Privacy Policy

Pawliday is a Cyprus-based marketplace for overnight dog stays, daycare and dog walking. For personal data used to operate the Pawliday platform, Pawliday is the data controller.

Questions or requests can be sent through our secure support centre or to pawliday.cy@gmail.com.

We collect information you provide, information created while you use Pawliday, and limited technical information needed to keep the service secure.

• Account and profile: name, email address, phone number, avatar, city, saved addresses, language and owner or host mode.
• Dog care information: dog profile, photos, age, breed, size, behaviour, routines, vaccination records, medication, veterinarian and emergency-contact information.
• Host and listing information: identity status, biography, experience, home and household details, listing address, availability, prices, photos and payout readiness.
• Bookings and care activity: requests, dates, meetings, decisions, cancellations, reviews, repeat bookings, stay updates, meals, walks and medication logs.
• Messages and media: in-app messages and the photos or videos users choose to share.
• Identity checks: identity-document images, selfie captures, review decisions, fraud signals and audit records. Identity files are restricted and are not shown publicly.
• Payment information: booking amounts, payment status, refunds, payout status and Stripe identifiers. Pawliday does not receive or store full card or bank-account numbers.
• Technical information: IP address, browser or device type, timestamps, security logs, errors and cookie-based session information.
• Location: approximate search areas, saved addresses and precise browser location only when you actively allow the location feature.
• Support and safety: reports, incident details, attachments, call notes and the actions taken to resolve a case.

We use personal data only when we have a lawful reason under the GDPR.

• Contract: to create accounts, show relevant hosts, process requests and bookings, enable messages, deliver stay tools, payments, payouts and support.
• Legitimate interests: to keep Pawliday safe, prevent fraud, improve reliability, moderate content, understand service performance and protect owners, hosts, dogs and Pawliday. We balance these interests against your rights.
• Legal obligations: to keep required financial records, respond to authorities, handle disputes and meet tax, consumer, safety and platform obligations.
• Consent: where required for optional communications, device location, camera or photo-library access, and non-essential technologies. Consent can be withdrawn at any time.
• Legal claims and urgent safety: to establish or defend claims and respond to credible emergencies involving a booking.

We do not sell personal data and do not use sensitive data for targeted advertising.

Pawliday separates owner and host information and reveals it only when needed for a genuine marketplace interaction.

• Public host listings show the host's display name, general area, listing information, services, verification status and reviews. A precise home address is not shown publicly.
• A host with a relevant booking request can see the owner profile and the selected dog's care information needed to assess and provide care.
• Owners can see information the host publishes and booking-specific updates. Owners do not see host identity documents or payout details.
• Messages, exact meeting details, emergency contacts and care records are limited to the relevant participants and authorised support staff.
• Reviews may show a first name or initial, dog name and booking context. Pawliday may remove identifying details where safety requires it.

We share only what is needed to provide, secure and support Pawliday.

• Supabase: authentication, database, storage and realtime platform services.
• Vercel: application hosting, delivery, security and operational logs.
• Stripe: payment processing, fraud checks, refunds, host onboarding and payouts. Stripe separately controls data it needs for its regulated services.
• Google: optional Google sign-in, when chosen by the user.
• Resend and email infrastructure: sign-in codes and transactional emails.
• OpenFreeMap and OpenStreetMap ecosystem: map tiles and map interaction. Precise browser location is used only after permission is granted.
• Professional advisers, insurers and authorities: where necessary for a claim, incident, legal duty or protection of rights.
• Business transfer: if Pawliday is reorganised, financed, sold or merged, subject to appropriate confidentiality and notice.

Some providers may process data outside Cyprus or the EEA. Where required, we rely on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism.

We keep data only for as long as needed for the purpose described, taking account of safety, disputes and legal record-keeping.

• Account and profile data is kept while the account is active and during the period needed to complete a deletion request.
• Booking, payment, payout, refund and tax records are kept for the period required by applicable financial and tax law.
• Messages, reviews and support records are kept while needed to provide the service, resolve incidents, prevent abuse and handle legal claims.
• Identity materials and verification records are kept only while needed for verification, fraud prevention, disputes and legal obligations, with more restricted access than ordinary profile data.
• Security logs and backups are kept for limited operational cycles and then deleted or overwritten, unless a specific incident requires preservation.

When data is no longer required, we delete it or irreversibly anonymise it. A deletion request may not remove records that Pawliday must retain by law or to resolve an active dispute.

Depending on the circumstances, you can ask Pawliday to:

• confirm whether we process your personal data and provide a copy;
• correct inaccurate or incomplete information;
• delete information;
• restrict or object to particular processing;
• provide eligible information in a portable format;
• withdraw consent without affecting earlier lawful processing; and
• review a significant decision if it were ever made solely by automated means.

Use the account export or deletion controls where available, or contact support. We may need to verify identity before completing a request. You may also complain to the Cyprus Commissioner for Personal Data Protection or another competent supervisory authority.

Pawliday uses essential cookies and similar storage for sign-in, account mode, security and basic preferences. These are required for the service to work. We will ask before introducing non-essential analytics or advertising technologies where consent is required.

We use access controls, row-level database security, encryption in transit, restricted administrative access and operational monitoring. No system is completely secure, so users should protect their email account and report suspicious activity promptly.

Pawliday accounts are for people aged 18 or older. The service is not directed to children, and we do not knowingly create accounts for children.

We may update this policy when the product, providers or law changes. Material changes will be communicated in the app or by email before they take effect where required.

For privacy questions, contact pawliday.cy@gmail.com or use the support centre.