Pawrate Privacy Policy
Last Updated: July 20, 2026
I. General Information
1. Who is responsible for data processing?
Pawrate UG (haftungsbeschränkt)Barlachweg 12 42857 Remscheid Germany Represented by the managing directors Marc-Colin Schwarz and Lukas Jahn Email: info@pawrate.de Commercial register, Local Court of Wuppertal, HRB 36234 VAT identification number: DE356925567
2. Who can I contact with questions about data protection?
If you have questions about data protection, you can contact datenschutz@pawrate.de.
3. What data subject rights do I have?
You generally have a right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). The fulfillment of these rights depends on certain requirements, and there are exceptional situations in which the named rights do not apply. For example, statutory retention obligations may prevent data erasure.
You can have an extract of your stored data created in JSON format directly through the Pawrate App.
If we process personal data to safeguard our legitimate interests under Art. 6(1)(f) GDPR, you have a general right to object. Where there are particular reasons arising from your specific situation and we do not have an overriding interest in the processing, we will stop the processing in the event of your objection. If you object to direct advertising, your data will no longer be processed for that purpose.
4. Can I withdraw consents that I have given?
Where we require consent for processing your personal data, we ask you for it expressly. Consents that have been given can be withdrawn at any time with effect for the future. Processing carried out up to that point is not affected.
5. Where can I lodge a complaint?
You have the right to lodge a complaint with the competent data protection supervisory authority at any time.
II. Pawrate Website
1. What happens when browsing the website?
When you access our website and view the various content, certain data is collected automatically and stored in server logfiles. In particular, usage data such as browser type/version, operating system used, referrer URL (the previously visited page), IP address of your device, and time of the server request are processed.
The lawfulness of this processing is based on Art. 6(1)(f) GDPR (legitimate interest). We want to present Pawrate and our services on a website and enable simple contact. This is unavoidable nowadays. The described data processing is required in order to access the website. It takes place automatically and cannot be prevented by you.
The IP address is stored insofar as this is appropriate for data security and the clarification or prevention of security or data protection violations. The storage period is generally no longer than three (3) months. In the event of a criminal complaint or the enforcement of claims against persons who have committed security or data protection violations, the data may be stored and used until the final clarification or enforcement of claims.
2. Which data is processed when using the contact form?
If you have questions, a contact form is available to you. Various information is requested in it so that we can better assign and process your inquiry. Alternatively, you can also contact us by email. We process the data you provide to answer your inquiry.
The lawfulness of this processing is based on Art. 6(1)(b) GDPR (pre-contractual measure) and Art. 6(1)(f) GDPR (legitimate interest). We want to be able to receive and answer your inquiries independently of place and time. We therefore provide you with an electronic means of contacting us.
We use the data you provide to answer your inquiry. Without the provision of your data, we cannot respond. In this respect, providing the data is necessary in order to contact us and receive answers to your questions.
We store your inquiry for the duration of contract initiation and beyond if a contract is concluded. Otherwise, the message history is deleted after 12 months.
4. What happens when Google Tag Manager is used?
Pawrate also uses Google Tag Manager from Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin 4, Ireland. With it, we can integrate code sections from various tools and manage them centrally through a user interface. Google Tag Manager triggers other tags, which may in turn collect data. However, Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, it remains in effect for all tracking tags insofar as they are implemented with Google Tag Manager.
Data transfer to a third country such as the USA is permitted under the conditions of Art. 46 GDPR and on the basis of the standard contractual clauses effectively incorporated into the contractual relationship with Google. These have been approved by the European Commission and guarantee an adequate level of protection for personal data. Google has also joined the Data Privacy Framework. Further information can be found in the Google Privacy Policy.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent).
Consent to this processing can be withdrawn at any time with effect for the future. Use is voluntary.
The data is deleted after 14 days.
5. What happens when Google Ads is used?
If you have consented, we use the Google Ads advertising program of Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin 4, Ireland. In this context, the IP address and interactions are stored if you reached our site via an advertisement.
