Privacy Policy

1. Who is responsible

Biera Solutions SL is the data controller for the information described here. The General Data Protection Regulation (GDPR) applies.

2. What we collect

• Account data: your email address, whether it has been verified, the name your sign-in method provides if any, which sign-in methods you have used and when, and the version of the Terms of Service you accepted and when.
• Pet data: what you and the other members of a pet enter about it: name, species, sex, date of birth, breed, neutering status, markings, microchip number, notes, photo, health records and documents, and whether the profile is active or archived.
• Sharing data: the pets you belong to and your role in each, which invite link you joined through, the invite links you create (their role, when they were created, whether they were turned off and how many people joined through them), and when an owner removed you from a pet. We never collect the name, email or phone number of the people you invite.
• Technical data: a session cookie that keeps you signed in, and server logs needed to run and secure the service.
• Usage data: how the service is used, as described in section 6 and section 7.

Pet data is not personal data on its own, but because it is tied to your account we treat it with the same care.

3. Why we process it

• To provide the service you asked for: keeping your pets' records and letting you sign in (performance of a contract).
• To let you share a pet with other people, and show the members of a pet to each other (performance of a contract). Section 4 explains what they see.
• To keep the service secure and prevent abuse (legitimate interest).
• To keep a record of the terms you accepted (legal obligation and legitimate interest).
• To learn how the service is used and what to improve: with your consent for the items stored on your device and for session recording, and on our legitimate interest for anonymous visit counts and the account events our server sends. The details are in section 6 and section 7.

We do not use your data for advertising and we do not sell it.

4. Sharing a pet with others

A pet can have more than one member. Owners can change everything about the pet, and viewers can see everything about it but change nothing.

What other members see

• Every member of a pet sees the other members: their name, if their account has one, their email address and their role. This includes people who join after you.
• Every member sees everything about the pet: its profile, photo, health records and documents, including what other members added.
• Before you join a pet, we show you the name and email address the other members will see. Joining is your choice, and you can leave at any time.

Invite links

• An owner invites people by creating a link and sending it themselves. Kuidara does not send it and cannot know who receives it.
• Anyone who has the link can use it to join the pet with the role it grants, until it expires after 7 days or an owner turns it off. Share it only with people you want to have access.
• We store a fingerprint of each link, not the link itself, so the link cannot be recovered from our database.

Ending access

• Any owner can see every member, change their role, remove them and turn invite links off. Removal takes effect straight away.
• If you leave a pet or an owner removes you, it disappears from your account. The records and documents you added stay with the pet, as part of its history.
• When an owner removes you, we record who did it and when, so that an invite link created before then cannot be used to bring you back.

5. Who else processes it

• WorkOS, Inc. provides sign-in. It holds your email address, your password if you set one, and the link to your Google account if you use it. WorkOS processes this data in the United States under a data processing agreement that includes the safeguards the GDPR requires for international transfers.
• Google acts as your identity provider when you choose to sign in with Google, under its own privacy policy.
• Our hosting provider stores the application and its database on servers in the European Union.
• PostHog provides product analytics and processes that data for us in the European Union. What it receives, for how long and on what basis is in section 7.

6. Cookies and similar technologies

Cookies and similar technologies, such as your browser's local storage, keep small pieces of information on your device. We use two kinds: strictly necessary items, which the service needs to work, and analytics items, which we only use if you allow them. There are no advertising or social media cookies.

Cookie and analytics disclosure: version 1, 26 September 2026

Strictly necessary

Always on, because the service cannot work without them. They do not need your consent.

• wos-sessionCookie

  Provider

  Kuidara, via WorkOS

  Purpose

  Keeps you signed in. Its content is encrypted.

  Duration

  Until you sign out, or 400 days at most

  Party

  First party

• wos-auth-verifierCookie

  Provider

  Kuidara, via WorkOS

  Purpose

  Protects sign-in: a one-time code that checks the sign-in coming back is the one you started.

