Legal Document
Privacy Policy
How we collect, use and protect your data and your pet's.
Last updated: 24 May 2026
1. Data Controller
The data controller for your personal data is Simone Cislaghi, operating through the Kiboo service, reachable at the following contacts:
- Website: kiboo.pet
- Support email: hello@kiboo.pet
This privacy notice is drafted pursuant to art. 13 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
2. Personal Data We Collect
2.1 Account data (Google OAuth)
When you register via Google OAuth we receive from your Google account:
- First and last name (display name)
- Email address
- Profile photo (avatar)
- Unique Google identifier (sub ID)
We do not receive or store your Google password. Authentication takes place entirely via Google and Supabase Auth.
2.2 Pet profile data
Data you voluntarily enter for each registered pet:
- Name, species, breed
- Date of birth, sex, weight
- Activity level, feeding personality, living environment
- Pet photo (uploaded voluntarily)
- Known allergies and medical conditions
2.3 Health and care data
Data you enter while using the app's features:
- Vaccination records (date, vaccine type, vet, expiry)
- Vet appointments (date, clinic, reason, notes)
- Health logs (daily weight, symptoms, appetite)
- AI-generated weekly nutrition plans
- AI-generated exercise and training guides
- Conversations with the AI vet assistant
2.4 Subscription and usage data
- Active plan (Free, Standard, Pro, Trial)
- AI usage counters (weekly messages)
- Purchase history and invoices (managed by Stripe, see sec. 4)
- Referral code and completed referrals
- Usage streaks and unlocked badges / achievements
2.5 Technical and navigation data
Collected automatically with each session:
- IP address (anonymised in Supabase logs)
- Browser type and operating system
- Date and time of access
- Pages visited within Kiboo
- Technical session cookies (see Cookie Policy)
3. Purposes and Legal Bases of Processing
| Purpose | Data used | Legal basis |
|---|---|---|
| Provision of the Kiboo service | Account, pets, health, usage | Performance of contract (art. 6.1.b GDPR) |
| Account authentication and security | Account, technical data | Performance of contract + legitimate interest (art. 6.1.b/f) |
| Payment and subscription processing | Email, plan, transaction history | Performance of contract + legal obligation (art. 6.1.b/c) |
| AI recommendations generation | Pet data, health, chat | Performance of contract (art. 6.1.b) |
| Notifications (vaccine alerts, reminders) | Email, dates | Performance of contract + legitimate interest (art. 6.1.b/f) |
| Service improvement and debugging | Technical data, usage logs (aggregated) | Legitimate interest (art. 6.1.f) |
| Tax and accounting obligations | Email, billing data | Legal obligation (art. 6.1.c) |
| Marketing communications (opt-in only) | Consent (art. 6.1.a), revocable at any time |
4. Sub-processors and Third Parties
Kiboo uses third-party service providers to deliver its functionality. Each provider is bound by a data processing agreement (DPA) compliant with the GDPR and may access your data only to the extent necessary for the requested service.
4.1 Supabase Inc.
- Role: database hosting, authentication, file storage (pet photos)
- Headquarters: San Francisco, CA, USA
- Data processed: all account and pet data
- Privacy Policy Supabase →
4.2 Stripe Inc.
- Role: payment processing, subscription management
- Headquarters: San Francisco, CA, USA
- Data processed: email, amounts, transaction history (card data NEVER seen by Kiboo)
- Privacy Policy Stripe →
4.3 Google LLC
- Role: authentication via Google OAuth
- Headquarters: Mountain View, CA, USA
- Data processed: name, email, profile photo (only at login)
- Privacy Policy Google →
4.4 Google LLC (AI – Gemini)
- Role: processing of AI vet assistant messages via Gemini 2.5 Flash
- Headquarters: Mountain View, CA, USA
- Data processed: content of AI conversations (includes your pet's data)
- Note: AI messages are used only to generate the response and not to train models, per Google AI API terms
- Google AI Terms →
4.5 Google Analytics
- Role: anonymized statistical analysis of site traffic, only with your consent
- Headquarters: Mountain View, CA, USA / Dublin, Ireland (EU)
- Data processed: anonymous cookie identifier, pages visited, aggregated usage data
- Privacy Policy Google Analytics →
4.6 Meta Platforms, Inc. (Meta Pixel)
- Role: measuring the performance of our Facebook/Instagram ad campaigns, only on the Health Score quiz page and only with your consent
- Headquarters: Menlo Park, CA, USA
- Data processed: browser cookie identifier, interaction events on the quiz page
- Privacy Policy Meta →
Kiboo does not sell, rent or transfer your data to third parties for marketing, advertising profiling or other commercial purposes.