Data transfer to a third country such as the USA is permitted under the conditions of Art. 46 GDPR and on the basis of the standard contractual clauses effectively incorporated into the contractual relationship with Google. These have been approved by the European Commission and guarantee an adequate level of protection for personal data. Google has also joined the Data Privacy Framework. Further information can be found in the Google Privacy Policy.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent).
Consent to this processing can be withdrawn at any time with effect for the future. Use is voluntary.
We store the data only as part of consent management.
6. What happens when Vercel Analytics is used?
If you have consented, we use Vercel Analytics from Vercel Inc. (USA) on the website. Vercel Analytics is an analytics tool that helps us understand visits to the website and further optimize it. Vercel does not use cookies; instead, it generates an individual hash value on the first visit to the website, which is stored for only one day.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent). We have a legitimate interest in understanding website visits in order to see which areas are visited frequently and thereby expand our offering.
Data transfer to a third country such as the USA is permitted under the conditions of Art. 46 GDPR and on the basis of the standard contractual clauses effectively incorporated into the contractual relationship with Vercel. These have been approved by the European Commission and guarantee an adequate level of protection for personal data. Vercel has also joined the Data Privacy Framework. Further information can be found in the Vercel Privacy Notice.
8. What happens in the context of Pawrate recommendations?
You can submit recommendations for places or providers to us. In doing so, you can describe and present the place or provider in more detail. We then review your information and, if positively suited and according to our individual decision, write a corresponding article about the place or provider. If you create an Insider profile, we can link to your profile in the article about the place or provider.
The lawfulness of data processing is based on Art. 6(1)(b) GDPR (contract). Providing your data is necessary in order to submit recommendations for further review. You may also voluntarily provide images of the place or provider in accordance with the Terms and Conditions.
We delete the data if we will not include the place or provider with us or if you do not create an Insider profile, so that no link between your Insider profile and the place or provider is created.
9. What happens when creating an Insider profile?
You can draft an Insider profile through the website. This is reviewed by us and may later appear in the Pawrate App as an Insider profile. In your profile, you can add personal information about yourself as well as a profile picture or hero image, or include links to other pages. If you have submitted a recommendation for a place or provider and it has been added to the database by us, we will link your Insider profile to it and identify you as the recommender.
The lawfulness of data processing is based on Art. 6(1)(b) GDPR (contract). Providing your data is necessary in order to become a Pawrate Insider.
The data is used for the duration of your presentation as an Insider until you change or remove it.
10. What happens when being presented as a provider?
We regularly receive recommendations for places and providers. If these have been reviewed and positively evaluated by us and we would like to publish an article about them, we ask the providers about participation in the presentation. Providers can provide further information and images, which we then add to the database and which will later be displayed in the app.
The lawfulness of data processing is based on Art. 6(1)(b) GDPR (contract). Providing your data is necessary in order to provide information as a provider.
The data is used for the duration of your participation as a provider until you change or remove it.
11. Where is the website hosted?
This website is hosted by Vercel Inc. (USA). Data such as IP addresses, meta and communication data, website accesses, and other data generated via a website are processed in this context.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in having the website hosted professionally, i.e. under optimal conditions and in compliance with appropriate security standards.
Data transfer to a third country such as the USA is permitted under the conditions of Art. 46 GDPR and on the basis of the standard contractual clauses effectively incorporated into the contractual relationship with Vercel. These have been approved by the European Commission and guarantee an adequate level of protection for personal data. Vercel has also joined the Data Privacy Framework. Further information can be found in the Vercel Privacy Notice.
The data is stored for the duration of website use.
12. Where is data stored (backend)?
For the storage and processing of certain data (e.g. email address for newsletter registrations), we use a server hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hereinafter Hetzner). The data is stored exclusively in Germany.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in reliable and secure storage of our users' data.
