Privacy Policy
Last updated: 1 June 2026
We've written this policy in plain English. If anything is unclear, please contact usand we'll explain.
1. Who we are
PawLink is a service operated by Voxel & Vine Design, a sole trader based in Telford, United Kingdom (the “data controller”).
Contact us at: voxelandvinedesigns@gmail.com
We are registered with the UK Information Commissioner's Office (ICO) as a data controller. Our lawful basis for processing personal data is set out in section 4 below.
2. What personal data we collect
We collect different types of personal data depending on how you interact with PawLink:
Account owners
- Email address and password (hashed — we never see the plain text)
- Mobile phone number (optional, for SMS alerts)
- Postcode (optional, used to estimate distance to found reports)
Pet profiles
- Pet name, breed, colour, gender, date of birth
- Photos uploaded by the owner
- Medical notes, medications, allergies, vet details
- Microchip number
- Distinguishing features
Tag scans
- Date and time of each NFC tap
- Estimated location derived from IP address (city/country — not precise GPS)
- Browser/device type (user agent string)
Found reports (finders)
- Name, email address, and optional phone number
- GPS location at time of submission (with your permission)
- Photos optionally uploaded of the pet or area
- Message to the owner
Household members
- Email addresses added by the account owner to receive notifications
We do not collect payment information. All purchases are made through Etsy, which operates under its own privacy policy. PawLink never receives your card details.
3. How we use your data
We use the data we collect only for the purposes described below:
- To provide the PawLink service — maintaining your pet's live profile and NFC tag functionality
- To send you notifications when your pet's tag is scanned, or when a found report is submitted
- To facilitate secure communication between pet owners and finders through our messaging system
- To verify microchip details via the ChipNDoodle API (chip number only — no other data is sent)
- To send you periodic account verification reminders (every 4 months) to ensure your details stay current
- To improve the service using anonymised analytics data
We do not use your data for advertising, and we do not sell your data to any third party.
4. Legal basis for processing
Under UK GDPR, we process your personal data on the following legal bases:
Contract (Article 6(1)(b))
Processing your account data and pet profile data is necessary to provide the PawLink service you signed up for.
Legitimate interests (Article 6(1)(f))
Processing tag scan data, found report data (from finders), and household member data serves the legitimate interest of reuniting lost pets with their owners — a purpose that does not override the data subjects' fundamental rights and freedoms.
Consent (Article 6(1)(a))
Where you actively choose to share your GPS location when submitting a found report, this is processed on the basis of your consent, which can be withdrawn at any time by not granting location access.
5. How long we keep your data
We keep your data for as long as your account is active. Specifically:
- Account and pet data — kept for the lifetime of your account. If you delete your account, your data is deleted within 30 days.
- Tag scan records — kept for 2 years, then automatically deleted.
- Found reports — kept for 1 year after the report is resolved, then deleted.
- Finder data (name, email, phone from found reports) — kept for 1 year or until the report is resolved, whichever comes first.
You can request deletion of your data at any time by contacting us (see section 8).
6. Who we share your data with
We do not sell your personal data. We use the following trusted third-party services (“processors”) to operate PawLink. Each has been selected for its GDPR compliance and data protection commitments.
Supabase
Database, authentication, and file storage · EU West (Ireland)
Vercel
Website hosting and performance analytics · United States (EU-US DPF certified)
Resend
Transactional email delivery · United States (EU-US DPF certified)
ChipNDoodle
Microchip database search · United States
When you use the microchip verification feature, your pet's chip number is sent to ChipNDoodle to search registered databases. No other personal data is shared. ChipNDoodle's privacy policy is available at chipndoodle.com.
OpenStreetMap / Nominatim
Reverse geocoding (address lookup from GPS coordinates) · Germany
GPS coordinates from found reports are sent to Nominatim to convert them into a human-readable address. No personal identifying information is included in these requests.
Google (optional)
OAuth authentication · United States
If you choose to sign in with Google, your name and email address are shared with us by Google. Google's privacy policy is available at policies.google.com/privacy.
7. International data transfers
Some of our processors are based outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:
- Vercel and Resend are certified under the EU-US Data Privacy Framework (DPF), which the UK recognises as providing adequate protection.
- Supabase stores data in EU West (Ireland) and uses Standard Contractual Clauses (SCCs) for any transfers outside the EEA.
8. Your rights under UK GDPR
Under UK GDPR, you have the following rights regarding your personal data:
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct inaccurate or incomplete data.
Right to erasure
Ask us to delete your personal data ('right to be forgotten').
Right to restriction
Ask us to pause processing of your data in certain circumstances.
Right to portability
Receive your data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interests.
To exercise any of these rights, email us at voxelandvinedesigns@gmail.com. We will respond within 30 days.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. Cookies
PawLink uses a small number of cookies and similar technologies. For full details, see our Cookie Policy.
In summary: we use essential cookies to keep you logged in, and optional analytics cookies via Vercel to help us understand how the site is used. We do not use advertising or tracking cookies.
10. Security
We take the security of your data seriously. Measures we have in place include:
- All data is encrypted in transit using HTTPS/TLS
- Passwords are hashed by Supabase — we never store or see plain-text passwords
- Row Level Security (RLS) on our database ensures users can only access their own data
- Finder contact details are never shown directly to owners — all communication goes through our secure messaging system
- Magic link tokens used in emails are single-use and rotate after each use
11. Changes to this policy
We may update this policy from time to time. When we make significant changes, we will notify you by email. The date at the top of this page shows when it was last updated.
12. Contact us
For any questions about this privacy policy or your personal data:
Data controller: Voxel & Vine Design
Email: voxelandvinedesigns@gmail.com
Location: Telford, United Kingdom