Privacy Policy

Effective date: May 28, 2026

This Privacy Policy explains in detail how PetBeats collects, receives, stores, organizes, uses, shares, secures, retains, and otherwise processes personal data in connection with account onboarding, service discovery, bookings, pet-care coordination, platform trust operations, grievance handling, and legal compliance. It applies to pet parents, care partners, veterinary partners, support contacts, website visitors, and other individuals interacting with PetBeats systems in India and, where relevant, from other locations. This Policy is intended to provide layered transparency, operational clarity, and rights information so that users can make informed choices and understand how personal data flows through the platform lifecycle.

1. Scope, Applicability, and Relationship with Terms

This Policy applies to all personal data processed by PetBeats through digital interfaces, support channels, and connected service operations. It should be read with the Terms of use and any feature-specific notices shown at the point of collection. Where feature notices provide additional detail, those notices supplement this Policy. If any part of this Policy conflicts with non-waivable legal rights, mandatory law prevails to that extent. This Policy does not govern processing by independent third parties acting as separate data fiduciaries/controllers outside PetBeats' instructions, though PetBeats seeks to partner with responsible service providers. Users are encouraged to review third-party privacy disclosures where external systems are used. PetBeats may provide translated summaries for convenience; however, the English version is used for legal interpretation, subject to mandatory legal standards.

2. Legal Basis and Indian Law Context

PetBeats privacy practices are designed with reference to applicable Indian legal frameworks, including the Digital Personal Data Protection Act, 2023 (as brought into effect), relevant provisions of the Information Technology Act, 2000 and associated rules, consumer and e-commerce obligations, lawful interception and disclosure requirements, and statutory record-keeping duties where relevant. Depending on context, processing may be based on user consent, performance of contract, compliance with legal obligations, protection against fraud and abuse, safety interests, and legitimate service administration needs recognized by law. Where consent is required, PetBeats seeks consent through clear notice and interface controls. Withdrawal rights are respected subject to lawful limitations such as unresolved disputes, anti-fraud retention, or mandatory legal preservation duties. Users may contact support for clarification regarding legal basis in specific scenarios.

3. Categories of Data Collected

PetBeats may collect identity data (name, phone, email, addresses, display identifiers), account credentials and authentication metadata, device/network indicators (IP approximations, browser attributes, app version data), transactional data (booking details, payment references, schedule changes), support records (complaints, responses, escalation metadata), reputation data (ratings, reviews, moderation outcomes), and policy-compliance signals (risk indicators, anomaly flags, abuse reports). For care continuity, pet-related information may include species, age, behavioural profile, diet preferences, vaccination context, allergies, medical notes, and service history submitted by users or authorized providers. In some workflows, location hints may be collected to support service matching and logistics planning. PetBeats seeks data minimization by limiting collection to what is relevant for specified purposes and by avoiding unnecessary sensitive data requests unless operationally justified and lawfully supported.

4. Data Sources and Collection Pathways

Data may be collected directly from users during registration, profile creation, booking requests, support interactions, and content submissions; indirectly from authorized counterparties involved in service delivery; automatically from devices and technical logs during platform use; and from trusted service partners such as payment providers, communication gateways, and fraud-prevention tools where lawfully permitted. Users are responsible for ensuring they have authority to share third-party information, including emergency contacts or shared household details. Where data about one user is submitted by another, PetBeats may rely on representational assurances but may request additional validation where risk signals appear. Collection interfaces may include web forms, app modules, chat workflows, tele-support notes, and system-generated event logs. PetBeats may correlate multi-source records to maintain consistency, prevent abuse, and improve service reliability.

5. Purposes of Processing

PetBeats processes data to create and manage user accounts, enable service discovery, facilitate booking workflows, route communications, support payment and settlement mechanics, preserve care continuity records, investigate incidents, moderate community behaviour, enforce terms, prevent fraud, improve quality, and meet legal obligations. Data also supports analytics for capacity planning, feature reliability, performance measurement, and safety tuning. Processing for product improvement uses aggregated or de-identified patterns where feasible. PetBeats may use contact data to communicate policy changes, service notices, and security alerts. Marketing communications, where offered, are managed with preference controls and lawful notice practices. PetBeats does not sell personal data for unrelated third-party advertising. Processing is bounded by purpose limitation principles and internal access controls designed to reduce misuse risk.