III. Pawrate App
1. What happens when downloading and installing the app?
When downloading and installing the Pawrate App, certain data is processed automatically. This particularly includes unique device identifiers, the IP address, country of installation and language, device manufacturer, model platform type, operating system, app or bundle identifier, and unique advertising IDs for iOS and Android devices. The downloaded content is also stored with IP address assignment.
Because of the user relationship between you and us regarding the Pawrate App, the processing that takes place is lawful under Art. 6(1)(b) GDPR. The processing as a whole is necessary in order to use the Pawrate App and all functions. Otherwise, no connection can be established between your device and our servers in order to retrieve information and trigger actions.
We do not store the data generated during installation. Data generated during use is anonymized promptly.
2. How can I register or log in?
There are several ways to use our Pawrate App.
First, you can use our guest access. No data from you or your animal is requested in this mode. Only technical data is processed. However, when using guest access, only limited functions (e.g. knowledge articles) are available to you.
Alternatively, you can log in using your Android or Apple account. You also have the option of registering and logging in with your email address and password.
In this case, you receive an email from us so that we can verify it. Login is only possible after successful verification.
Login credentials must be protected against unauthorized access by third parties.
If you are not a Pawrate user yourself, you may have received a link from a user to access certain information. In this case, registration is not necessary for the limited view. Access can be restricted and revoked by the authorized user.
The lawfulness of this processing is based on Art. 6(1)(b) GDPR (user relationship). It is necessary for login and to ensure sufficient data security.
3. What happens when using the Pawrate App?
After successful login, you can use the various Pawrate functions.
First, you can create a profile for your pet. Relevant information about your pet, such as name, weight, vaccination status, etc., can be provided.
You can also upload a picture of your pet.
If you are also visible in the picture, we process your image data.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in enabling you to use the extended profile presentation. You will not suffer any disadvantages if you do not use the function.
You can also provide further information that may allow conclusions to be drawn about data relating to you personally. This may be the case, for example, if you enter activities in the profile.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in enabling you to use the extended profile presentation. You will not suffer any disadvantages if you do not use the function.
You can use Pawrate not only to store health information about your pet, but also to manage your pet's appointments in the Pawrate calendar and activate appointment reminders.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in enabling you to use the function. You will not suffer any disadvantages if you do not use the function.
This function is also available in Pawrate so that you can continue using the stored information and share it with selected persons (e.g. veterinarian or pet sitter). This way, you have all information managed in one central place and can keep track yourself of who should receive access.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in enabling you to use the function. You will not suffer any disadvantages if you do not use the function.
Your data and your pet's data are stored by us for the duration of your use of Pawrate. You can delete the data yourself at any time. Otherwise, it will be deleted together with your profile.
4. Which data is processed for support?
You naturally have the option of sending us messages about questions or problems via our email or our contact form on the website. In this case, we process your data to respond to your request.
The lawfulness of processing is based on Art. 6(1)(b) GDPR (use). Providing information is necessary in order to answer your inquiry.
The information is stored by us for the duration of Pawrate use and otherwise deleted after 12 months.
We use Microsoft Graph as an interface for email sending in order to ensure good system integration. Further information can be found in the Microsoft Privacy Statement.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in an efficient, secure, and consistent way of working.
5. What happens when using Paw AI?
Pawrate provides you with Paw AI, an AI-supported assistant that you can ask in chat about your pet, in particular regarding health, behavior, nutrition, or other questions about your pet's everyday life. Paw AI uses the entered information and the context to improve responses.
The following systems may be used:
- OpenAI from OpenAI L.L.C., 548 Market St #60151, San Francisco, CA 94104, USA.
- Gemini from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Paw AI: Third-country transfer, recommendations, and incognito mode
Data transfer to a third country such as the USA is permitted under the conditions of Art. 46 GDPR and on the basis of the standard contractual clauses effectively incorporated into the contractual relationship with OpenAI or Google. These have been approved by the European Commission and guarantee an adequate level of protection for personal data. Further information can be found in the OpenAI Privacy Policy and the Google Privacy Policy.
