Privacy Policy

Last Updated: July 22, 2026

FlexPilot Inc., doing business as BossPaws™ ("BossPaws," "we," "us," or "our"), operates the BossPaws pet care platform, including the website at bosspaws.ai, the web application at app.bosspaws.ai, and the BossPaws mobile applications for iOS and Android (collectively, the "Service").

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service. We are committed to protecting your privacy and handling your data transparently and responsibly in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy laws.

Privacy Officer: The person responsible for the protection of personal information at BossPaws is the Privacy Officer, who can be reached at [email protected].

By using BossPaws, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

Account Information

When you create a BossPaws account, we collect:

• Email address
• Display name (optional)
• Password (stored as a secure hash; we never store or have access to your plain-text password)
• Authentication method (email/password or Google OAuth)

Pet Profile Information

When you add pets to your account, we collect:

• Pet name, species, breed, date of birth, and sex
• Weight and physical characteristics
• Medical history, allergies, medications, and veterinary information you choose to provide
• Pet profile photos
• Country and postal code (for location-relevant care guidance)

AI Conversation Data

When you interact with BossPaws AI, we collect:

• Messages you send and AI responses generated
• Photos, documents, and videos you upload for AI analysis
• AI Memory data (contextual information the AI retains about your pet across conversations, available on paid plans)
• Conversation metadata (timestamps, message counts, model used)

Health Documents

When you use the Health Intelligence feature, we collect:

• Uploaded veterinary documents (PDFs, images, text files)
• AI-generated analysis reports from those documents
• Video recordings and AI-generated video transcriptions
• Document metadata (file type, size, upload date)

PawAlert Data

If you use the PawAlert feature, we collect:

• Pet care schedules, feeding times, and medication reminders
• Emergency contact information you provide
• Care instructions and notes
• Alert and alarm configurations

Payment Information

When you subscribe to a paid plan, we collect:

• Subscription plan selection and billing period
• Payment transaction identifiers

We do not directly collect or store your credit card number, bank account details, or other financial instrument data. All payment processing is handled by our third-party payment processors (see Section 3).

1.2 Information Collected Automatically

Usage and Analytics Data

We automatically collect:

• Feature usage patterns (which features you use, how often)
• Session data (pages visited, actions taken within the app)
• Device type, operating system, browser type, and platform (web, iOS, Android)
• General geographic region (derived from IP address, not precise location)
• Error and performance logs
• Points earned and engagement tier status (gamification system)

Our web application (app.bosspaws.ai) uses cookieless analytics, meaning we do not track you across sessions using cookies for analytics purposes. Our marketing site (bosspaws.ai) uses cookie-based analytics subject to your consent. See our Cookie Policy and Section 9 for full details.

1.3 Categories of Personal Information (CCPA/CPRA Disclosure)

For California residents, the following table identifies the categories of personal information we have collected in the preceding 12 months, their sources, purposes, and third-party disclosures:

We do not collect: Social Security numbers, driver's license numbers, biometric data, precise geolocation, racial/ethnic origin, religious beliefs, sexual orientation, genetic data, or any information classified as "sensitive personal information" under CCPA/CPRA Section 1798.140(ae) beyond account login credentials.

2. How We Use Your Information

We use the information we collect for the following specific purposes:

We do NOT:

• Sell your personal information to any third party for monetary or other valuable consideration.
• Share your personal information for cross-context behavioral advertising.
• Use your data for targeted advertising.
• Share your pet profiles, conversations, or health documents with other users (unless you explicitly use sharing features such as PawAlert care sharing).
• Use your personal data or content to train AI models.
• Make automated decisions that produce legal or similarly significant effects on you without human involvement.

3. Third-Party Service Providers

We disclose personal information to the following third-party service providers solely for the business purposes of operating the Service. We maintain data processing agreements with each provider requiring them to protect your information and use it only as we direct.

AI Processing Providers

Infrastructure Providers

Payment Processors

Document Processing

Analytics and Monitoring

We require all third-party providers to protect your information and to use it only for the purposes we specify. We do not authorize them to use your data for their own marketing or any unrelated purpose.

4. Pet Health Data and AI Disclaimer

How We Treat Pet Health Data

Pet health data is not subject to human health privacy regulations such as HIPAA (which applies only to human health information in the United States). However, we treat your pet's health information with the same level of care and security as sensitive personal information:

• All pet health documents are stored in private, encrypted storage buckets.
• Access is restricted to your account only through Row Level Security (RLS) database policies.
• Health documents and AI analyses are never shared with other users or third parties beyond the AI processing providers listed in Section 3.
• AI providers process health data solely to generate your requested analysis and do not retain it after processing.

