Version 8 · effective 24 October 2026
You're viewing an older, archived version of this document. View the current version
Effective 2026-10-24. This is version 8 — see the version history at the bottom of this page.
This Policy explains what personal data Petunija collects, why, who we share
it with, and what rights you have over it. It's written from a full, real
inventory of what this app stores — see docs/DATA_INVENTORY.md in our
public source repository if you want the underlying technical detail this
Policy is drawn from.
Petunija is the data controller for the personal data described in this Policy, processed for the purpose of operating the Platform described in our Terms of Service.
Account & profile. Name, email, phone number, and — if you become a Nanny — a public bio, location, and (once geocoded) an approximate service area. Why: necessary to create and operate your account and, for Nannies, to be discoverable (contract necessity / consent for the optional public bio).
Pet data. If you're an Owner: your pet's name, type, breed, age, weight, vaccination status, and an optional care profile — feeding schedule, medication, health/vaccination history, your regular vet's contact, behavioral notes, and an emergency human contact. Why: this is exactly the information a Nanny needs to safely care for your pet (contract necessity). We treat the care profile as sensitive: a Nanny can only see it once a specific booking with you has been accepted — never while it's still a pending request from a stranger.
Messages. Private conversations between an Owner and a Nanny. Why: coordinating a booking requires being able to talk to the other person (contract necessity). Only the two participants in a conversation can ever read it.
Identity verification (optional, Nannies only). A government ID photo and a selfie, if a Nanny chooses to complete identity verification. These images are never visible to anyone but an admin reviewing them — not even to the Nanny who uploaded them — and are deleted as soon as an admin makes a decision (approve, request changes, or revoke), with an hourly automated backstop that catches anything a one-off technical error left behind. Only a short note survives after that ("Identity document reviewed (approved) on [date] by [admin]") — never the image itself, never an ID number. Why: legitimate interest in offering a meaningful "Identity verified" badge, only ever completed voluntarily.
Phone verification. Your phone number and a hashed record of any SMS verification code we sent you (never the plaintext code). Why: legitimate interest in preventing fraud and throwaway accounts; a verified phone also becomes a trust signal other users can see.
Location. If you're a Nanny, your approximate home area — geocoded from the location you enter, stored as an exact coordinate for accurate distance search, but never shown to anyone in exact form. What's public is a small (~300-500m), consistently-offset approximation of your real position, plus your city district — enough for "near me" search, not enough to find your actual address. This is enforced at the database level (a technical access restriction on the exact columns, not just an app-layer promise), on top of the same restriction the app's own pages already apply. Why: legitimate interest in distance-based search, with a deliberate, proportionate mitigation given how sensitive a home address is.
Bookings, care contracts & reviews. Dates, price, cancellation history, the generated care-contract document, and any review you write or receive. Why: this is the core service (contract necessity), and, for cancellation/incident history, our legitimate interest in supporting dispute resolution between users (Petunija is a venue, not a party to any booking — see our Terms §10).
Reports & safety. If you or someone else files a report (harassment, a fake profile, a booking incident, etc.), we keep what was reported, by whom, and how our trust & safety team resolved it. Why: legitimate interest in keeping the Platform safe.
We use a small number of specialist processors to run the Platform. None of them may use your data for their own purposes.
| Processor | What they do | What they see |
|---|---|---|
| Supabase | Database, authentication, and file storage hosting | Everything described in §2 — it's the database itself |
| Vercel | Hosts and serves the application | Request traffic needed to load pages and aggregate Web Analytics statistics |
| Resend | Sends transactional email (booking updates, verification links, review nudges) | Your email address and the content of emails we send you |
| Messente | Sends SMS one-time codes for phone verification | Your phone number and the code text, for that purpose only |
We do not sell your personal data, and we do not share it with advertisers. Other users only ever see what this Platform is designed to show them — your public profile if you're a Nanny, messages you send them directly, and the fields of a care contract relevant to a booking you share with them.
Essential cookies support authentication, language and dashboard preferences. Our cookie-free Vercel Web Analytics continues to measure aggregate visits and bounded product actions in production, respecting Do Not Track. It does not require the separate Google Analytics choice and creates no analytics cookies or stored marketing attribution. Vercel uses transient request inputs, including IP and browser information, to derive a visitor hash discarded after 24 hours. We do not log or persist raw IP for analytics. Browser URLs are redacted and server business events do not claim campaign attribution.
