Buddyly · Buddyly Privacy Policy

Last updated: 6 September 2026

This Privacy Policy explains how Buddyly collects, uses, stores, shares and protects personal data relating to people who use the Buddyly mobile application, the buddyly.app website, its links and QR codes, and related services.

Buddyly is a pet-focused social application. Depending on the features available at any given time, it enables users to create pet profiles, publish content, report lost or found pets, record sightings, receive notifications, and discover pet-related places, businesses or services.

Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD), and other applicable law.

Using Buddyly means accepting its Terms and Conditions, but it does not make consent the legal basis for every processing activity described in this Policy. Each processing activity relies on the appropriate legal basis described below.

1. Data Controller

Controller: MARTIN PINO ARCE
Trading name: Buddyly
Spanish Tax ID (NIF): 43926806A
Address: AVENIDA REINA SOFIA 15 - ESTEPONA - MALAGA, Spain
Privacy email: [email protected]
Website: https://buddyly.app

For privacy enquiries or to exercise your data protection rights, contact [email protected].

2. Personal Data We Process

The data we process depends on the Buddyly features you use.

2.1. Account and authentication data

We may process:

Name, alias or display name.
Email address.
Telephone number, where requested or voluntarily provided.
Profile photo or avatar.
Internal user and account identifiers.
Data required for authentication, account recovery and account security.
Language, country and account preferences.

Authentication data may be managed through our infrastructure and technology providers. Buddyly does not need to know or store passwords in plain text.

2.2. Pet data

When you create or manage a pet profile, we may process:

Name.
Species or animal type.
Breed.
Age or approximate date of birth.
Sex.
Description.
Photographs.
Physical characteristics.
Other information you choose to provide.

Although this information mainly describes a pet, it may constitute personal data where it is linked to an identified or identifiable person.

2.3. Posts and user-generated content

We may store content you publish or submit to Buddyly, including:

Posts and text.
Photographs and images.
Reports.
Sightings.
Case updates.
Interactions or other social features Buddyly may enable in the future.

Certain content is intended to be visible to other users or publicly within the service.

2.4. Lost pets, found pets and sightings

When you use these features, we may process:

Pet information and photographs.
Case description.
Approximate date and time.
Area, entered address or selected location.
Geographic coordinates.
Contact information you choose to make available.
Report or sighting updates.

This information is used to publicise the case and facilitate community collaboration.

2.5. Location

Buddyly may process approximate or precise location where needed for features such as:

Creating or viewing lost-pet reports.
Recording sightings.
Selecting a location on a map.
Showing nearby content, businesses or services.
Sending area-related alerts where that feature is enabled and you have granted the relevant permissions.

Location may come from your device, an address entered manually, or a location you select on a map.

You can withdraw location permissions through your device settings. Refusing or withdrawing permission may limit certain features. Buddyly will not use background location unless a specific feature requires it, appropriate information is provided, and the relevant permission is requested.

2.6. Camera, photographs and media files

When you choose to upload content, Buddyly may access photographs, the camera or files selected by you for features such as pet profiles, posts, reports and sightings.

Where supported by the operating system, we aim to request only the access needed for the action you choose.

You must not publish images or information about third parties unless you have the right to do so.

2.7. Technical, security, diagnostic and analytics data

We may process information such as:

IP address.
General device type and model.
Operating system.
Buddyly version.
Language and approximate region.
User, installation, device or session identifiers, as applicable.
Usage and navigation events within Buddyly.
Screens or features used.
Error, crash, performance and diagnostic information.
Information needed to prevent fraud, abuse or unauthorised access.

We use analytics and diagnostic tools, currently including PostHog for product analytics and attribution and Sentry for errors, diagnostics and performance, according to their configuration in Buddyly.

2.8. QR codes, links and campaign attribution

Buddyly uses first-party links and QR codes for physical and digital campaigns. When you open one of these links, we may process:

Campaign source or identifier.
Date and time.
Platform or operating system.
Technical browser or device information.
IP address where received by our infrastructure or providers.
Subsequent conversion or usage events associated with the campaign, where technically possible and legally permitted.

This information helps us measure campaign performance, for example campaigns involving veterinary clinics, shelters, events, sponsors or social media.

2.9. Push notifications

If you enable notifications, we may process:

Push notification token or identifier.
Installation or device identifier.
Notification preferences.
Delivery, opening or interaction information where available.

Buddyly currently uses OneSignal for push notification infrastructure.

You can disable notifications through Buddyly, where that option is available, or through your device settings.

