Privacy Policy

At Zo, protecting your privacy and your pet's information is at the core of our ethos. This Privacy Policy explains who we are, what information we collect, how and why we use it, who we share it with, how long we keep it, how we protect it, and the rights you have — wherever in the world you use Zo. It applies globally; the regional sections below add rights and disclosures specific to where you live.

1. Who We Are (Data Controller)

Zo ("Zo", "we", "us", or "our") is the controller responsible for your personal information processed through the App. Zo is operated by an independent individual.

You can reach us at contact@thezoapp.online for any question or request relating to this Policy or your data.

2. Definitions

• "Personal Data": information relating to an identified or identifiable individual (you), such as your name, email, or device identifier.
• "Pet Information": information about your pet that you record. A pet is an animal, not a person, so this is generally not your personal data — but where linked to your account it is treated with the same care.
• "Well-being Information": the well-being attributes you choose to record about your pet (breed traits, dietary preferences, activity levels, and any conditions or sensitivities you note). It personalises suggestions and is not medical or veterinary data.
• "Processing": any operation performed on Personal Data (collecting, storing, using, sharing, or deleting).
• "Controller": the party that decides why and how Personal Data is processed (us).
• "Processor" / "Service Provider": a third party that processes data on our instructions and on our behalf.
• "Sale" / "Sharing": as defined under laws such as the California Consumer Privacy Act — Zo does neither (see Section 6).

3. Information We Collect

a. Account Information (about you):
When you register, we collect your name, email address, a securely hashed password, and (optionally) a profile picture. If you sign in with a third-party provider (e.g. Google), we receive the basic profile information that provider shares.

b. Pet Profile & Well-being Information:
Information you record about your pets, including name, species, breed, age, weight, sex, spay/neuter status, activity levels, dietary preferences, any well-being conditions or sensitivities you choose to note, and photographs. You decide what to record and can edit or remove it at any time.

c. Usage & Activity Information:
How you interact with the App, including daily check-ins, well-being logs, step counts, walks, feature usage, session duration, and the AI-generated blueprints and suggestions produced for your pet.

d. Device & Technical Information:
Device identifiers, operating system and app version, approximate region, IP address, crash logs, and diagnostic data, collected automatically to keep the App stable and secure.

e. Location Information:
With your explicit permission, foreground location data (while the App is in use, including during an active walk) to map walks, calculate distances, and provide localised environmental awareness (such as local UV index, temperature, or tick activity). We do not collect your location in the background. You can withdraw this permission at any time in your device settings.

We do not intentionally collect special-category personal data about you. Well-being Information relates to your pet, not to you.

4. How We Use Your Information and Our Legal Bases

We use your information only for the purposes below. Where the UK or EU GDPR applies, we rely on the legal basis identified for each:

• Provide the service — deliver and secure the App's core features. Basis: performance of a contract.
• Personalise well-being suggestions — process your pet's profile to generate blueprints, insights, and suggestions. Basis: performance of a contract; and, where required, your consent.
• Localised awareness — use location (with permission) for walk mapping and environmental awareness. Basis: your consent.
• Communicate with you — send routine, administrative, security, and service messages. Basis: contract and our legitimate interests; marketing only with your consent.
• Keep the App safe and improve it — maintain stability, prevent abuse, and develop features using aggregated, de-identified data. Basis: our legitimate interests.
• Comply with law — meet legal and regulatory obligations. Basis: legal obligation.

Where we rely on consent you can withdraw it at any time; where we rely on legitimate interests you can object (see Section 11).

5. Automated Processing and AI

Zo uses artificial intelligence (currently Google Gemini) to generate well-being blueprints, daily insights, and suggestions from the information you provide. This processing is automated, but it does not make decisions that produce legal or similarly significant effects on you. The outputs are suggestions for your consideration only — you remain in control of every decision about your pet, and they are never a substitute for professional veterinary care. You can ask us about the logic involved and request human review of any output (see Section 11).