6. Consent Management and Withdrawal

Where consent is required, PetBeats presents clear prompts and records user action linked to relevant context. Users may withdraw consent through account settings or support channels, subject to technical feasibility and legal constraints. Withdrawal does not invalidate prior lawful processing conducted before withdrawal and may limit continued access to features that depend on the withdrawn data. In high-risk workflows, PetBeats may seek renewed or granular confirmations to avoid ambiguity. If users request withdrawal for data essential to ongoing contractual performance, PetBeats may close or restrict associated services after informing the user of implications. Consent records may be retained for audit and legal defense purposes. Users should provide updated contact details to ensure receipt of material consent and policy communications.

7. Sharing with Care Partners and Operational Vendors

PetBeats shares only minimum necessary data with selected care partners to enable safe and functional service delivery, such as contact coordination details, pet profile essentials, schedule context, and relevant instructions. Data may also be shared with vetted operational vendors acting under contractual controls, including cloud infrastructure providers, payment processors, messaging gateways, analytics vendors, and security tooling partners. These vendors are expected to process data only under documented instructions, security obligations, and lawful restrictions. PetBeats may disclose data to competent authorities where required by valid legal process, emergency safety concerns, or statutory reporting duties. When practical, PetBeats evaluates proportionality before disclosure and may challenge overbroad requests where legally permissible. Data sharing is logged and governed through internal controls to support accountability.

8. Payments and Financial Metadata

Payment transactions may involve third-party payment gateways or banking partners that independently process payment instrument data under their own regulated obligations. PetBeats generally receives limited financial metadata necessary for transaction status, reconciliation, fraud monitoring, refunds, and dispute response. PetBeats does not intentionally store full card credentials unless handled through compliant tokenized mechanisms provided by authorized processors. Users should review payment partner terms where relevant. Chargeback events, failed payments, and suspicious transaction patterns may trigger risk review and temporary account safeguards. Financial records may be preserved for accounting, tax, anti-fraud, and legal defense requirements for prescribed durations.

9. Cookies, SDKs, and Similar Technologies

PetBeats may use cookies, local storage, session tokens, SDK event logs, and similar technologies to maintain login continuity, secure sessions, remember preferences, analyze performance, detect abuse, and support feature diagnostics. Some controls are strictly necessary for service operation; others may be optional depending on implementation and legal context. Browser and device settings may allow users to limit certain tracking functions, though disabling technical controls can affect usability or security. PetBeats strives to classify and document tracking usage and may update disclosures as tooling evolves. Anti-abuse and security logs may continue even when optional analytics controls are restricted, where justified for lawful platform protection.

10. User Content, Reviews, and Public Visibility

Information voluntarily posted in public or semi-public areas, such as reviews, profile bios, and marketplace-facing descriptions, may be visible to other users and may be indexed by internal search features. Users should avoid posting unnecessary sensitive data in public fields. PetBeats may moderate content for policy compliance, abuse prevention, and legal risk management. Content moderation decisions may involve human review, automated flagging, or hybrid workflows and may generate enforcement metadata. Even if content is edited or removed later, historical versions may persist in backups, logs, moderation archives, or legal records for limited periods. Users remain responsible for legality and accuracy of submitted content.

11. Security Architecture and Safeguards

PetBeats maintains technical and organizational controls designed to protect confidentiality, integrity, and availability of personal data. Controls may include role-based access restrictions, credential hardening, encrypted transport, audit logging, anomaly monitoring, backup routines, incident response playbooks, and periodic security review. No internet-connected system can guarantee absolute security; therefore, residual risk remains despite safeguards. Users contribute to shared security by protecting account credentials, using secure networks, and reporting suspicious activity promptly. PetBeats may temporarily suspend access or require additional verification during security investigations. Security incidents are managed through triage, containment, impact assessment, remediation, and legal notification pathways as required by applicable law.

12. Data Retention and Record Lifecycle

PetBeats retains personal data only for durations necessary to fulfill stated purposes and legal obligations, including service delivery, financial reconciliation, tax and accounting compliance, grievance handling, dispute defense, fraud investigation, and regulatory requests. Retention periods vary by data category and context. At end of retention need, data may be deleted, anonymized, aggregated, or securely archived where lawful and proportionate. Backup systems may retain residual copies for limited periods as part of operational resilience. Where users request deletion, PetBeats evaluates legal exceptions and technical feasibility and communicates outcomes through support channels. Retention policies are periodically reviewed to align with evolving legal and operational requirements.

13. Cross-Border Processing and Transfers

Some technical processing may involve infrastructure, subprocessors, or support workflows located outside India, depending on architecture and vendor footprint. Where cross-border processing occurs, PetBeats seeks appropriate safeguards such as contractual commitments, access controls, minimization techniques, and security standards proportionate to risk and legal requirements. Transfers are assessed with attention to legal permissibility, purpose necessity, and governance controls. Users acknowledge that global cloud and communication infrastructure can involve distributed processing pathways. PetBeats attempts to maintain transparency about material transfer practices through policy updates and vendor governance processes.