AI Processing Transparency

When you submit content for AI analysis, the following occurs:

• Your content is sent to Anthropic and/or Google (AI infrastructure providers) via encrypted connections.
• The AI generates a response based on your input.
• Neither Anthropic nor Google retains your data for model training under their API terms.
• All AI outputs are informational and generated without human review.
• You may request clarification on any AI-generated output by contacting [email protected].

5. Data Storage and Security

Storage Location

Your data is stored on Supabase infrastructure located in the United States. Data is processed in the United States and Canada.

Your data stored in the United States may be accessible to US government agencies, courts, or law enforcement pursuant to the laws of the United States, including the USA PATRIOT Act, the CLOUD Act, and the Foreign Intelligence Surveillance Act (FISA). We use contractual safeguards (data processing agreements) with all service providers to ensure a comparable level of protection.

Security Measures

We implement security safeguards appropriate to the sensitivity of the information, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Data stored in our database and file storage is encrypted at rest.
• Row Level Security (RLS): Every database table enforces Supabase Row Level Security, ensuring your data is accessible only to your authenticated account. Your data is completely isolated from all other users at the database level.
• Authentication security: Passwords are hashed using industry-standard algorithms. We support secure authentication via email/password and Google OAuth.
• Access control: Administrative access to production systems is restricted and logged.
• File storage isolation: Uploaded documents and images are stored in private storage buckets with authenticated access controls.
• Regular security review: We conduct periodic security audits of our systems and access policies.

Security Limitations

While we implement robust security measures, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data. If you become aware of any unauthorized access to your account, please contact us immediately at [email protected].

6. Data Retention

We retain your personal information only as long as necessary for the purposes described in this Privacy Policy. The following table specifies our retention periods by category:

7. Account Deletion

You may request deletion of your account and all associated personal data at any time.

How to Request Deletion

• In-app: Settings > Account Actions > Delete Account
• By email: Send a request to [email protected]

Deletion Process

When you confirm deletion, your account and all associated data are permanently and irreversibly deleted immediately from our systems and our service providers' systems, including:

• Your account profile and login credentials
• All pet profiles and associated information
• All AI conversations and chat history
• All AI Memory data
• All uploaded documents, photos, and videos
• All health tracking and PawAlert data
• All usage and gamification data

This action is immediate and cannot be undone — once deletion is confirmed, we cannot recover or restore your account or any of its data. There is no grace period and no recovery window. Payment and billing records may be retained for up to 7 years as required for tax and legal compliance. Anonymized, aggregated statistical data that cannot identify you may be retained indefinitely.

Important: Subscription Cancellation

Deleting your account does not automatically cancel paid subscriptions managed through third-party platforms:

• Apple App Store subscriptions must be cancelled through Settings > Apple ID > Subscriptions on your Apple device.
• Google Play subscriptions must be cancelled through Google Play > Payments & subscriptions > Subscriptions.
• Web (Stripe) subscriptions are cancelled automatically upon account deletion.

We strongly recommend cancelling any active subscriptions before requesting account deletion.

8. Your Privacy Rights

For All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete personal information.
• Deletion: Request that we delete your account and associated personal data (see Section 7).
• Data Portability: Request your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Withdraw Consent: Withdraw consent for optional data processing (such as marketing communications) at any time through your account settings.

For Canadian Residents (PIPEDA and Provincial Laws)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, you have the right to:

• Access your personal information held by us.
• Challenge the accuracy and completeness of your information and have it amended.
• Withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions. We will explain the consequences of withdrawal upon request.
• File a complaint about our privacy practices.

We will respond to all access and correction requests within 30 days of receipt of a verified request.

For Quebec Residents (Law 25): In addition to the rights above, you have the right to:

• Data portability in a commonly used technological format.
• Be informed if your personal information is used for automated decision-making.
• Request de-indexation (cessation of dissemination) of personal information if its dissemination contravenes the law or a court order.

