dashboard: legal@mizuu.pet with reasonable proof of identity. Response time: 1 month (extendable to 3 when the request is complex, Article 12 UK GDPR).

8. Data security

We apply technical and organisational measures reasonable to the state of the art:

• Encryption in transit (TLS 1.3 on all connections).
• Encryption at rest of sensitive PII: ID document, IBAN, PayPal, phones, addresses — AES-256-GCM with a dedicated key.
• Encryption at rest of the chat with AES-256-GCM (Mizuu only moderates when there is a report).
• Argon2id hashing for passwords with OWASP 2023 parameters.
• JWT with RS256 signature and refresh token rotation.
• Automatic account lockout after 5 failed login attempts.
• Rate limiting on sensitive endpoints.
• Helmet, CSP, HSTS, explicit CORS allowlist policy.
• Immutable audit of critical actions in an append-only table.
• Encrypted backups.

If we suffer a security breach affecting personal data, we will report it to the Spanish Data Protection Agency within 72 hours at most from when we become aware of it (art. 33 GDPR), unless it is unlikely to result in a risk. If the breach may result in a high risk to your rights, we will also let you know without undue delay, explaining what happened and what you can do (art. 34 GDPR).

9. Minors

To create an account on Mizuu you must be 16 or older; you state this when you sign up. To open a shelter, clinic or professional account, or to sign an adoption, you must be of legal age. If your child appears in your adoption form (“children at home” field), we only keep a general piece of data (age range) and it is never published outside the adoption file. More detail in the Minors policy.

10. Changes to this policy

When this policy is modified substantially, you will receive an email notice at least 15 days in advance. The date and version are always visible in the header of the document.