In addition, weekly personalized recommendations are created and displayed to you on an AI-based basis using your information about your pet and location-related information. You can freely choose whether these should be based only on the stored profile or also on notes from the Health area.
Processing is lawful under Art. 6(1)(a) GDPR (consent). Use is voluntary and you can change the settings at any time with effect for the future.
Chats are deleted only after the profile is deleted.
If you do not want Paw AI to store and access your chats, you can also use incognito mode. In this mode, the entered information is stored only until one hour after closing the chat. In this case, the data is not taken into account for further use of Pawrate. At OpenAI, the data is retained for up to 30 days.
6. What happens when using Paw AI+?
Our paid Paw AI+ subscription is available for an extended request experience. A monthly subscription amount is due for use, with part of the subscription fees being donated to animal emergency aid organizations selected by the provider.
Payment management runs through the payment system of the app stores. Further information can be found at the respective app store.
Google Play Terms of Service and Apple Media Services Terms and Conditions
We receive the booking information necessary to provide the subscription.
Processing is lawful under Art. 6(1)(b) GDPR (contract).
The data is deleted when the contract has ended and no further statutory retention obligations exist.
7. What happens when push notifications are activated?
We use Expo Push Notifications for push notifications. This allows you to receive important information or news about Pawrate according to your settings.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent).
Consent to this processing can be withdrawn at any time with effect for the future. Use is voluntary.
Technical information (e.g. notification status) is deleted together with the user account. The push notifications themselves are not stored.
8. What happens when Google Firebase is used?
Pawrate uses Google Firebase from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The functions of Google Firebase include databases, authentication, push notifications, analytics functions, file storage, and much more. Due to its use, extensive processing of technical personal data takes place. Access to Pawrate is registered and reported to the provider of Google Firebase. In particular, data such as profile pictures is also stored there.
Data transfer to a third country such as the USA is permitted under the conditions of Art. 46 GDPR and on the basis of the standard contractual clauses effectively incorporated into the contractual relationship with Google. These have been approved by the European Commission and guarantee an adequate level of protection for personal data. Google has also joined the Data Privacy Framework. Further information can be found in the Google Privacy Policy.
The data processing that takes place, and in particular the transfer of data to Google, is based for necessary processing on Art. 6(1)(f) GDPR in conjunction with Section 25 TDDDG (legitimate interest). We have a legitimate interest in using important functions such as authentication.
For necessary processing such as analytics, the lawfulness of processing is based on Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent). Use is voluntary and may be objected to at any time with effect for the future.
The data is deleted if we no longer have an interest in retaining it or if consent is withdrawn.
9. What happens when PostHog is used?
We use the analytics service PostHog from PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. This enables us to analyze the use of Pawrate, in particular clicks, interactions, or page views. By evaluating this information, we can improve the Pawrate offering.
Further information can be found in the PostHog Privacy Policy.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent).
Consent to this processing can be withdrawn at any time with effect for the future. Use is voluntary.
The data is pseudonymized where possible and stored for 1 year.
10. What happens when Sentry is used?
We use the Sentry service from Sentry Software Solutions Inc., 120 Kearny St, San Francisco, CA 94108, USA. This detects technical disruptions and errors in the context of using Pawrate and helps us analyze causes and improve system availability.
Processing is lawful under Art. 6(1)(f) GDPR (legitimate interest) in conjunction with Section 25 TDDDG. We have a legitimate interest in keeping Pawrate stable and usable for you, and in this context it is essential to detect disruptions and errors early.
The data is stored for up to 90 days.
11. What happens when Tavily is used?
We use the Tavily service from AlphaAI Technologies Inc., 1350 Broadway, 24th Floor, New York, NY 10018, USA. This service is an AI-based application/web search that, for example, enables the veterinarian search in Pawrate.
Only the approximate location is shared.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent).
The data is deleted if location is disabled.