  Duration

  10 minutes

  Party

  First party

• timcare.analytics.consentLocal storage

  Provider

  Kuidara

  Purpose

  Remembers your analytics choice: a random choice id that matches our record of your consent, your answer for each purpose, when you chose and which version of this section you saw.

  Duration

  24 months, then we ask again

  Party

  First party

Analytics, only if you allow them

Set only after you turn on usage measurement in your analytics choice. They are stored under our own domain and read by PostHog, which processes the data for us. Turning analytics off deletes them.

• ph_<project>_posthogCookie

  Provider

  PostHog

  Purpose

  Usage measurement: a random ID for this browser, and your account's internal number while you are signed in.

  Duration

  1 year

  Party

  First party

• ph_<project>_posthogLocal storage

  Provider

  PostHog

  Purpose

  Usage measurement: the same ID and the analytics settings for this browser.

  Duration

  Until you turn it off or clear site data

  Party

  First party

• ph_<project>_window_idSession storage

  Provider

  PostHog

  Purpose

  Tells your browser tabs apart, so visits and recordings do not mix.

  Duration

  Until you close the tab

  Party

  First party

• ph_<project>_primary_window_existsSession storage

  Provider

  PostHog

  Purpose

  Notes whether another tab of the site is already open, so each tab is counted and recorded on its own.

  Duration

  Until you close the tab

  Party

  First party

7. Analytics with PostHog

PostHog processes analytics data for us as a processor, under a data processing agreement. The data stays in the European Union, on servers in Frankfurt, Germany.

What we send

• Your account's internal number. Events sent by our server always carry it. From your browser it is sent only when you are signed in and have allowed usage measurement. Never your email, name or sign-in details.
• Events about what happens in the app, such as a pet being added. They carry only ids, fixed categories and counts, never pet names, notes, captions or documents.
• Session recordings, only if you allow them: a replay of what appears on screen and what you do there, with pet details, health records and documents masked. Screens whose masking we have not reviewed are never recorded.
• Anonymous page visit counts, without cookies and without storing your IP address.

How long it is kept

Events are kept for one year. Session recordings are kept for up to 30 days.

Legal basis

8. Your analytics choice

You can change your choice at any time from Analytics choices at the bottom of every page, including inside the app. It applies to this browser on this device only.

When you turn analytics off

• Session recording stops straight away.
• If you turn off usage measurement, we also delete the analytics items on this device and unlink this browser from your account in PostHog.
• Anonymous visit counts carry on, without cookies.

What turning it off does not do

• It does not erase data already sent. Erasing it is a separate request: write to us at the address in section 11.
• It does not change your choice in other browsers or on other devices.
• It does not stop the account events our server sends to PostHog. See the next paragraph.

Objecting to server-side analytics

If you have an account, you can object to the account events our server sends to PostHog. Write to us from the email address on your account. From then on, your account is left out of those events. Your browser choice stays as you set it.

When we ask again

We ask again if we add an analytics provider, a purpose or an item stored on your device, and 24 months after you last chose, as the Spanish data protection authority (AEPD) recommends. Other edits to this policy do not ask you again. Until you choose again, analytics are off.

Changes to this section

• Version 1, 26 September 2026: First version. PostHog, usage measurement and session recording.

9. How long we keep it

We keep your account and pet data while you have an account. Archived pet profiles are kept, not deleted, until you delete your account. When your account is deleted, you stop being a member of every pet. A pet nobody else belongs to is deleted with its records; a pet shared with others stays with them. Records of invite links and removals are kept for as long as the pet exists. Server logs are kept for a short period for security and then discarded.

10. Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong;
• delete your account and the data in it;
• restrict or object to processing in the cases the law provides;
• receive your data in a portable format.

You can also complain to the supervisory authority where you live. In Spain that is the Agencia Española de Protección de Datos.

11. Changes and contact

We publish changes to this policy here with a new version number. Material changes are announced before they take effect. The cookie and analytics disclosure in section 6 has its own version, listed in section 8. The Terms of Service are versioned separately.

Privacy requests: dani@danilat.com.