Privacy Policy

1. Who we are and what this covers

FURRR (“FURRR”, “we”, “us”) operates a booking and business-management platform for pet grooming salons, available at furrr.tech and on salon-specific web addresses we host (together, the “Platform”). This policy explains what personal information we collect, why we collect it, who we share it with, and the choices and rights you have. It is written to satisfy the privacy laws of the places we serve, including Canada (PIPEDA and Quebec’s Law 25), the United States (including the California Consumer Privacy Act as amended), the United Kingdom (UK GDPR and the Data Protection Act 2018), Australia (the Privacy Act 1988 and the Australian Privacy Principles), and New Zealand (the Privacy Act 2020).

This policy covers everyone who uses the Platform: customers who book grooming appointments, and the owners and staff of grooming salons that subscribe to FURRR.

2. Our two roles: your salon and us

FURRR is software that grooming salons use to run their business. That gives us two distinct roles, and your rights work slightly differently under each:

• Your salon is responsible for its customer records. When you book with a salon, your booking details, pet profiles, appointment history, and grooming notes belong to that salon’s relationship with you. The salon decides what is collected and why; we process those records on the salon’s behalf, under its instructions (in legal terms, the salon is the “controller” or “business” and we are its “processor” or “service provider”).
• We are responsible for the Platform itself. For your sign-in account, platform security, fraud prevention, our records of how the Platform is used, and our billing relationship with salons, FURRR decides what is collected and why, and we are the controller.

If you ask us to correct or delete records that a salon holds about you, we may fulfil the request together with the salon or refer it to the salon, and we will tell you when we do. We never leave a request without a path forward.

3. Information we collect

Account and sign-in information

• Your name, email address, and mobile phone number.
• If you set a password: a one-way cryptographic hash of it. We never store your password itself, and no one at FURRR can read it.
• If you sign in with Google or Microsoft: your name, your email address, whether the provider has verified that address, and the provider’s account identifier. We do not receive your Google or Microsoft password, contacts, files, or calendar.
• If you sign in by text message: the short verification codes we send, which are stored only in hashed form and expire within minutes.

Booking and pet information

• Appointments you book, the services chosen, and your appointment history.
• Pet profiles: your pet’s name, breed, size, coat, and any grooming, behaviour, health, or vaccination notes you or your salon add so the groom can be done safely.
• Photos of your pet taken as part of the grooming service (see section 14).

Payment information

• Payments are processed by Stripe. Your full card number goes to Stripe, not to us; we receive and keep only what we need to run the service — such as the card brand, its last four digits, and payment status.

Technical and security information

• IP address, browser and device type, and the pages of the Platform you use.
• Security records: sign-in attempts and failures, verification-code requests, rate-limit and lockout events, and an audit trail of administrative access.

Communications

• Messages the Platform sends you (text and email) and their delivery status.
• Messages you send us, for example support requests.

4. How we use information, and our legal bases

We use personal information to:

• Provide the service — create your account, take and manage bookings, maintain pet profiles and grooming records, process payments, and send the messages the service depends on (legal basis: performing our contract with you or with your salon).
• Keep the Platform safe — verify sign-ins, detect and block fraud and abuse (including SMS-verification fraud), rate-limit suspicious activity, screen new passwords against known data breaches, and keep audit records (legal basis: our legitimate interest in securing the service, and in some cases legal obligation).
• Support you — answer questions and investigate problems. Where support requires a member of our team to view an account, that access is logged and auditable (legal basis: contract and legitimate interest).
• Improve the Platform — understand usage through our own records so we can fix and improve the product. We do not use third-party analytics services to do this (legal basis: legitimate interest).
• Meet legal obligations — including tax, accounting, and responding to lawful requests (legal basis: legal obligation).

Where a use requires your consent under applicable law — for example, any future marketing messages — we will ask for it separately, and you will be able to withdraw it at any time.

5. Text messages and email

The Platform sends service messages: sign-in verification codes, booking confirmations and changes, appointment reminders, and security notices (for example, when your password changes). These are part of providing the service you or your salon asked for; they are not marketing. Message and data rates from your mobile carrier may apply to texts.

We do not send marketing texts or marketing email unless you have separately agreed to receive them, and any such message will include a way to opt out. Opting out of marketing never stops security messages or messages about appointments you have booked.

6. Who we share information with

Your salon. The salon you book with sees your bookings, contact details, pet profiles, grooming records, and payments to it — that is the service working as intended.

Service providers that run the Platform for us. Each processes personal information only to provide its service to us, under contract:

• DigitalOcean — cloud hosting for the Platform and its databases, and storage for pet photos.
• Stripe — payment processing. Card details are collected and held by Stripe under its own safeguards.
• Postmark (ActiveCampaign) — delivery of the Platform’s email.
• Telnyx — delivery of the Platform’s text messages.
• Google and Microsoft — only if you choose to sign in with them, to perform that sign-in.
• Anthropic — used to resolve unrecognised dog-breed names into our breed reference. Only breed text is sent; no names, contact details, or account information.
• Have I Been Pwned — when a password is set, we check it against known data breaches by sending only the first five characters of a one-way fingerprint of it. Your password — and even its full fingerprint — never leaves the Platform.

Other disclosures. We may disclose information to professional advisers under confidentiality; to authorities where the law requires it; to protect the rights, safety, or property of FURRR, our users, or others; or as part of a merger, financing, or sale of our business, in which case this policy will continue to apply to the transferred information until it is replaced with notice to you.

7. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioural advertising (as those terms are defined in the California Consumer Privacy Act). We have not done so in the preceding 12 months.
• We do not run advertising trackers, advertising cookies, or third-party analytics on the Platform.
• We do not put tracking pixels in our email.
• We do not use your information, or your pet’s, to train advertising or profiling systems.

8. Where information is stored and international transfers

The Platform is hosted with DigitalOcean, and our service providers listed above operate in the United States and other countries. This means your information may be stored and processed outside the country where you live, including outside Canada, the UK, the EEA, Australia, and New Zealand, in countries whose privacy laws differ from your own.

Where the law of your country requires safeguards for such transfers, we rely on our providers’ data processing agreements, which incorporate recognised transfer mechanisms (such as the standard contractual clauses approved for the UK and EEA) and equivalent contractual commitments. You can contact us for more information about these safeguards.

9. How we protect information

Security controls we actually run, not aspirations:

• All traffic to and from the Platform is encrypted in transit (TLS).
• Passwords are stored only as one-way hashes using argon2id, a modern memory-hard algorithm designed to resist large-scale cracking.
• Each salon’s records are isolated from every other salon’s at the database layer, enforced by the database itself rather than only by application code.
• Sign-in is protected by rate limiting, automatic temporary lockout after repeated failures, and defences against SMS-verification fraud.
• New passwords are screened against known data breaches (see section 6) and weak choices are refused.
• Administrative access by our team is restricted, logged, and auditable, including any support access to an account.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that the law requires us to report, we will notify the affected people, salons, and regulators as required, without undue delay.

10. How long we keep information

We keep personal information while your account is active or while the salon relationship it belongs to continues, and afterwards only as long as needed for the purposes described in this policy — including meeting legal, tax, and accounting obligations, resolving disputes, and maintaining security records. Short-lived data is genuinely short-lived: sign-in verification codes expire within minutes, and expired records of that kind are purged rather than archived. Backup copies roll off on our backup schedule. When information is no longer needed, we delete it or irreversibly de-identify it.

11. Your rights

Wherever you live, you can ask us to access the personal information we hold about you, to correct it, to delete it, or to receive a portable copy of information you provided. You may also object to or ask us to restrict certain processing, and withdraw consent where processing is based on consent. We will never discriminate against you for exercising a privacy right.

To exercise any right, contact privacy@furrr.tech. We may need to verify your identity first. We respond within the time required by the law that applies to you, and if we refuse a request we will say why and tell you how to challenge the refusal. Where the records are held for a salon as controller, we will coordinate with, or refer you to, that salon (see section 2). If you are an authorised agent making a request for someone else under a law that permits it, we may ask for proof of your authority.

Region-specific notes

• Canada. We comply with PIPEDA and, in Quebec, Law 25. Our privacy officer — the person in charge of the protection of personal information — can be reached at privacy@furrr.tech. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
• United States. Residents of California and other states with comprehensive privacy laws have the rights described above, including the right to know the categories of information collected (section 3), the purposes (section 4), and the categories of recipients (section 6). We do not sell or share personal information (section 7), so there is nothing to opt out of; we also do not use or disclose sensitive personal information for purposes that require a right to limit.
• United Kingdom. We rely on the legal bases set out in section 4 under the UK GDPR. You may lodge a complaint with the Information Commissioner’s Office (ico.org.uk), though we would welcome the chance to address your concern first.
• Australia. We handle personal information in accordance with the Australian Privacy Principles. Section 8 describes the countries where information may be held. If you are unsatisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).
• New Zealand. We handle personal information in accordance with the Privacy Act 2020, including its information privacy principles. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).

12. Children

The Platform is for adults. You must be at least 18 (or the age of majority where you live) to hold an account. We do not knowingly collect personal information from children under 13, and if we learn that we have, we will delete it. A parent or guardian who believes a child has provided us information can contact privacy@furrr.tech.

13. Cookies and similar technologies

We use only strictly necessary cookies and browser storage: a session cookie that keeps you signed in, and security and preference values the Platform needs to work. We set no advertising cookies and no third-party analytics cookies, which is why the Platform does not show you a cookie-consent banner — there is nothing optional to consent to. You can clear or block cookies in your browser, but blocking the session cookie will prevent signing in.

14. Photos of your pet

Salon staff may photograph your pet before and after grooming as part of the service record — for example, to document coat condition and the completed groom. These photos are attached to the appointment, visible to you and to your salon, and stored with our hosting provider. They are not used for advertising by FURRR. If you would like a photo removed, ask your salon or contact us.

15. Automated fraud protection

To keep sign-in safe, the Platform automatically limits and can temporarily block activity that looks like fraud or abuse — for example, rapid repeated verification-code requests or patterns associated with SMS-verification fraud. These automated decisions protect the service and other users; they do not produce legal effects and are temporary by design. If you believe you were blocked in error, contact support@furrr.tech and a person will review it.

16. Changes to this policy

When we change this policy, we will update the effective date above; for material changes we will give reasonable advance notice on the Platform or by email. Each change takes effect on the date stated, and the current version always lives at this address.

17. How to contact us

Privacy questions, requests, and complaints: privacy@furrr.tech. General support: support@furrr.tech. FURRR is operated from Toronto, Ontario, Canada. We take every privacy concern seriously and will respond to complaints promptly; the region-specific notes in section 11 list the regulator you may also contact where you live.