Data Protection
Privacy Policy
Last updated: 2026-10-09 • Version 2.0 (UK • EU • US • BR Compliance)
At PetFoodFix, we take your personal privacy as seriously as your pet's nutritional wellbeing. This Privacy Policy outlines how PetFoodFix (“we”, “us”, or “our”) collects, uses, protects, and discloses personal data across our websites, label checking engines, reports, and digital services.
Our Core Privacy Principles
- ✓Data Minimization: We only collect information strictly required to evaluate pet food labels and deliver your nutritional report.
- ✓No Sale of Data: We never sell, rent, or trade personal data to third parties, data brokers, or advertising networks.
- ✓No AI Training: We never use your personal information, pet symptoms, or label uploads to train third-party generative AI models.
- ✓Full Multi-Jurisdiction Rights: We support your statutory rights under UK GDPR, EU GDPR, California CCPA/CPRA, and Brazilian LGPD.
1. Data Controller & Data Protection Officer (DPO)
The Data Controller responsible for your personal data is PetFoodFix / LookADev, a sole trader business operated by Lucas Martins, operating PetFoodFix in the United Kingdom and globally.
Privacy Officer & Encarregado de Proteção de Dados (DPO — UK/EU, and Brasil/LGPD): petfoodfix@lookadev.com
General support, order, refund and unsubscribe inquiries: petfoodfix@lookadev.com
2. Categories of Personal Data Collected
We collect and process the following categories of information:
- Pet Owner Contact Information: Name, email address, and communication history when you request a report, suggest a food, or contact customer support.
- Pet Profile & Dietary Information: Dog name, age, breed, body weight, Body Condition Score (BCS), neuter status, activity level, current food brand, dietary preferences, and answers to our non-clinical health questionnaire.
- Label Uploads: Photos or files of commercial pet food ingredient labels submitted for nutritional analysis.
- Technical & Log Data: Internet Protocol (IP) address, approximate geographic country (used exclusively for regional routing and language resolution), browser user agent, device operating system, and cookie consent timestamps.
- Payment Metadata: Transaction identifiers, payment timestamp, currency, and masked payment status. Note: All payment card details are processed directly by Dodo Payments, the Merchant of Record for every PetFoodFix order. We never store complete credit card numbers or security codes on our servers.
3. Purposes of Processing & Lawful Bases Matrix
Under European and UK data protection laws (GDPR Art. 6) and the Brazilian LGPD (Art. 7), every data processing activity must rest on an established lawful basis:
| Purpose of Processing | UK / EU GDPR Lawful Basis | Brazil LGPD Base Legal |
|---|---|---|
| Generating and delivering your customized dog food analysis report | Contractual Necessity (Art. 6(1)(b)) | Execução de Contrato (Art. 7º, V) |
| Health triage screening to identify clinical red flags and refer to vets | Contractual Necessity & Legitimate Interest (Safety) | Execução de Contrato e Legítimo Interesse (Art. 7º, V e IX) |
| Processing payments and issuing refunds | Contractual Necessity (Art. 6(1)(b)) | Execução de Contrato (Art. 7º, V) |
| Tax, accounting, and statutory regulatory compliance (HMRC / Receita Federal) | Legal Obligation (Art. 6(1)(c)) | Cumprimento de Obrigação Legal (Art. 7º, II) |
| Platform security, rate limiting, and fraud prevention | Legitimate Interests (Art. 6(1)(f)) | Legítimo Interesse (Art. 7º, IX) |
| Non-essential analytics and performance measurement | Consent (Art. 6(1)(a) / PECR) | Consentimento (Art. 7º, I) |
| Educational email newsletter or nutritional tips (optional) | Consent (Art. 6(1)(a)) | Consentimento (Art. 7º, I) |
4. Service Providers & Sub-Processors
We engage vetted third-party infrastructure providers to operate PetFoodFix. Each vendor is bound by strict Data Processing Agreements (DPAs) and confidentiality obligations:
- Google Cloud (Cloud Run): Application hosting for the website and APIs, in the
southamerica-east1(São Paulo) region. - Cloudflare, Inc. (USA): Edge proxy and CDN in front of the application; handles TLS termination and rate limiting.
- Neon Inc. (USA/EU): Managed serverless PostgreSQL database hosting with encryption at rest and role-based access controls.
- Dodo Payments Inc.: Merchant of Record and sole payment processor for all markets (cards in every market; Pix for orders billed in BRL).
- Resend Inc. (USA): Transactional email delivery service to securely send generated reports and order confirmations.
- Google Analytics (Google LLC, USA): Website analytics, loaded only after you consent to analytics cookies (see the Cookie Policy). Analytics and advertising signals stay denied until you opt in.