6. We Do Not Sell or "Share" Your Data

Your trust is our most valuable asset. We do not, and will never, sell, rent, or lease your personal information or your pet's information to third parties, data brokers, or advertisers, and we do not "share" your personal information for cross-context behavioural advertising as defined under California and other privacy laws. Your data is not the product.

7. How We Share Information

a. Service Providers (Processors):
We use trusted providers to run the App — including Supabase (database, authentication, storage), Google Cloud, Google Firebase Cloud Messaging (push delivery), and Google Gemini (AI generation of suggestions). They process data only on our documented instructions under data processing agreements and may not use it for their own purposes.

b. Legal & Safety:
We may disclose information where required by law, court order, or a valid governmental request, or to protect the rights, safety, or property of Zo, our users, or the public.

c. Business Transfers:
If Zo is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honour this Policy and notify you of any change in control of your information.

8. International Data Transfers

Zo operates globally, and your information may be processed in countries other than the one in which you live, including the United States and the European Union. Whenever we transfer personal information out of the UK or the EEA, we rely on a lawful transfer mechanism, such as: transfers to countries covered by a UK or EU adequacy decision; the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified; and the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by a transfer risk assessment where appropriate. Contact us for more information about these safeguards.

9. Data Security

We implement robust, industry-standard measures to protect your information, including encryption in transit (TLS), encryption at rest, and Row-Level Security in our database so that you can only access your own data. We restrict internal access on a need-to-know basis. No method of transmission or storage is ever completely secure, so while we work hard to protect your information we cannot guarantee absolute security. If a breach affects your rights, we will notify you and the relevant authorities as required by law.

10. Data Retention

We keep your personal and pet information only for as long as your account is active or as needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will erase your identifying data from our active systems within 30 days, subject to limited retention required by law. Aggregated or de-identified data that can no longer be linked to you or your pet may be kept for analytics.

11. Your Privacy Rights

Subject to your local law, you have the right to: Access a copy of your data; Rectify inaccurate data (most of which you can edit in the App); Erase your account and associated data from the App's settings; Restrict processing in certain cases; Portability of your data in a machine-readable format; Object to processing based on our legitimate interests and to direct marketing; Withdraw consent where we rely on it; request Human review of any automated output; and Complain to your local data protection authority.

To exercise any of these, use Settings → Privacy & Data or email contact@thezoapp.online. We will respond within the timeframe required by your local law (generally one month under UK/EU GDPR). We will not discriminate against you for exercising your rights.

12. Regional Privacy Disclosures

a. United Kingdom & EEA:
Zo is the controller of your personal data. Our legal bases are in Section 4 and our transfer safeguards in Section 8. You have the rights in Section 11, including to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your national authority. Where we must designate an Article 27 representative, we will identify it here and you may contact it via contact@thezoapp.online.

b. California (CCPA/CPRA):
We collect the categories in Section 3 for the purposes in Section 4. We do not sell or share personal information, and we do not use sensitive personal information for purposes requiring a right to limit. California residents have the right to know, delete, correct, and to non-discrimination, and may use an authorised agent. Submit requests via contact@thezoapp.online.

c. Other regions:
If you are in Canada, Australia, Brazil, or another jurisdiction with a comprehensive privacy law (such as PIPEDA, the Australian Privacy Principles, or the LGPD), you have the rights granted by your local law; to exercise them, email contact@thezoapp.online.

13. Children's Privacy

Zo is intended for adults and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child without appropriate consent, we will delete it promptly. If you believe a child has provided us with personal data, please email contact@thezoapp.online.

14. Contact Us

If you have any question, concern, or request regarding this Policy or how we handle your data, please contact us at contact@thezoapp.online.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in the law or our practices. We will post the updated Policy here, update the "Last Updated" date, and — for material changes — provide additional notice through an in-app message or email before the change takes effect. Your continued use of the App after an update means you accept the revised Policy.