Privacy policy

1. Who is responsible

The controller for your data on senicure.com, in the Senicure web app and in the mobile app is:

Shruti Shah
994 Claridad Loop, Milpitas, CA 95035, USA
Germany
Privacy email: privacy@senicure.com

More details are in our legal notice.

2. The short version

• We only process what we need to run Senicure for you and your pet. We don’t sell data and we don’t show ads.
• Some of our service providers are in the US (list below). We don’t claim that all data stays in the EU.
• AI features are processed by OpenAI, with Anthropic as a fallback. Under their API terms, this data is not used to train their models by default.
• Analytics (PostHog) only run if you agree in the cookie banner.
• You can export your data and delete your account anytime.

3. Visiting the website

Server logs

When you open a page, our hosting provider processes technically necessary data: IP address, date and time, page requested, referrer, browser and operating system. This is needed to deliver the page and protect it against abuse (Art. 6(1)(f) GDPR). Logs are kept only as long as needed for that.

Cookies and similar storage

Strictly necessary storage (language, your cookie choice) is based on § 25(2) no. 2 TDDDG. Anything optional runs only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). The full list is in our cookie policy. You can change your choice anytime via “Cookie settings” in the footer.

Analytics with PostHog (consent only)

If you agree, we record page views and device information with a pseudonymous identifier to understand which pages help. Session recording is off. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw anytime for the future.

Error monitoring

So we can find and fix bugs, the website and apps send technical error data to Sentry when something crashes (Art. 6(1)(f) GDPR). Sentry doesn’t set cookies for this. In the web app, session replay is only switched on with your consent.

4. Launch updates and our earlier survey

Until October 2026 a founding page let you vote on features, tell us about your pet (species, age band, conditions) and answer a pricing survey. That page no longer exists. Answers already given are stored with a random identifier, your language, the referrer and campaign parameters (utm_*) to understand what matters to owners (Art. 6(1)(f) GDPR), and deleted once no longer needed for product planning, at the latest after 24 months.

We only store your email for launch updates with your explicit consent (Art. 6(1)(a) GDPR). You can unsubscribe anytime.

5. Your account and your pet’s data

When you create an account, we process the following to perform our contract with you (Art. 6(1)(b) GDPR):

• Account data: name, email, password (stored only as a hash), language, plan.
• Pet profiles: name, species, breed, age, weight, known conditions, photo.
• What you enter: daily check-ins, medications and doses, journal entries, photos, voice notes, glucose readings and insulin doses, vet contacts.
• Shared care: if you invite family or a sitter, they can see and edit the shared pet’s data.
• Reports and share links: if you share a report by link, anyone with the link can open it until you revoke it.

Pet health data isn’t a “special category” under Art. 9 GDPR. We still handle it with the same care, because it can say a lot about your daily life.

6. AI features

For symptom guidance, photo checks, voice transcription and summaries, we send the content you submit plus relevant details about your pet to OpenAI. If OpenAI is unavailable, we use Anthropic as a fallback. The legal basis is performance of our contract (Art. 6(1)(b) GDPR). Under both providers’ API terms, this data is not used to train their models by default; it may be retained for a limited time for abuse monitoring.

Please don’t put unnecessary personal details about yourself or other people into free-text fields. AI results are guidance, not a diagnosis, and there is no automated decision with legal effect within the meaning of Art. 22 GDPR.

7. Payments and emails

Stripe processes payments. Only Stripe sees your card details, not us. We receive your name, email, plan, payment status and invoices (Art. 6(1)(b) and (c) GDPR). Invoices are kept for 10 years as required by tax law.

We send service emails (e.g. sign-up, password, reminders) via Resend. Mobile push notifications go through Expo and Apple or Google, if you allow them.

8. Contact and clinic enquiries

If you write to us or use the clinic contact form, we process your details to answer (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is closed and no retention duty applies.

9. Recipients and processors

We use carefully selected service providers who process data only on our instructions (Art. 28 GDPR). Some are based in, or process data in, the US:

• Vercel Inc.

  Hosting of the website and web app, content delivery (CDN)

  Data: Server logs (IP address, time, page requested, browser)

  Location: USA / global edge network

• Senicure (eigener Server / own server)

  Running the server application (API) and database on a server we operate ourselves

  Data: All account data and your pets’ health data, server logs

  Location: Operator’s location

  Not a processor. Server location to be confirmed by the operator.