5. Data Transfers Outside the EU
All providers listed in section 4 are headquartered in the United States. Data transfers to these countries take place in compliance with GDPR guarantees, through:
- Standard Contractual Clauses (SCC) approved by the European Commission
- For Supabase: availability of EU regions (data can be stored in Europe)
- For Stripe: adherence to the EU-USA Data Privacy Framework
- For Google (OAuth, AI services and Analytics): SCCs in force with supplementary technical measures
- For Meta (Meta Pixel): adherence to the EU-USA Data Privacy Framework
You can request more information about transfers by writing to hello@kiboo.pet.
6. Data Retention
| Data category | Retention period |
|---|---|
| Account and pet data | For the full duration of the active account |
| Health data and health logs | Duration of account + 12 months after deletion |
| Payment data and invoices | 10 years from issuance (tax obligation) |
| AI conversations | 6 months from creation (then automatically deleted) |
| Technical and access logs | 90 days |
| Data after account deletion | Deletion within 30 days of request, except where legally required |
7. Your Rights (GDPR)
As a data subject, you have the following rights under arts. 15–22 of the GDPR:
| Right | Description | How to exercise it |
|---|---|---|
| Access (art. 15) | Obtain confirmation and a copy of data processed | Email to hello@kiboo.pet |
| Rectification (art. 16) | Correct inaccurate or incomplete data | Directly in the app or via email |
| Erasure (art. 17) | 'Right to be forgotten', deletion of all data | Profile > Delete account |
| Restriction (art. 18) | Suspend processing in certain circumstances | Email to hello@kiboo.pet |
| Portability (art. 20) | Receive data in a structured format (JSON/CSV) | Email to hello@kiboo.pet |
| Objection (art. 21) | Object to processing based on legitimate interest or marketing | Email to hello@kiboo.pet |
| Withdrawal of consent | Revoke any consent previously given | Email or app settings |
| Complaint to supervisory authority | Lodge a complaint with the data protection authority | Your national data protection authority |
We respond to all requests within 30 days of receipt. For complex requests, the deadline may be extended by a further 60 days, with prior notice.
8. Data Security
We adopt appropriate technical and organisational measures to protect your data from unauthorised access, loss or disclosure. In particular:
- All data is encrypted in transit via TLS 1.3
- Data at rest is encrypted in the Supabase infrastructure (AES-256)
- Database access is restricted via Row-Level Security (RLS), each user can only access their own data
- Authentication tokens have a short expiry and are automatically rotated
- Payment card data never passes through Kiboo's servers (Stripe PCI-DSS Level 1)
- In the event of a data breach, we will notify you within 72 hours (art. 33 GDPR)
9. Children's Data
Kiboo is a service intended for persons aged 16 or over. We do not knowingly collect personal data from persons under 16. If you are a parent or guardian and believe that a minor has provided personal data to Kiboo, please contact us immediately at hello@kiboo.pet and we will delete the data promptly.
10. Profiling and Automated Decision-Making
Kiboo's AI generates personalised recommendations (nutrition plans, exercise guides, health advice) based on your pet's data. These processes:
- Are intended solely to improve the care of your pet
- Do not produce legally binding effects or automated decisions relating to you as a person
- Are purely educational and informational (not a substitute for veterinary advice)
- Do not create commercial or advertising profiles
Pursuant to art. 22 GDPR, you have the right to object to any relevant 'automated decision'. To do so, write to hello@kiboo.pet.
11. Changes to This Privacy Policy
Kiboo reserves the right to update this Privacy Policy to reflect regulatory, technical or service changes. In the event of material changes:
- We will send you a notification via email to your account address
- We will display a notice in the app on next login
- We will update the 'Last updated' date at the top of this page
Continued use of the service after 30 days of notification constitutes acceptance of the changes.
12. Contact Us
For any questions or requests regarding your personal data:
- Support email: hello@kiboo.pet
- Data Protection Authority: Your national data protection authority (EDPB members list →)
The English version of this Privacy Policy is the legally binding one.