Controller and contact

Petiosa is a pre-launch service planned to be operated by ARQDEV in Prague, Czech Republic. ARQDEV has not yet been incorporated. The registered legal name, company number, full service address, governing law, and dispute terms will be added and professionally reviewed after incorporation and before public app-store release.

The planned operator is ARQDEV, based in Prague, Czech Republic (incorporation pending). Until the registered operator details are published, privacy enquiries and rights requests are handled through privacy@petiosa.com. The registered legal identity, company number, and full service address must be added after incorporation.

Data we process

• Account identifiers, email address, username, authentication and security records.
• Profile details, pet profiles, photos, posts, comments, likes, follows, groups, events, adoption and lost-and-found content.
• Private messages and attachments, accessible only as needed to provide the service, investigate valid reports, protect safety, or comply with law.
• Location information when a user enables location features; visibility follows product privacy controls and feature-specific discovery rules.
• Professional profile, verification, service, appointment, campaign, subscription, and provider-confirmed billing records.
• Device, notification-token, diagnostic, anti-abuse, audit, and support information.

Purposes and legal bases

• Contract: provide accounts, profiles, social features, messaging, discovery, free adoption, safety tools, professional services, support, and account deletion.
• Legitimate interests: secure the service, prevent fraud and abuse, enforce Community Guidelines, investigate reports, maintain reliability, and defend legal claims, balanced against user rights.
• Consent or device permission: use optional location, notification, camera, photo, or similar device features where the platform requires a choice. Consent may be withdrawn through device or app settings.
• Legal obligation: respond to lawful requests and retain limited records where law requires it.
• Provider-confirmed transactions: verify purchases and maintain subscription entitlements without Petiosa storing full payment-card details.

Service providers and recipients

Petiosa uses the following provider categories only where the relevant feature is active:

• Supabase: authentication, database, storage, server functions, and security infrastructure.
• Vercel: public website hosting, delivery, and operational request logs.
• Expo/EAS: mobile application build, update, and delivery infrastructure.
• Apple and Google: app distribution, device platform services, and provider-controlled purchases.
• Stripe: professional web billing and identity-verification workflows where offered.
• Email delivery provider: transactional, support, privacy, and account-verification messages once the final production provider is configured.

Information is also shared with other users according to the feature and privacy settings, with professional counterparties when a user initiates a relevant interaction, and with authorities or advisers where legally required. Providers may process data outside a user's country. Where required, Petiosa will use adequacy decisions, approved contractual safeguards, or another lawful transfer mechanism.

Visibility and control

Petiosa is an authenticated social network. Social content intended for discovery may be visible to signed-in users. Private messages remain participant-scoped. Pet privacy settings are enforced server-side, while adoption and matching can have intentional discovery rules disclosed in the interface.

Retention and deletion

• Account, profile, social, messaging, pet, notification-token, and user-owned media data is kept while the account is active and removed when authenticated account deletion completes, except where a limited record must be retained.
• Support and privacy requests are kept until the request is resolved and for the minimum additional period reasonably needed to document the response or handle a dispute.
• Security, anti-abuse, and audit records are kept only for the period needed to investigate incidents, protect users, meet platform security requirements, or establish and defend legal claims.
• Provider-confirmed billing, tax, fraud, dispute, and accounting records may be retained for the legally required period; direct identifiers are removed or minimized where possible.
• Backups and provider logs expire according to controlled backup rotation and provider retention schedules. Data scheduled for deletion is not restored to active use.

Cookies and device storage

The public website does not currently use advertising cookies, cross-site tracking, or optional analytics cookies. Essential cookies and browser storage may be used for security, Supabase authentication, and the one-time account-deletion email verification flow. These mechanisms are necessary to provide the requested service and cannot be disabled through a consent banner. See the Cookie & Storage Notice for details. If optional analytics or advertising technology is introduced, Petiosa will update this policy and request consent where required before activating it.

Your rights and regional choices

Depending on location, users may request access, correction, deletion, restriction, portability, or objection; withdraw consent where consent is used; and complain to their local data-protection authority. Residents of jurisdictions with applicable privacy laws may also request information about categories of data, sources, recipients, and use, and may exercise rights without unlawful discrimination.

Petiosa does not sell personal information and does not currently share it for cross-context behavioural advertising. Identity may be verified before a request is fulfilled. Contact privacy@petiosa.com or use the account deletion page.

Adults only

Petiosa is not directed to children. Accounts require users to be at least 18. Accounts reasonably identified as underage may be restricted or removed.

Security and changes

Petiosa applies access controls, encrypted transport, scoped storage, logging redaction, and server-enforced authorization. No service can guarantee absolute security. Material policy changes will be dated and communicated when required.