Disclaimer: This document is a translation of the original French version of the Privacy Policy, provided for reference purposes only. In the event of any discrepancy between this translation and the French version, the French version shall prevail.

Privacy Policy

Last updated: March 24, 2026

Article 1 — Introduction

This Privacy Policy describes how SARL DAMONI (hereinafter "izyPet", "We"), publisher of the izyPet platform accessible at https://izypet.co, collects, uses, stores, and protects the personal data of Platform users.

This policy applies to all Platform Users, whether they are Professionals ("Pros") or End Customers ("Customers"), as defined in our Terms of Use.

izyPet is committed to respecting the privacy of its Users and protecting their personal data in accordance with:

• Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation — GDPR);
• Law No. 78-17 of 6 January 1978 on information technology, data files, and civil liberties (Loi Informatique et Libertés);
• And any other applicable data protection legislation.

Article 2 — Identity of the data controller

2.1 izyPet as data controller

For processing operations related to the operation of the Platform and management of User accounts, the data controller is:

SARL DAMONI 3 chemin de la Font — 87510 Saint-Jouvent — France RCS Limoges 982 444 580 Email: contact@izypet.co

2.2 The Professional as data controller

For the personal data of End Customers collected and processed via the Platform in the course of the Professional's activity (customer records, animals, bookings, contracts, invoices), the Professional is the data controller.

In this context, izyPet acts as a data processor within the meaning of Article 28 of the GDPR. The respective obligations are set out in the Data Processing Agreement (DPA) entered into between izyPet and the Professional.

2.3 GDPR Contact

For any questions regarding the protection of your personal data, you may contact:

Email: contact@izypet.co

Article 3 — Data collected and purposes of processing

3.1 Processing for which izyPet is the data controller

A. Management of Professional accounts

B. Management of Customer accounts

C. Animal data

D. Transactional emails and notifications

E. Messages and notes

F. AI Voice Assistant (Professionals only)

AI data retention period: ninety (90) days, followed by automatic deletion of conversations and associated audio files.

G. Automatically collected browsing data

When you use the Platform, the following data is collected automatically:

Data collected for error tracking and security (always active):

Data collected via session recordings (session replays — only with your consent):

H. Security and technical diagnostics

I. Customer support

J. Marketing communications (where applicable)

You may unsubscribe from marketing communications at any time via the unsubscribe link included in each email or by contacting contact@izypet.co.

3.2 Processing on behalf of the Professional (izyPet as data processor)

For the following processing operations, izyPet acts as a data processor on behalf of the Professional (data controller):

Processing instructions and respective obligations are detailed in the DPA.

Article 4 — Cookies and similar technologies

4.1 What is a cookie?

A cookie is a small text file placed on your device (computer, tablet, smartphone) when you visit a website or use an application. It enables the site to remember information about your visit, such as your preferences or login status, in order to facilitate your subsequent browsing.

4.2 Strictly necessary cookies

These cookies are essential for the operation of the Platform. They do not require your prior consent in accordance with Article 82 of the Loi Informatique et Libertés and the guidelines of the CNIL (Commission Nationale de l'Informatique et des Libertés — the French Data Protection Authority).

Technical characteristics:

• ip_s: httpOnly: yes, secure: yes in production, SameSite: not set (browser default), path: /
• ip_cc: httpOnly: no, secure: yes in production, SameSite: Lax, path: /
• NEXT_LOCALE: httpOnly: no, secure: no, SameSite: Lax, path: /

4.3 Functionality and support cookies

The loading of the Crisp widget is subject to your consent, collected via the cookie management banner displayed on your first visit.

Crisp details:

• The Crisp widget is loaded only after acceptance of functional cookies.
• The data transmitted to Crisp (email, name, phone, company name) is detailed in Article 3.1.I above.
• Crisp privacy policy: https://crisp.chat/fr/privacy/

4.4 Analytics and monitoring cookies

Sentry includes two distinct features:

• Error and performance tracking: always active in the production environment, on the basis of legitimate interest (ensuring the stability and security of the Platform). This tracking does not require your consent.
• Session recording (session replays): visual reproduction of your browsing for diagnostic purposes. This feature is subject to your consent, collected via the cookie management banner displayed on your first visit.

