Privacy policy
This Privacy policy describes how SAS Digistart collects, uses and protects the personal data of Woopets AI users, in compliance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
The data controller is SAS Digistart, 61 allée du 3e Génie, 62000 Arras, France. Any request relating to your data may be sent to contact@digistart.fr. No Data Protection Officer (DPO) has been appointed, the volume of processing not making it mandatory.
2. Data collected
We only collect data necessary to operate the service and improve your experience.
- Account: email address, password (stored hashed via bcrypt), display name, preferred language, creation and update dates.
- Pets: name, species, breed, date of birth, weight, sex, photo, notes, sterilization status, medical conditions, allergies, medications, food (brand, type, product), activity level, living environment, insurance status, veterinarian name.
- Conversations: messages exchanged with virtual experts, agent consulted, language, selected pets, dates.
- Health record: veterinary events (vaccinations, consultations, treatments, etc.) entered manually or extracted automatically from your conversations.
- Behavioral memory: behavioral facts (behavior, care, household, preferences, context) automatically extracted from your conversations to personalize future answers.
- Technical data: IP address, device identifier (cookie), browser language, server logs.
- Notification token: a system-provided technical device identifier, collected ONLY in the mobile app if you enable push notifications.
3. Purposes and legal bases
Your data is processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| User account creation and management | Performance of the contract (Terms) |
| Provision of the AI chatbot and conversation history | Performance of the contract |
| Storage and automatic enrichment of pet profiles | Performance of the contract |
| Search for nearby pet professionals | Performance of the contract |
| Anti-abuse moderation and fraud prevention | Legitimate interest |
| Strictly necessary cookies (auth, language) | Legitimate interest / CNIL exemption |
| Push notifications (reply ready, program reminders, news) | Consent |
4. Subprocessors
To provide the service, we use carefully selected subprocessors who act under our responsibility and in accordance with the GDPR:
| Subprocessor | Purpose | Country | Guarantees |
|---|---|---|---|
| Anthropic PBC | AI response generation (Claude API) | United States | EU Standard Contractual Clauses |
| OpenAI, L.L.C. | Text vectorization (embeddings) | United States | EU Standard Contractual Clauses |
| DeepSeek | AI response generation (chat) | China | EU Standard Contractual Clauses |
| Google Ireland Ltd | Professional search (Places API) | Ireland | EU framework |
| Google Ireland Ltd (Firebase Cloud Messaging) | Delivery of push notifications (mobile app) | Ireland / United States (transfer) | Standard Contractual Clauses (SCC) for transfers outside the EU |
| OpenStreetMap Foundation | Address geocoding (Nominatim) | United Kingdom | EU adequacy decision |
| Amazon Web Services EMEA SARL | Hosting (Lambda, RDS, S3) | Luxembourg / Paris (eu-west-3) | EU subprocessor |
| Qdrant | Vector database (behavioral memory) | European Union | EU subprocessor |
5. Retention periods
Your data is retained for the following periods:
- Active account: throughout the lifetime of your account.
- Deleted account: definitive removal after 30 days (reversibility window).
- Conversations, pets, health record: as long as your account is active.
- Server logs: 12 months maximum (CNIL recommendation).
- Cookies: 13 months maximum (CNIL recommendation).
6. Your rights
In accordance with the GDPR, you have the following rights regarding your data:
- Right of access: obtain confirmation that your data is processed and receive a copy.
- Right to rectification: correct inaccurate or incomplete data.
- Right to erasure: request the deletion of your data in cases provided for by law.
- Right to object: object to processing on legitimate grounds.
- Right to restriction: temporarily suspend the processing of your data.
- Right to portability: receive your data in a structured, machine-readable format.
- Right to withdraw your consent at any time when processing is based on consent.
To exercise these rights, write to contact@digistart.fr specifying your request and providing proof of identity.
If you believe your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.
7. Transfers outside the European Union
Some of our subprocessors are located outside the European Union: Anthropic and OpenAI in the United States, and DeepSeek in China. Data transfers to these countries are framed by EU Standard Contractual Clauses validated by the European Commission, ensuring a level of protection equivalent to that of the EU.
8. Security
We implement appropriate technical and organizational measures to protect your data: HTTPS encryption, password hashing (bcrypt), signed JWT tokens, strict per-user data isolation, separate administrator access, logging of sensitive actions.
9. Minors
The service is prohibited to minors under 15, in accordance with the French Data Protection Act. If we discover that an account has been created by a minor under 15 without the required parental consent, we will delete it.
10. Policy changes
This Privacy policy may be updated to reflect changes to the service or regulations. The last update date appears at the top of this page. In case of substantial change, you will be informed via the service or by email.