14. Rights of Data Principals/Users

Subject to applicable law and lawful limitations, users may request access to personal data summaries, correction of inaccurate information, completion of incomplete records, update of outdated fields, erasure where permissible, restriction in defined contexts, grievance redressal, and consent withdrawal. PetBeats may verify requester identity before acting on rights requests to prevent unauthorized disclosure. Requests may be denied or partially fulfilled where legal obligations, fraud-prevention needs, unresolved disputes, security considerations, or evidentiary preservation duties require continued retention or limited processing. PetBeats aims to respond within reasonable timelines and may provide staged responses for complex requests. Users can submit rights requests via support@petbeats.in.

15. Automated Decision Support and Risk Signals

PetBeats may use rule-based or automated signal systems to detect suspicious behavior, policy abuse, spam patterns, or transactional anomalies. These systems support trust and safety but may not be determinative in every case. Significant adverse actions may involve human review, contextual analysis, and evidence assessment. Users may contact support to seek explanation or challenge actions where appropriate. Automated tools are periodically calibrated to reduce false positives and adapt to evolving misuse patterns. PetBeats does not guarantee error-free automation and continues to invest in proportional review mechanisms.

16. Children and Guardian Considerations

PetBeats services are intended primarily for adults with legal capacity. The platform does not knowingly solicit independent accounts from children below lawful age thresholds. Where child-related personal data is incidentally involved (for example household contact context), processing is handled with additional caution and legal sensitivity. If PetBeats becomes aware of unauthorized child data submission in violation of policy, it may take corrective action, including deletion where appropriate and restriction of the relevant account. Guardians may contact support for child-data concerns and review requests in accordance with legal requirements.

17. Grievance Redressal and Escalation

For privacy questions, data rights requests, or grievance submissions, users may contact support@petbeats.in. If unresolved, users may escalate to pankaj@petbeats.in. PetBeats aims to acknowledge submissions within reasonable operational timelines and to provide structured responses with status visibility where feasible. Complex or legally sensitive matters may require additional verification, document review, or consultation before closure. PetBeats maintains complaint logs to track handling quality, compliance consistency, and systemic improvements.

18. Incident Reporting and Breach Response

In the event of a confirmed data security incident, PetBeats follows incident response protocols including containment, impact scoping, forensic analysis, mitigation, and corrective action. Where required by applicable law, PetBeats may notify affected users and competent authorities within prescribed timelines and provide guidance on protective steps. Not all security events constitute reportable personal data breaches; classification depends on legal criteria and risk assessment. Users are encouraged to report suspected compromise immediately to speed containment efforts. Incident learnings may inform policy, architecture, and training improvements.

19. Policy Updates and Change Management

PetBeats may revise this Privacy Policy to reflect legal changes, regulatory guidance, architecture updates, product enhancements, or operational learnings. Material updates are published with revised effective date and may be communicated through website notices, app alerts, or email depending on significance. Continued use after effective date indicates acceptance of updated policy where legally permissible. If users disagree with revisions, they may discontinue use and request account closure subject to retention obligations. Historical versions may be retained for transparency and audit integrity.

20. Contact and Interpretive Notes

Questions regarding this Policy, data processing practices, or rights pathways can be directed to support@petbeats.in, with escalation available at pankaj@petbeats.in. This Policy is intended to promote clarity, accountability, and trust. It does not constitute legal advice to users regarding their independent obligations, and users should consult qualified professionals for legal, tax, or compliance guidance specific to their circumstances.

21. Data Quality, Accuracy Duties, and Correction Framework

PetBeats relies on users and authorized partners to provide accurate data for safe operations. Inaccurate records may impact care decisions, support outcomes, and fraud checks. Users should promptly correct outdated contact details, pet-health notes, and booking context. PetBeats may implement periodic prompts and validation checks to improve data quality. Where conflicting records are detected, PetBeats may request clarification and temporarily restrict dependent workflows until inconsistencies are resolved. Correction requests are handled through support channels with identity verification safeguards. In some cases, historical records are retained with correction annotations rather than deletion to maintain evidentiary integrity and audit traceability.

22. Internal Access Governance and Least-Privilege Controls

PetBeats applies role-based access controls and least-privilege principles so that personnel and processors access only data required for legitimate duties. Access pathways may be logged and reviewed to detect anomalies and enforce accountability. Sensitive operations may require elevated approvals, contextual justifications, or dual-control patterns depending on risk category. Staff and contractor access may be adjusted upon role changes, suspension events, or separation from service. PetBeats may provide periodic privacy and security training to relevant teams and update controls in response to incident learnings, audits, or regulatory developments.