Sentry details:

• Data is sent to a server located in the European Union (de.sentry.io — Germany).
• Data collected (error tracking): user ID, email, username, error logs, performance traces (see also Article 3.1.H above).
• Data collected (session replays, with consent): navigation interactions, visited page content, console logs (see also Article 3.1.G above).
• Sentry privacy policy: https://sentry.io/privacy/

4.5 Integrated third-party services

When you use certain features of the Platform, third-party services may place cookies or collect information through their own technologies:

These third-party services are subject to their own privacy policies. Only services that use cookies are covered by the cookie management banner. The AI assistant (Google Gemini) uses a direct WebSocket connection and does not place cookies; its use is governed by the Terms of Use (Article 10.3).

4.6 Managing your preferences

4.6.1 Via the cookie management banner

On your first visit to the Platform, a banner allows you to accept or refuse cookies that are not strictly necessary. You can change your preferences at any time via the "Manage cookies" link accessible in the Platform footer.

4.6.2 Via your browser

You can also configure your browser to accept, refuse, or delete cookies.

4.6.3 Consequences of refusing cookies

Refusing the session cookie (ip_s) will prevent any login to your izyPet account, as the Platform will be unable to maintain your authentication.

Refusing third-party cookies may limit certain features:

• Without Crisp: live chat support will not be available.
• Without Sentry (analytics cookies): session recordings will not be activated. Error tracking remains active (legitimate interest).

4.7 Similar technologies

4.7.1 Local storage

The Platform does not use the browser's local storage mechanisms (localStorage, sessionStorage) to store personal data.

4.7.2 Service Worker

The Platform uses a Service Worker as part of its Progressive Web App (PWA) nature. This Service Worker is used exclusively for caching application resources to enable offline use and improve performance. It does not collect or transmit any personal data.

Article 5 — Data recipients

5.1 Internal access

Access to personal data is strictly limited to authorized izyPet personnel, to the extent necessary for the performance of their duties (development, support, maintenance).

5.2 Technical sub-processors

izyPet uses the following sub-processors for the operation of the Platform:

5.3 Sharing with Professionals

Customer data is accessible to the Professional with whom they interact, within the following limits:

• A Professional may only access the data of their own Customers (isolation by facility);
• Accessible data includes: identity, contact details, emergency contact, animal records, booking history, contracts, and invoices.

5.4 Other recipients

izyPet does not sell, rent, or transfer Users' personal data to third parties for commercial purposes.

Personal data may be disclosed:

• To competent authorities where required by law (judicial request, administrative investigation);
• To a potential acquirer in the event of a sale, merger, or acquisition of izyPet, subject to prior notification of Users.

Article 6 — Data transfers outside the European Union

Some of our sub-processors are located outside the European Union, primarily in the United States. For these transfers, izyPet implements the following safeguards in accordance with Chapter V of the GDPR:

Regarding Fly.io, Neon, AWS, Sentry, and Cloudflare: although these entities are American companies, data is stored and processed in data centers located within the European Union (Paris or Frankfurt), thereby limiting transfers outside the EU.

You may obtain a copy of the appropriate safeguards by contacting us at contact@izypet.co.

Article 7 — Retention periods

Personal data is retained for the following periods:

7.1 Account and profile data

7.2 Contractual and accounting data

7.3 Technical and security data

7.4 AI assistant data

7.5 Support data

7.6 Monitoring data

Article 8 — Rights of data subjects

In accordance with the GDPR and the Loi Informatique et Libertés, you have the following rights:

8.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation that data concerning you is being processed and to obtain a copy of that data.

8.2 Right to rectification (Art. 16 GDPR)

You may request the rectification of inaccurate or incomplete data. You can directly modify certain information from your Account (profile, animals, emergency contact).

8.3 Right to erasure (Art. 17 GDPR)

You may request the deletion of your personal data, subject to legal retention obligations (accounting, tax) and the rights of third parties.

For both Professionals and Customers: account deletion is available in your account settings. It results in the deactivation of access to the Account and the removal of the facility from search results (for Professionals). Data required to comply with accounting and tax obligations, as well as data appearing on issued contracts and invoices, is retained for the legally required period.

8.4 Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another data controller. This right applies to data provided by you and processed on the basis of your consent or the performance of a contract. To exercise this right, contact us at contact@izypet.co and we will provide your data as soon as possible.

8.5 Right to object (Art. 21 GDPR)

You may object to the processing of your data based on legitimate interest, on grounds relating to your particular situation. We will cease processing unless there are compelling legitimate grounds.