12. What happens when using map functions?
For searching and displaying service providers, places, and locations, we use map functions to better display location-related content. The map view is based on react-native-maps and uses various providers depending on the device:
- Android: Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
- iOS: Apple Maps (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland)
Map functions: location access
Further information on processing by the providers can be found in their privacy notices.
The location stored on the device is accessed by means of expo-location.
Processing is lawful under Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG (consent).
Consent to this processing can be withdrawn at any time with effect for the future. Use is voluntary.
13. To what extent is data of non-users processed?
Pawrate wants to provide an optimal service around pets and also include personal recommendations for veterinarians or excursion options with pets, such as cafés or parks, in order to recommend suggested or verified information to users. For this purpose, Pawrate is constantly looking for reliable cooperation partners who would like to participate in these recommendations. In this respect, personal data of recommenders may also be processed.
The lawfulness of processing is based on Art. 6(1)(a) GDPR (consent). Consent to this processing can be withdrawn at any time with effect for the future. Use is voluntary.
The data is deleted at the recommender's request or at our own discretion.
14. Where is data stored (backend)?
For the storage and processing of certain data (e.g. email address for newsletter registrations), we use a server hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hereinafter Hetzner). The data is stored exclusively in Germany.
The lawfulness of processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in reliable and secure storage of our users' data.
15. What happens when Meta (SDK) is used?
To make our offering known, place advertisements through Meta, and measure the campaign success of these advertisements, we use covered products of Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland).
In connection with its use, we collect the following event data and transmit it to Meta:
- first activation of the Pawrate App on a device
- completed registration
- completed onboarding
Meta (SDK): Technical data and advertising IDs
In connection with these events, Meta receives your IP address. Technical app and device information is also transmitted (e.g. timestamp, app and build version, app identifier (bundle or package name), operating system version, device model, language and region, time zone, mobile network provider, and screen data). Meta then creates an individual pseudonymous identifier for you in order to create a pseudonymous profile.
- If Apple iOS is used, the advertising ID (IDFA) may additionally be transmitted if you have separately consented to Apple's App Tracking Transparency (ATT) prompt.
- If Android is used, the Google Advertising ID and Google Play Install Referrer may be transmitted if you have separately consented.
Meta (SDK): Purposes, responsibility, and withdrawal
Through these separate system settings, Meta can then associate the data more precisely with an existing profile that is not pseudonymized.
Other content from the Pawrate App (e.g. pet health data) is not shared with Meta.
Meta may use the data to prepare reports on the effectiveness of our advertising campaigns and to create aggregated analyses and insights into the use of our Pawrate App and advertising campaigns. We and Meta are jointly responsible for collecting and transmitting the data used to create the analyses (e.g. campaign performance measurement), and we have entered into a joint controllership agreement with Meta to define compliance with the requirements of the GDPR. We provide you with the information under Art. 13 and 14 GDPR. Further information under Art. 13(1)(a) and (b) GDPR can be found in the Meta Ireland Privacy Policy.
Use of the services enables us to place targeted advertising and measure the success of advertising campaigns. In aggregated form, we learn which advertisements led someone to our Pawrate App and can better align our offering and advertisements accordingly.
Meta may be able to recognize you if you are logged into your Meta profile at the same time. If you do not want this, you can change it through WebChoices or Your Online Choices | EDAA.
Meta may transfer your data to countries outside the EU/EEA, in particular the USA. The EU Standard Contractual Clauses apply to these transfers. Meta has also joined the Data Privacy Framework. Further information on joint processing and Meta's further processing can be found in the Terms for covered products. You may also contact Meta there to exercise your data subject rights, as Meta is responsible in this context for implementing the rights under Art. 15-20 GDPR.
The legal basis for processing is Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG.
You can withdraw your consent to this processing at any time with effect for the future in the app settings. This will not disadvantage your use of the Pawrate App. Providing the data is voluntary.
The data is stored for the duration of app use and subsequently continues to be used in aggregated form.