23. De-Identification, Aggregation, and Product Analytics Governance

To improve service quality and capacity planning, PetBeats may transform personal data into de-identified or aggregated formats where individual identities are not reasonably attributable in ordinary use. Such datasets may inform trends, feature refinement, fraud model tuning, operational forecasting, and service reliability analysis. PetBeats applies safeguards intended to reduce re-identification risk and limits access to teams with legitimate analytical purposes. De-identified outputs are not used to target unrelated third-party advertising sales. Where legal obligations require additional controls for anonymization standards, PetBeats aims to align processing accordingly.

24. Vendor Due Diligence and Contractual Safeguards

Before engaging critical data processors, PetBeats may evaluate security posture, compliance maturity, incident response practices, and operational reliability. Processor agreements may include confidentiality commitments, security controls, subprocessing constraints, breach notification obligations, and deletion/return commitments at end of engagement. PetBeats may reassess vendors periodically, especially after material incidents, architectural changes, or legal developments. Use of vendors does not eliminate PetBeats accountability for governance of instructed processing within applicable legal frameworks.

25. Fraud Prevention, Abuse Detection, and Safety Intelligence

PetBeats may analyze behavioural patterns, device relationships, transaction anomalies, content signals, and account linkages to identify abuse vectors such as impersonation, payment fraud, review manipulation, and coordinated harassment. Safety intelligence workflows aim to protect genuine users and maintain marketplace trust. Risk controls may include additional verification requests, temporary holds, reduced feature access, or escalation to human review. Legitimate users may occasionally experience cautionary friction; PetBeats seeks proportional balancing between convenience and protection. Data used in anti-fraud contexts may be retained longer where legal or security needs justify preservation.

26. Rights Request Handling Timelines and Escalation Mechanics

PetBeats aims to acknowledge rights requests within reasonable timelines and to provide outcome communication with clear reasoning where action is limited or denied. Complex requests involving multiple systems, legal reviews, or third-party dependencies may require extended handling periods. Users may escalate unresolved concerns through grievance contacts. PetBeats may request additional information to verify identity or clarify scope before processing requests. Repetitive, abusive, or manifestly unfounded requests may be declined to the extent permitted by law while still preserving basic grievance pathways.

27. Record Localization Considerations and Jurisdictional Requests

Where law, regulation, or policy direction introduces localization, retention, or reporting requirements, PetBeats may adapt data architecture and operational procedures to maintain compliance. Transitional implementation may involve phased controls, regional routing updates, and revised processor configurations. Users acknowledge that evolving legal frameworks can change how data is stored, mirrored, or accessed across regions. PetBeats will update disclosures as materially required.

28. Privacy by Design and Default Operational Principles

PetBeats seeks to embed privacy considerations into product design, workflow engineering, and operational governance. This includes minimizing unnecessary collection, constraining default visibility, implementing security-first architecture patterns, and reviewing feature impact before broad rollout. Privacy-by-design is an ongoing process rather than a one-time certification, and controls may evolve with technology and legal expectations. Users can support these principles by sharing only necessary information and using platform tools responsibly.

29. Research, Testing, and Controlled Environments

PetBeats may conduct controlled testing, debugging, and quality assurance activities to improve reliability and safety. Where feasible, testing environments use masked, synthetic, or minimized datasets. Access to production-like data in troubleshooting contexts is restricted and monitored. Temporary copies created during diagnostics are managed under retention and deletion controls. Research and testing functions are designed to improve user safety and service quality without undermining privacy commitments.

30. Final Interpretive Provision

This Privacy Policy is intended to communicate meaningful transparency and enforceable accountability across the PetBeats ecosystem. It should be interpreted in a manner that preserves lawful rights of users, supports legitimate safety and anti-fraud objectives, and enables practical service operations. If any provision is held unenforceable, remaining provisions continue in force to the extent permitted by law.

31. Detailed Log Management and Audit Trail Governance

PetBeats maintains operational logs for security, reliability, troubleshooting, accountability, and legal compliance purposes. Logs may include access events, authentication outcomes, API interactions, configuration changes, moderation actions, support workflow transitions, and system alerts. Logging is designed to support traceability without unnecessary exposure of content beyond legitimate needs. Retention duration for logs varies by risk and compliance category. High-value security logs may be retained longer than routine diagnostics where fraud detection, incident forensics, or legal defense necessitates extended availability. Access to log repositories is restricted, monitored, and subject to role-based review protocols. When logs contain personal data, PetBeats applies minimization and masking measures where practical. In response to rights requests, PetBeats may provide summaries where feasible while protecting system security and third-party confidentiality. Audit governance is periodically reviewed to align with evolving regulatory expectations and operational realities.