5. International Data Transfers
When personal data is transferred outside the United Kingdom, European Economic Area (EEA), or Brazil, we ensure an adequate level of data protection is maintained by utilizing:
- European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA).
- Adequacy decisions issued by the UK Information Commissioner's Office or European Commission.
- Applicable legal transfer mechanisms under Chapter V of the Brazilian LGPD.
6. Data Retention Periods
We do not keep personal data longer than necessary:
- Intake Submissions & Reports: Retained for 24 months to allow report regeneration, comparative re-evaluations, and customer support verification. After that period the submitted details, the generated report payload and the personal identifiers attached to them are redacted; the anonymised record (dates, statuses, amounts) stays for accounting.
- Financial & Transaction Records: Retained for 6 years in compliance with statutory UK and Brazilian tax, accounting, and anti-fraud regulations.
- Marketing Consent Records: Retained until you unsubscribe, plus 6 months on a suppression list to honor your opt-out.
These periods are applied by a retention sweep run periodically by our team over the customer database (scripts/retention-sweep.ts, dry-run by default). This is an operator-run sweep, not an automatic background job inside the site.
7. Your Legal Privacy Rights by Jurisdiction
7.1 United Kingdom & European Union (UK GDPR & EU GDPR)
Under GDPR, you have the following enforceable rights:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal records.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where no statutory retention basis applies.
- Right to Restrict or Object to Processing: Limit how we process your data or object to legitimate interest processing.
- Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format.
- Right to Withdraw Consent: Withdraw previously granted consent at any time without affecting prior lawful processing.
You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk, or with your national data protection authority in the EU.
7.2 United States Residents (CCPA / CPRA & State Privacy Laws)
If you are a resident of California or other US states with enacted privacy laws (Virginia, Colorado, Connecticut, Utah):
- Right to Know & Access: You may request the categories and specific pieces of personal information collected about you over the past 12 months.
- Right to Delete: You may request deletion of your personal information, subject to legal exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Notice of Non-Sale and Non-Sharing: WE DO NOT SELL YOUR PERSONAL INFORMATION, AND WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING.
- Global Privacy Control (GPC): Our website automatically honors the browser-based GPC opt-out signal.
- Non-Discrimination: We will never discriminate against you (e.g., deny services or charge different prices) for exercising your privacy rights.
7.3 Titulares de Dados no Brasil (LGPD - Lei nº 13.709/2018)
Em conformidade com o Artigo 18 da Lei Geral de Proteção de Dados (LGPD), você pode exercer perante o PetFoodFix:
- Confirmação da existência de tratamento e acesso aos dados.
- Correção de dados incompletos, inexatos ou desatualizados.
- Anonimização, bloqueio ou eliminação de dados desnecessários ou excessivos.
- Portabilidade dos dados a outro fornecedor de serviço, mediante requisição expressa.
- Eliminação dos dados tratados com consentimento do titular, ressalvadas as hipóteses de guarda legal.
- Informação sobre as entidades públicas e privadas com as quais realizamos uso compartilhado de dados.
- Revogação do consentimento a qualquer momento.
Para exercer seus direitos de titular da LGPD, entre em contato diretamente com o nosso Encarregado pelo e-mail petfoodfix@lookadev.com. Você também possui o direito de peticionar perante a Autoridade Nacional de Proteção de Dados (ANPD).
8. Cookies & Tracking Technologies
We use technical cookies for secure session routing, market determination, and storing your consent preferences. Non-essential cookies require your explicit prior consent. For a complete inventory of cookies and to update your choices, please visit our Cookie Policy.
9. Technical & Organizational Security Measures
We transport all traffic over TLS encryption and rely on encryption at rest provided by our database and hosting providers. The site runs behind a Content Security Policy with per-request cryptographic nonces, admin sessions are cryptographically signed, and access to production systems is restricted to the site operators. In the event of a personal data breach posing a risk to your rights, we will notify relevant supervisory authorities (ICO, ANPD) within 72 hours.
10. Protection of Minors
PetFoodFix is intended strictly for adults aged 18 and older. We do not knowingly collect personal data from individuals under 18 years of age. If we discover that personal data of a minor has been collected without verifiable parental consent, we will promptly delete that data.
11. How to Exercise Your Rights
To submit an access, deletion, correction, or portability request, or to ask any questions regarding our data practices, use our data request page or email our privacy team:
Global / UK / EU / US and Brasil / LGPD requests: petfoodfix@lookadev.com
We will respond to verified requests within thirty (30) days (or within 15 days as specified under LGPD Art. 19, II).