Google Analytics 4 is optional and used only after you select “Allow analytics”. Before that choice, after rejection and under Do Not Track, we load no Google analytics script and send no Google measurement requests or cookieless pings. Google processes consented public-page categories, validated marketing campaign codes, browser/device information, approximate geography and analytics identifiers for website acquisition and campaign reports. Google receives the network request (including IP); GA4 does not log or store individual IP addresses. Public route categories replace real page addresses and titles; we suppress referrers and remove queries, fragments and profile IDs. Authentication, dashboard, messages, claims, private and token-bearing pages are excluded. No names, contact information, forms, pet/health details or message contents are sent. We do not link Google reports to account IDs or server booking/signup receipts, and reports omit non-consenting and blocked visits.
Only the essential versioned Google choice is stored in local storage (“petunija_ga_consent”) until you change it, clear browser storage or we update the consent version. Google may set first-party _ga and ga<stream> analytics cookies after opt-in, configured for up to one year without rolling renewal. Use “Analytics preferences” in the footer to reject or withdraw at any time. Withdrawal stops further measurement in this and other open tabs and deletes known Google analytics cookies. It does not erase earlier Google reports; contact us to exercise applicable data rights. Account terms acceptance is separate and never grants analytics or advertising consent.
Google Signals, advertising storage, advertising user data, personalization, remarketing, cross-domain linking and enhanced automatic measurement are off. The Google integration uses no advertising pixel, User-ID, fingerprint or Measurement Protocol secret. The GA property must use two-month event/user-data retention; standard aggregate report retention differs and is controlled by Google. Processing may involve Google entities outside the EEA under Google's applicable contractual and transfer safeguards. Google Analytics configuration and processor terms are documented in our operational data inventory. This policy remains an engineering draft pending legal review. Analytics rejection does not affect your access to the Platform.
Separately from Google, selecting “Allow Meta” permits one basic PageView image request per document visit on the homepage, browse or generic signup page. No Meta JavaScript SDK is loaded. We send only our public Pixel ID, the PageView event name and the image-mode flag; page URLs, referrers, campaign parameters, forms, account IDs, messages and pet/health details are not sent. Meta receives your IP address and browser/network information and may use its own cookies, subject to browser restrictions, to associate the visit with your Meta account. This is limited visit measurement, not confirmed registration or booking tracking. We do not enable automatic matching, first-party _fbp/_fbc cookies or server Conversions API. Meta's own cookies and retention are controlled by Meta; see Meta's privacy policy and cookie policy.
Your essential separate choice is saved as petunija_meta_consent in local storage until changed, cleared or its disclosure version changes. Use the same footer “Analytics preferences” control and “Reject Meta” to withdraw. No requests are sent before acceptance, after rejection, under Do Not Track or Global Privacy Control, or on private/token-bearing pages. Withdrawal stops subsequent requests across open tabs; a request already sent cannot be recalled and prior Meta records are not erased. We cannot clear cookies on Meta's own domain. Rejecting Meta does not affect use of Petunija or your Google choice. Processing is subject to Meta's Business Tools Terms and may involve processing outside the EEA under Meta's applicable transfer safeguards. Account signup terms do not grant advertising consent.
We keep most data for as long as your account exists, or as long as it's needed for the purpose it was collected for. Some specifics:
Under the GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; request deletion; request that processing be restricted in certain cases; object to processing based on our legitimate interest; and receive a copy of your data in a portable format. Today, you can exercise deletion directly and immediately from Account Settings. For access, correction, portability, or objection requests, contact us at hello@petunija.lt and we'll action it manually — a self-service one-click export and a fully-automated rights request flow are planned (tracked separately) but not built yet; we're not going to pretend they already exist. You also have the right to lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), Lithuania's supervisory authority.
Our processors (§3) may process data on infrastructure located inside or outside the European Economic Area, depending on each processor's own regional configuration. Where data is processed outside the EEA, we rely on the safeguards each processor itself commits to in its own data processing terms (such as the EU Standard Contractual Clauses).
We rely on our processors' platform-level security (encryption in transit and at rest, access controls) and enforce our own access rules directly in the database — for example, only an admin can ever read an identity document, and a Nanny's exact home coordinates are never selectable by an ordinary user account, enforced as a database-level restriction, not just an app-layer promise. No system is perfectly secure; if we ever become aware of a data breach affecting you, we will notify you and the supervisory authority as required by law.
The Platform is not directed at, and accounts may not be created by, anyone under 18.
The same change process described in our Terms of Service §12
applies here: a material change is emailed to affected users (and, once
available, shown as an in-app notice); a non-material clarification takes
effect on publication. Every past version stays available at a stable
archive URL (e.g. /privacy/v1).
Questions about this Policy, or a request to exercise any of the rights in §6, can be sent to hello@petunija.lt.
Also see our Terms of Service