32. Advanced Transparency Commitment and Accountability Reporting

PetBeats is committed to improving privacy transparency over time through policy refinement, structured grievance handling, internal accountability controls, and periodic process reviews. Where feasible, PetBeats may publish high-level transparency information on topics such as complaint categories, average response windows, policy updates, and security improvement priorities, while respecting confidentiality and legal limits. Accountability includes documenting decisions, preserving rationale for major enforcement actions affecting data processing, and maintaining escalation pathways for sensitive matters. PetBeats may integrate privacy checkpoints into product release governance so that new features are assessed for data minimization, access restrictions, and risk impact before launch. Users are encouraged to provide feedback on clarity gaps in policy communication. Continuous accountability is a process rather than a one-time declaration, and PetBeats intends to evolve governance practices in line with legal developments, user expectations, and operational learnings.

33. Extended Privacy Operations Annex

For sensitive cases involving legal hold, security incidents, coordinated abuse investigations, or formal rights disputes, PetBeats may execute enhanced privacy operations to ensure defensible handling of personal data. Enhanced operations may include restricted-access case rooms, elevated approval chains for data extraction, documented chain-of-custody practices, purpose-specific retention tagging, and controlled disclosure logs. Data access in such contexts is limited to authorized personnel with demonstrable need-to-know and subject to supervisory review. Where lawful requests require production of records, PetBeats seeks to disclose only what is necessary and proportionate while preserving confidentiality of unrelated users and protected security controls. Users may be informed of such processing where legally permissible and operationally appropriate.

During enhanced operations, certain deletion or modification requests may be paused if compliance, evidentiary, or safety requirements demand temporary preservation. Once constraints are resolved, pending requests are reassessed according to law and policy. PetBeats may maintain internal review notes documenting legal basis, scope, and duration of elevated controls to strengthen accountability. Post-incident, PetBeats may conduct retrospective reviews to identify process improvements, policy clarifications, and control hardening opportunities. This annex complements core policy provisions and reflects PetBeats' commitment to balancing rights protection, lawful compliance, and operational integrity in exceptional privacy-sensitive circumstances.

34. Long-Form User Privacy Acknowledgement

By accessing or using PetBeats, users acknowledge that personal data processing is necessary for core service delivery, trust and safety operations, legal compliance, and incident accountability in a multi-party marketplace. Users agree to provide accurate information, avoid unnecessary sensitive disclosures in public channels, and use grievance pathways responsibly for corrections or rights requests. Users understand that some data processing cannot be instantly halted where lawful obligations, security controls, fraud-defense needs, or evidentiary duties require temporary continuity. Users also acknowledge that privacy protection is strengthened when both platform and users follow disciplined practices, including secure credentials, verified communication channels, and prompt reporting of anomalies. PetBeats commits to continuous improvement of privacy governance, and users commit to responsible participation in that governance by engaging constructively, submitting truthful requests, and recognizing the practical constraints of distributed digital infrastructure. This acknowledgement supports informed consent, operational transparency, and shared accountability.

35. Supplemental Privacy Notice on Communication Metadata

To maintain service quality and safety, PetBeats may process limited communication metadata such as message timing, delivery status, response intervals, and channel integrity indicators. This metadata is used to troubleshoot failed communication, investigate abuse, support dispute chronology, and improve reliability. PetBeats does not process communication metadata for unrelated ad-sales purposes. Metadata retention follows proportionality principles and may be extended where legal hold or security investigation applies. Users acknowledge that communication reliability and auditability are essential in time-sensitive pet-care contexts, and therefore limited metadata processing is a necessary part of responsible platform operations.

36. Closing Clarification

PetBeats recognizes that privacy compliance is an ongoing discipline shaped by legal evolution, technical change, and user expectations. Accordingly, operational controls, verification methods, retention logic, and notice mechanisms may be refined over time to preserve lawful processing, reduce risk, and improve accountability. Users are encouraged to periodically review this Policy and to contact support for clarifications where needed.

37. Additional Notice

Users should promptly notify PetBeats if they believe account data is outdated, account access has been compromised, or profile visibility exposes unintended personal details. Early reporting helps reduce downstream risk and supports faster remediation.

End of Policy. Continued use after updates means acceptance where law permits.