2.10. In-app purchases and contributions

Where Buddyly offers in-app purchases or contributions, these may be managed by the Apple App Store, Google Play and RevenueCat.

Buddyly does not store your full payment card details. We may receive and process information such as:

Product or contribution purchased.
Transaction date and status.
Transaction, customer or purchase identifiers.
Purchase platform.
Information needed to validate or restore purchases, prevent fraud and provide support.

2.11. Communications and support

When you contact Buddyly, we may process:

Your name and contact details.
The content of your enquiry.
Communication history.
Technical or account information needed to investigate and resolve an issue.

2.12. Website and similar technologies

The Buddyly website may receive standard technical data associated with a web connection and may use cookies, local storage or similar technologies where needed for operation, security, preferences or analytics.

Where the law requires consent for non-essential technologies, consent will be requested before they are used. The website's actual configuration and tools must remain consistent with this Policy and, where applicable, with the relevant cookie notice or policy.

3. Purposes and Legal Bases

We process personal data only where there is a valid legal basis.

3.1. Performance of a contract

Legal basis: Article 6(1)(b) GDPR.

We may process data needed to:

Create, authenticate and manage your account.
Create and manage pet profiles.
Publish and display content you ask us to publish.
Manage reports and sightings.
Provide maps and service-related functionality.
Manage purchase or contribution features.
Handle requests directly related to the service.

3.2. Consent

Legal basis: Article 6(1)(a) GDPR.

Where appropriate, we will ask for consent for processing such as:

Access to precise location where required by the operating system or applicable law.
Camera, photograph or file permissions.
Push notifications.
Marketing communications not covered by another legal basis.
Non-essential analytics cookies or technologies where legally required.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

3.3. Legitimate interests

Legal basis: Article 6(1)(f) GDPR.

After considering the interests and rights involved, we may process data to:

Maintain Buddyly's security.
Prevent fraud, spam, abuse and misuse.
Investigate errors and improve stability and performance.
Obtain reasonable metrics about service use and operation.
Measure campaign and QR-code effectiveness.
Defend legal rights and manage claims.
Moderate content and protect users, third parties and the community.

Where the law requires consent for a specific technology, we will not rely on legitimate interests to bypass that requirement.

3.4. Legal obligations

Legal basis: Article 6(1)(c) GDPR.

We may process or retain data to comply with legal obligations, valid requests from authorities, tax or accounting requirements, consumer law, security requirements, dispute handling or other applicable obligations.

4. Public Data and Visibility

Buddyly includes social and community features. Information you publish in profiles, posts, reports or sightings may be visible to other users and, depending on the feature, to people accessing public content.

Before publishing:

Avoid exact home addresses unless necessary.
Do not publish identity documents, banking data or other highly sensitive information.
Do not publish third-party data or images without a legitimate basis.
Do not publish data or images of minors unless you have legal authorisation and it is strictly necessary.

Buddyly may reduce the precision of certain publicly displayed locations where the feature is designed to do so.

5. Recipients and Service Providers

To operate Buddyly, we may disclose data to or allow access by technology providers, subject to their role and the applicable agreements.

These currently may include:

Supabase: authentication, database, storage and backend services.
OneSignal: push notifications.
PostHog: product analytics, events and attribution.
Sentry: error monitoring, diagnostics and performance.
RevenueCat: management and validation of in-app purchases.
Apple: app distribution and iOS purchase processing.
Google: app distribution, Google Play Billing, maps and related Android or web services, depending on the feature used.
Hosting, infrastructure, security, email and technical support providers needed to provide the service.

We may also disclose data where necessary to comply with a legal obligation, respond to a competent authority, protect legal rights, investigate fraud or abuse, or protect users and third parties.

Buddyly does not sell personal data.

We will not share personal data with sponsors, veterinary clinics, businesses or other commercial partners for their own marketing purposes unless there is a valid legal basis and users are informed where required.

6. International Data Transfers

Some technology providers may process data outside the European Economic Area.

Where an international transfer requires additional safeguards, we will use mechanisms permitted by the GDPR, such as:

European Commission adequacy decisions.
The EU-U.S. Data Privacy Framework where applicable to the recipient.
European Commission Standard Contractual Clauses.
Additional technical, contractual or organisational safeguards where necessary.

You may request further information about applicable safeguards by contacting [email protected].

7. Data Retention

We retain data for no longer than necessary for the purpose for which it was collected and, afterwards, for periods needed to address legal liabilities.