• Cloudflare, Inc. (Tunnel)

  Secure connection between the internet and our API server, attack protection

  Data: Connection data (IP address, time), encrypted requests to the API

  Location: USA / global edge network

• OpenAI, L.L.C. / OpenAI Ireland Ltd.

  AI features: symptom guidance, photo checks, voice transcription, summaries

  Data: The content you submit to an AI feature (text, photos, voice recordings) plus relevant details about your pet

  Location: USA

• Anthropic, PBC

  Fallback AI provider when OpenAI is unavailable

  Data: As for OpenAI, only when falling back

  Location: USA

• Cloudflare, Inc. (R2)

  Storage of photos and files you upload

  Data: Photos, documents, exports

  Location: USA / region as configured

• Stripe Payments Europe, Ltd.

  Payment processing and invoices

  Data: Name, email, payment details (only Stripe sees card data), billing address

  Location: Ireland / USA

• Resend, Inc.

  Sending emails (sign-up, password, reminders, launch updates with consent)

  Data: Email address, name, email content

  Location: USA

• Functional Software, Inc. (Sentry)

  Error monitoring so we can find and fix crashes

  Data: Technical error data, IP address, browser/device

  Location: USA

• PostHog, Inc.

  Website usage statistics

  Data: Page views, device information, pseudonymous identifier

  Location: Per project region (EU or USA)

  Only after your consent in the cookie banner.

• Google Ireland Ltd. (Places API)

  Finding vets near you in the app

  Data: Search term and the approximate location you provide

  Location: EU / USA

  Only when you use vet search.

• Expo (650 Industries, Inc.), Apple, Google

  Push notifications in the mobile app (e.g. medication reminders)

  Data: Device token, notification text

  Location: USA

  Only if you allow notifications.

Transfers to the US rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards.

10. How long we keep data

• Account and pet data: as long as your account exists. After a deletion request there’s a 30-day grace period, then the data is permanently deleted.
• Invoices and accounting records: 10 years (legal requirement).
• Answers from our earlier survey: at the latest after 24 months.
• Email for launch updates: until you unsubscribe.
• Analytics: until you withdraw consent, otherwise per the project’s settings.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time.

Start an export or deletion right in the web app under “Account”; more under Your data rights. Or email privacy@senicure.com.

You can also lodge a complaint with a data protection supervisory authority, in particular where you live or where the controller is based. If you live in the US, see section 12 for your state privacy rights.

12. US privacy rights (California and other states)

If you live in the United States, state privacy laws such as the California Consumer Privacy Act (as amended by the CPRA) and similar laws in other states may give you additional rights. This section is our notice at collection for those laws.

What we collect and why

• Identifiers and account data (name, email, IP address): to run your account and keep it secure.
• Pet health information you enter (check-ins, medications, notes, photos, voice recordings): to provide the features you use, including AI features described above.
• Commercial information (your plan and payments, processed by Stripe): to bill you.
• Internet activity (page views): only if you opt in to analytics in the cookie banner.
• Approximate location: only the location you type in when you use vet search.

How long we keep each category is described in section 10; who receives it is listed in section 9.

No sale, no sharing for advertising

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We don’t use sensitive personal information to infer characteristics about you. Because optional analytics only run after you opt in, we also treat a Global Privacy Control signal as a “no”.

Your rights

• Know and access the personal information we hold about you, and get a portable copy.
• Correct inaccurate information.
• Delete your personal information.
• Not be treated differently for using any of these rights.
• Appeal our decision on your request, where your state provides that right — just reply to our answer.

Export and delete directly in the web app under “Account”, or email privacy@senicure.com. We verify requests through your account email, answer within 45 days, and accept requests from an authorized agent with your signed permission.

13. Security

Connections are encrypted with TLS, passwords are stored only as hashes, and you can turn on two-factor sign-in. Access to data is limited to what’s needed. More on our security page.

14. Children

Senicure is meant for adults. You need to be at least 16 to create an account.

15. Changes

When providers or purposes change, we update this page and tell you in advance about material changes.