Legal
Privacy Policy
Last updated: May 15, 2026
This policy describes what personal data VetLocal ("we", "Provider") processes, for what purposes, on what legal basis and for how long. It complies with EU Regulation 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.
1. Controller and contact
The data controller under Article 4(7) GDPR is the operator of VetLocal, email: danila.s.anikin@gmail.com.
Where the Customer processes personal data of their clients through the Service (e.g. in review text), the Customer acts as an independent controller and the Provider acts as processor under the Data Processing Agreement (Article 28 GDPR).
2. Categories of personal data
We process the following categories of personal data:
a) User identification and contact data: name, email, role in organisation. b) Authentication data: password hash or OAuth tokens (Google). c) Google Business Profile data: location IDs, photos, opening hours, categories; and names and content of reviews published by clients on Google. d) Billing data: company name, registration number, VAT ID, address, email. e) Technical data: IP address, user agent, usage logs, error telemetry via Sentry. f) Analytics data: anonymised usage events in PostHog (after consent).
3. Purposes and legal basis
We process data for the following purposes:
• Providing the Service — Article 6(1)(b) GDPR (contract performance). • Invoicing and accounting — Article 6(1)(c) GDPR (legal obligation). • Security and abuse prevention — Article 6(1)(f) GDPR (legitimate interest). • Analytics and product improvement — Article 6(1)(a) GDPR (consent).
4. Recipients and sub-processors
We use the following sub-processors:
• Supabase, Inc. (USA, EU data location Frankfurt) — database, authentication. • Vercel, Inc. (USA, EU edge) — application hosting. • Stripe Payments Europe, Ltd. (Ireland) — payment processing. • Anthropic, PBC (USA) — generative AI models. • Resend, Inc. (USA) — transactional email delivery. • Inngest, Inc. (USA) — background job orchestration. • DataForSEO LLC (USA) — Google search rank checking. • Google LLC / Google Ireland Ltd. (Ireland) — Google Business Profile API. • Sentry GmbH (Germany) — error tracking. • PostHog Inc. (USA, EU instance) — product analytics.
5. International transfers
For US-based sub-processors, data transfers are based on Standard Contractual Clauses (SCC) 2021/914 or the EU-US Data Privacy Framework adequacy decision.
6. Retention periods
Operational data — for the duration of the contract plus 30 days for export. Accounting records — 10 years by law. Security log — 24 months. PostHog analytics data — 12 months or until consent is withdrawn.
7. Your rights
As a data subject you have the right to access, rectification, erasure, restriction, portability and objection. To exercise your rights contact danila.s.anikin@gmail.com. We will respond within 30 days.
9. Children
The Service is intended exclusively for business users and persons over 18. We do not knowingly process data of persons under 16.
10. Security
We have implemented technical and organisational measures including: TLS 1.2+ encryption in transit, encrypted OAuth tokens at rest, Row-Level Security in PostgreSQL, restricted employee access with 2FA, and regular backups.
11. Policy updates
We may update this policy. You will be notified of material changes by email at least 30 days before they take effect.