You may object to certain email notifications:

• Boarding companion (buddy) notifications: unsubscribe via the link in the email or in your Account settings;
• Booking request notifications (Professionals): frequency settings available in your Account settings.

8.6 Right to restriction of processing (Art. 18 GDPR)

You may request the restriction of the processing of your data in the cases provided for by Article 18 of the GDPR (challenge to accuracy, unlawful processing, etc.).

8.7 Right to withdraw consent

Where processing is based on your consent (particularly for analytics cookies and session replays), you may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.

8.8 Post-mortem directives

In accordance with the Loi Informatique et Libertés, you may define directives regarding the retention, deletion, and disclosure of your data after your death.

8.9 Exercising your rights

To exercise your rights, contact us:

• Email: contact@izypet.co
• Mail: SARL DAMONI — 3 chemin de la Font — 87510 Saint-Jouvent — France

We will respond to your request within one (1) month of receipt. This period may be extended by two months in the case of complex requests or a high number of requests, in which case you will be informed of the extension.

Proof of identity may be requested to verify your identity.

8.10 Complaint to the CNIL

If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) (the French Data Protection Authority):

• Website: https://www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715 — 75334 PARIS CEDEX 07

Article 9 — Data security

izyPet implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data, including:

9.1 Technical measures

• Encryption in transit: all communications between your browser and our servers are encrypted via HTTPS/TLS;
• Password hashing: passwords are hashed using the scrypt algorithm (128-bit random salt, 512-bit key) and are never stored in plain text;
• Secure cookies: the session cookie is marked httpOnly and secure in production (see Article 4.2 for cookie details);
• Pre-signed URLs: documents (contracts, invoices) are accessible via temporary URLs that expire after 15 minutes;
• Ephemeral tokens: the AI assistant uses single-use tokens that expire after 30 minutes;
• Server Action encryption: server actions are protected by AES-GCM encryption;
• Brute-force protection: automatic rate limiting of login attempts by IP address (IP addresses are retained for a maximum of one month, then automatically deleted).

9.2 Organizational measures

• Role-based access control: strict data isolation between Professionals (each Pro can only access the data of their own facility);
• Environment separation: development and production environments are separate;
• Monitoring: continuous error and performance monitoring via Sentry;
• Logging: access and sensitive actions (logins, booking modifications, invoices) are logged.

9.3 Breach notification

In the event of a personal data breach, izyPet will notify the CNIL within 72 hours in accordance with Article 33 of the GDPR, and will inform the affected individuals if the breach is likely to result in a high risk to their rights and freedoms (Article 34 of the GDPR).

Article 10 — Processing of minors' data

The Platform is not intended for minors (under 18 years of age). izyPet does not knowingly collect personal data from minors. If we become aware that data from a minor has been collected without the consent of a person with parental authority, we will delete it as soon as possible.

Article 11 — Specific provisions for Users outside the European Union

11.1 Users residing in California (CCPA)

If you reside in California, you benefit from the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know what personal data is collected, used, and shared;
• Right to deletion of your personal data;
• Right to opt out of the sale of your data. izyPet does not sell your personal data;
• Right to non-discrimination: you will not be penalized for exercising your rights.

To exercise these rights: contact@izypet.co.

11.2 Users residing in Japan (APPI)

If you reside in Japan, izyPet complies with the provisions of the Act on the Protection of Personal Information (APPI). Transfers of your data to third countries are governed by safeguards compliant with the APPI. Japan benefits from an adequacy decision by the European Commission.

11.3 Users in other jurisdictions

For Users residing in other countries with specific data protection regulations, izyPet is committed to respecting the fundamental principles of data protection (minimization, purpose limitation, security, individual rights). For any specific questions, contact contact@izypet.co.

Article 12 — Changes to this policy

This Privacy Policy may be amended at any time to reflect changes to the Platform, applicable regulations, or our practices.

In the event of a substantial change, Users will be informed by email or by notification on the Platform. The date of the last update is indicated at the top of this document.

Changes do not apply retroactively. Data processing carried out prior to a change remains subject to the version of the Policy in effect at the time it was performed.

Article 13 — Contact

For any questions regarding the protection of your personal data:

Email: contact@izypet.co Mail: SARL DAMONI — 3 chemin de la Font — 87510 Saint-Jouvent — France