As a general approach:

Account: while the account remains active and until deletion is processed, except for data that must lawfully be retained.
Pet profiles and content: while associated with an account or published, unless deleted, anonymised or justifiably retained.
Reports and sightings: while needed for the community purpose of the case and, where appropriate, for a reasonable period afterwards for security, abuse prevention or incident handling.
Support: for the time needed to handle the enquiry and potential liabilities.
Purchases: for periods needed for validation, support, fraud prevention and applicable tax or accounting obligations.
Security, errors and diagnostics: for limited periods configured according to operational and security needs.
Analytics and attribution: for limited periods defined in the configuration of the tools used; where possible, aggregated or anonymised data will be used for longer-term analysis.

Buddyly will review retention periods and provider configurations to avoid retaining identifiable data for longer than necessary.

8. Account and Data Deletion

You may request deletion of your account:

Through the account deletion feature available within Buddyly.
Through the external account-deletion resource Buddyly publishes on buddyly.app.
By contacting [email protected] if you need assistance.

We may request reasonable identity verification to prevent fraudulent deletion requests.

When an account is deleted, Buddyly will delete or anonymise associated personal data that is no longer required, including, as applicable, account data, pet profiles, content, photographs, reports, sightings, preferences and identifiers.

Certain data may be retained in a blocked or segregated form where there is a legal obligation or a legitimate need for security, fraud prevention, defence of legal claims or transaction records. Where information can be made genuinely anonymous so that it is no longer personal data, it may be used for statistics or service improvement.

Deleting a Buddyly account does not automatically cancel a subscription or purchase managed directly by Apple or Google where the user must manage it through the relevant store account.

9. Your Data Protection Rights

Where applicable, you may exercise the rights of:

Access.
Rectification.
Erasure.
Objection.
Restriction of processing.
Data portability.
Withdrawal of consent.
The right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, in the circumstances provided by law.

To exercise your rights, contact [email protected]. We may request reasonable information to verify your identity.

You also have the right to lodge a complaint with a supervisory authority. If you are in Spain, the competent authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos --- AEPD).

10. Device Permissions

Buddyly may request permissions for:

Location: maps, reports, sightings and nearby features.
Camera and photographs: uploading images selected by the user.
Notifications: relevant alerts and updates.
Network/Internet: connection to services required for Buddyly to operate.

Permissions can be managed through the operating system. Refusing a non-essential permission will not prevent use of features that do not require it.

11. Security

Buddyly applies reasonable technical and organisational measures proportionate to risk, which may include:

Encryption of communications in transit.
Authentication and access controls.
Restrictions on administrative access.
Data-access and storage rules.
Error and security monitoring.
Secret and credential management.
Dependency updates and reviews.
Backups and recovery measures where appropriate.

No system can guarantee absolute security. If you identify a vulnerability or incident relating to Buddyly, contact [email protected].

12. Minors

Buddyly is intended for people aged 18 or over.

We do not intend to knowingly collect personal data from people under 18 as account holders. If we learn that an account was created in breach of this requirement, we may take steps to remove it and handle the data in accordance with applicable law.

Users must not publish identifiable data or images of minors without legal authorisation and a legitimate need.

13. Communications

We may send communications necessary to provide Buddyly, for example concerning:

Account access and security.
Significant service changes.
Reports or alerts you have requested.
Purchases or support.
Legal notices.

Marketing communications will only be sent where there is a valid legal basis. Where optional, you can unsubscribe using the mechanism provided.

14. Third-Party Services and Links

Buddyly may display links or information relating to veterinary clinics, shelters, businesses, pet-friendly services, maps, app stores, sponsors or other third parties.

When you leave Buddyly or interact directly with an independent third party, that party's own policies may apply. Buddyly does not control the privacy practices of independent external services.

15. Automated Decision-Making and Profiling

Buddyly may use automated rules for technical functions such as abuse prevention, content ordering, analytics or error detection. Unless expressly stated otherwise, Buddyly does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them.

If this changes, we will provide the information and safeguards required by applicable law.

16. Changes to this Policy

We may update this Policy to reflect legal, technical, operational or functional changes.

Where changes are significant, we will use reasonable means to inform users, such as an in-app notice, email or prominent notice on the website.

The date shown at the beginning identifies the current version.

17. Contact

For privacy matters or to exercise data protection rights:

[email protected]

Controller: MARTIN PINO ARCE
Trading name: Buddyly
Spanish Tax ID (NIF): 43926806A
Address: AVENIDA REINA SOFIA 15 - ESTEPONA - MALAGA, Spain
Website: https://buddyly.app