Tendling privacy notice

We decide how to use the information in business accounts and on our own website. Client, pet and visit information that a business enters, or that someone sends it through its forms, belongs to that business, and we handle it on its behalf to provide the service. If you are a pet parent, ask your pet care business first about your records. If you contact us instead, we may pass your request to them.

• Accounts: name, email, a securely hashed password or your Google sign-in, business name, role and time zone.
• Clients: names, email, phone, home address, emergency contact, vet details and notes.
• Pets: name, species, breed, birth date, weight, photo, feeding, care tasks, medications, behavior notes and vaccine records. Pet parents can update care details, breed, birth date, weight and vaccines in the portal.
• Home access: lockbox, alarm and gate codes, kept in encrypted notes, plus key tags and who holds each key.
• Visits: schedules, check-in and check-out times, checklists, notes, report cards and photos.
• Location: during a walk, the sitter's phone records location points and markers between check-in and check-out. We ignore points recorded outside the visit. Sharing is on by default. If the sitter switches it off for that visit, location stops recording. The saved route stays with the visit, and the pet parent can see it on the report card.
• Messages and notifications: messages between a business and its clients, in-app alerts, emails we send, and browser push subscriptions.
• Team records: working hours, service ZIP codes, time off, pay rates, payouts, mileage and a 1099 or W-2 flag.
• Payments: plans, invoices, amounts, Stripe identifiers, and a saved card's brand, last four digits and expiry. Stripe holds full card numbers. We do not see or store them.
• Booking requests: the name, email, phone, ZIP code, pet names, types and breeds, service, chosen meet & greet time or preferred date, and notes someone sends through a business's booking page, including when that form is placed on the business's own website.
• New-client forms: what someone enters on a business's new-client form: contact details, home address, emergency contact, vet, pet details including health, medications and vaccines, home access details, the services they want, notes, any agreements they sign, and the IP address the form came from. The business reviews each form before it is added to its records. Home access details are encrypted and can't be read until then.
• Visit and schedule requests: the visits, stays and weekly schedules a pet parent asks for in the portal, with their notes and the business's answer.
• Calendar links: a secure hash of each private calendar link, not the link itself.
• Signed agreements: if a business asks for a signature, the document's text and a fingerprint of it, the signer's typed name, a drawn signature if they add one, the time, IP address, browser details, whether it was signed in the portal, from an emailed link or on a new-client form and, in the portal, the signed-in account. Owners, admins and the pet parent can see the signed copy, including the IP address and browser details. Sitters can't.
• Device and usage data: IP address, browser and device details, pages visited, errors and security logs.
• Support: what you send us when you ask for help. The Help and support form also includes your name, email, business, role and the page you were on.

• To run the service: scheduling, check-ins, report cards, messages, invoices, payments and sitter pay.
• To send reminders, missed-visit alerts and other service messages by email, push and in the app.
• To keep accounts secure, prevent abuse and fraud, and keep audit logs.
• To give support, fix problems and improve the service.
• To measure our website and marketing, as described in section 8.
• To meet legal, tax and accounting duties and enforce our terms.

Where the law requires a legal basis, we rely on our contract with you, our legitimate interests in running a safe and reliable service, legal obligations, and your consent for optional website tracking.

We use AI for two optional features. A person checks the result each time. We do not use your content to train AI models, and we don't ask our AI providers to. Their handling of it is covered by their own terms.

• Report card drafts: a sitter can ask for an AI draft of a report card. We then send the visit facts through Lovable's AI gateway to OpenAI: pet names and species, the service, tasks, activity, mood and the sitter's notes. We do not add client contact details, home addresses or access notes, but anything typed into the sitter's notes is included.
• Reading vaccine certificates: a pet parent or team member can upload a certificate to fill in vaccine names and expiry dates. We send the whole file, with the pet's name and species, through Lovable's AI gateway to OpenAI. We do not store the file, but anything printed on it is included, such as an owner's name and address or a vet's details.

• People in the business: owners, admins and sitters see what their role allows. Pet parents see their own records, along with report cards and photos once sent. Sitters can read access notes only on the day of a visit, and every staff or sitter read is logged.
• Hosting and infrastructure: Lovable and Supabase (hosting, database, sign-in, file storage, analytics) and Cloudflare (network and app servers).
• Email: Lovable's email service and its delivery provider.
• AI: Lovable's AI gateway and OpenAI, as described in section 4.
• Stripe: handles our plan billing, and processes card payments on a business's own Stripe account. See Stripe's privacy policy.
• Push services: Apple, Google, Microsoft and Mozilla deliver a wake-up signal to your device. The notification text does not pass through them.
• Maps and fonts: walk maps load from OpenFreeMap, and website fonts load from Google Fonts, so those providers receive your IP address. When a sitter taps Directions or Route for today, the addresses open in Google Maps.
• Google sign-in: if you choose Continue with Google, Google confirms who you are, shares your name and email with us, and knows you are signing in to Tendling.
• Payment links: if a business lists Venmo, Cash App, PayPal, Square or a Stripe payment link, tapping it opens that provider. Venmo, Cash App and PayPal links include the amount, and Venmo's also includes the invoice number.
• Public page: if a business turns on its booking page, anyone can see the bio, service area, email and phone it publishes, along with its services, estimated prices and open meet & greet times. If it places the booking form on its own website, that website's privacy practices also apply.
• Security checks: public booking and new-client forms may show a Cloudflare Turnstile check to stop spam. When they do, Cloudflare receives your IP address and browser details. See the Cloudflare Turnstile privacy addendum.
• Calendar apps: a pet parent or team member can add a private link to an app such as Google, Apple or Outlook Calendar. That provider then receives the business name and each visit's time, service, pet names and status, from 30 days back to 90 days ahead, plus the client's first name in a team member's calendar. Calendar links never include addresses, access notes, codes or messages. Anyone who has the link can see the same details, so keep it private. It can be replaced or turned off at any time, and it stops working when someone's portal access is removed or they leave the team.
• Meta and Google: for advertising measurement on the pages described in section 8.
• Others: professional advisers where needed, authorities where the law requires it or to protect people's rights and safety, and a buyer or successor if the business is sold or merged.

A business owner can connect QuickBooks Online in Settings. It stays off until they do, and nothing is sent to QuickBooks before then.

• What we send: a sales receipt for each paid invoice from the date the owner chooses, to the QuickBooks company they connected. It includes the client's name, the payment date, the invoice number, each charged item's description and amount, and any tip. If that client or a "Pet care" service item isn't in QuickBooks yet, we add it.
• What we read and receive: the QuickBooks company ID, connection tokens, and the existing customers, items, income accounts and sales receipts needed to match entries and avoid duplicates.
• How we use it: only to provide the connection. Owners and admins of that business can see the connection's status and sync problems. We do not sell QuickBooks data, use it for advertising, or use it to train AI models.
• Disconnecting: an owner can disconnect at any time. We then stop syncing, ask Intuit to revoke the sign-in, and delete the connection tokens. Entries already sent stay in QuickBooks, which is covered by the Intuit privacy statement.

Signing in keeps a session in your browser. So that visits still work with weak signal, unsent visit updates and walk points are kept on the phone, per signed-in user, until they are sent. Signing out with updates waiting asks you first. If you dismiss the prompt to install the app, your device remembers that too.

Website analytics. Lovable measures pages visited, referral sources, country, browser, visit duration, performance and errors. Its analytics sets a first-party session cookie that expires after 30 minutes without activity, so it can link pages within a visit but does not recognize you after that. Page visits and performance are recorded on every page, whatever you choose in Cookie settings. Other interactions follow your analytics choice.

Facebook advertising measurement. On Tendling's public marketing pages, we use the Meta Pixel to measure page views and support ad measurement and optimization. When a visitor successfully submits the plain free-trial signup form, we also report a registration event from that page. This does not mean their email is confirmed or they are a paying customer. Meta receives the page URL, including any ad click or campaign details in it, permitted referrer, browser and device information, IP address, and advertising cookie identifiers such as _fbp and _fbc. Meta may connect this information with its own services, and this may count as targeted advertising under some laws. We do not provide form contents, email addresses, account identifiers, pet records, visit locations, messages or payment details through this installation. We do not report sign-ins, sign-ups with Google, email-link or invite flows, the client portal, private app, or pet-care business pages. Signup measurement follows your advertising choice and is not replayed after later acceptance. See Meta's privacy policy for how Meta handles data.

Google Ads measurement. On Tendling's public marketing pages and the page for signing in and signing up, we use the Google tag to measure visits from Google ads and to record when someone creates a Tendling account. Google receives the page address without query parameters, browser and device information, IP address, and advertising cookie identifiers such as ad click IDs. We do not send email addresses, names, account identifiers or any pet-care business data to Google. The tag does not run on sign-in links, invite links, the client portal or private app pages, and it is set not to use this information for ad personalization. See how Google uses information from sites that use its services.

Your choices. The banner asks visitors in the EU/EEA, UK, Switzerland and Canada for separate analytics and advertising choices. An unknown location also requires a choice. Elsewhere advertising measurement is enabled unless refused. Global Privacy Control overrides acceptance and blocks advertising tracking. Open Cookie settings below at any time to reject advertising and optional analytics. A withdrawal stops future optional tracking and applies to other open tabs. It does not erase information already received by Meta or Google. You can also manage your Facebook and Google ad preferences and delete cookies in your browser.

Choice records. Your browser stores your choices, the time and this notice version. If you accepted an earlier version, the banner asks again where a choice is required. A separate local history retains earlier acceptance when you withdraw. Refusals are revisited after 183 days and acceptances after 365 days. Clearing browser storage removes these local records. These records are not uploaded to Meta or Google.

• Account, client, pet, visit, location and message records stay until the business's account closes. The app has no way to delete most of these yet, so a business or pet parent can email us to remove specific records.
• Booking requests and new-client forms also stay until the account closes. If a business dismisses a new-client form, we delete it. Home access details are erased from a form once the business adds it to its records.
• Signed agreements can't be changed or deleted in the app, so they remain a record until the account closes. A business can void one and ask for a new signature.
• Notifications are removed once they are 60 days old and have been read or resolved. Records of queued emails and of QuickBooks sync problems are removed after 90 days.
• To close an account, email us. We can provide a copy of the business's data on request within 30 days of closing, then delete or anonymize it within 90 days.
• We may keep billing, tax and audit records longer where needed for legal, accounting or dispute reasons, typically up to 7 years.
• Deleted data can remain in provider backups until those backups expire.

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or limit some uses, to opt out of targeted advertising, and to withdraw consent. You can also complain to your local data protection authority. Email support@tendling.io to make a request. We aim to respond within 30 days and may need to confirm your identity. We will not treat you differently for using these rights.

We use encryption in transit, encryption at rest through our infrastructure providers, separate encryption for home access notes, database rules that keep each business's records apart, private storage for visit photos, and audit logs for sensitive actions. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

We are based in the United States, and our providers may process information in other countries, including the United States and the European Union. Where the law requires safeguards for a transfer, we rely on those our providers offer, such as Standard Contractual Clauses.

Tendling is not meant for children under 16, and we do not knowingly collect their personal information. If you think a child has given us information, email us and we will delete it.

We may update this notice. We will change the date above and announce material changes through the service or by email.

Cladeworks LLC, support@tendling.io.