How to file a complaint: If you are not satisfied with our response to a privacy request, you may file a complaint with:

• Office of the Privacy Commissioner of Canada: priv.gc.ca | 1-800-282-1376 | 30 Victoria Street, Gatineau, QC K1A 1H3
• Commission d'accès à l'information du Québec (for Quebec residents): cai.gouv.qc.ca

For California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, you have the right to:

• Right to Know: Request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it. You may request information for the preceding 12 months.
• Right to Delete: Request deletion of your personal information, subject to certain legal exceptions (e.g., completing a transaction, legal compliance, security).
• Right to Correct: Request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. No opt-out action is required.
• Right to Limit Use of Sensitive Personal Information: We use account login credentials (the only category of sensitive personal information we process) solely for the purpose of authenticating your account. No additional limitation is necessary or available.
• Right to Non-Discrimination: We will not deny you the Service, charge you different prices, or provide a different quality of service because you exercise your CCPA/CPRA rights.

How to Submit a Request:

• Email: [email protected]
• In-app: Settings > Account (for deletion and data export)

We will verify your identity before fulfilling any request. We will respond within 45 calendar days of receiving a verifiable request. If we need additional time, we will notify you of the extension (up to an additional 45 days) and the reason for the delay.

Authorized Agents: You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of written authorization and may verify your identity directly.

Global Privacy Control (GPC): We honor the Global Privacy Control (GPC) browser signal. If we detect a GPC signal from your browser, we will treat it as a valid opt-out request for any sale or sharing of personal information, in compliance with CCPA/CPRA.

For Residents of Other US States

Several US states (including Virginia, Colorado, Connecticut, Texas, Oregon, and others) have enacted comprehensive privacy laws providing rights similar to those described above. If you are a resident of a state with an applicable privacy law, you may exercise your rights by contacting us at [email protected].

9. Cookies and Tracking Technologies

Our use of cookies and similar technologies varies by platform:

• Marketing site (bosspaws.ai): Uses Google Analytics 4 and Microsoft Clarity for analytics. These tools set cookies on your device. A cookie consent banner is presented when you first visit, and analytics cookies are loaded only after you provide consent. You may accept or reject non-essential cookies, and you may change your preferences at any time via the cookie settings link in the site footer.
• Web application (app.bosspaws.ai): Uses only essential authentication cookies (Supabase session cookies) required for the Service to function. Product analytics are collected using PostHog in cookieless mode, which does not place tracking cookies on your device. No cookie consent banner is displayed because no non-essential cookies are used.
• Mobile applications (iOS/Android): Use device-native secure storage for session and authentication data. No traditional browser cookies are used.

For comprehensive information about the specific cookies used, their purposes, durations, and how to manage them, please refer to our Cookie Policy.

10. Breach Notification

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will:

1. Notify you as soon as feasible after becoming aware of the breach, by email or through the Service. Notification will include:
   • A description of the circumstances of the breach
   • The date or period of the breach (or approximate date)
   • A description of the personal information involved
   • A description of what we have done or intend to do to reduce the risk of harm
   • Steps you can take to reduce your risk of harm
   • Contact information for someone at BossPaws who can answer your questions
2. Report the breach to the Office of the Privacy Commissioner of Canada and any other applicable regulatory authority as required by law.
3. Notify any third-party organizations that may be able to reduce the risk of harm resulting from the breach.

We maintain a record of all breaches of security safeguards, regardless of whether they meet the notification threshold, for a minimum of 24 months in accordance with PIPEDA.

11. International Data Transfers

BossPaws is operated from Canada. Your data is stored in the United States (Supabase infrastructure) and processed in the United States and Canada by the third-party providers listed in Section 3.

Your data stored or processed in the United States may be subject to disclosure under the laws of the United States, including to US government agencies, courts, or law enforcement. We use contractual safeguards (data processing agreements) with all service providers to ensure a level of protection comparable to Canadian privacy law.

If you access the Service from outside of North America, please be aware that your information will be transferred to, stored, and processed in the United States and Canada, where data protection laws may differ from those in your jurisdiction.

By using the Service, you acknowledge and consent to the transfer and processing of your information in the United States and Canada as described in this Privacy Policy.

12. Children's Privacy

BossPaws is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18 years of age. We do not direct any part of the Service to children.

If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly and terminate the associated account.

If you believe a child under 18 has provided us with personal information, please contact us immediately at [email protected].

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy.
• Provide prominent notice through the Service (such as an in-app notification or banner) at least 30 days before the changes take effect.
• Send an email notification to your registered email address for significant changes.
• Where required by law, obtain your consent before the changes take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes take effect constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must stop using the Service.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy Officer: [email protected]
• General support: [email protected]
• Mailing address: Toronto, ON, Canada

We aim to respond to all privacy-related inquiries within 30 days. For CCPA/CPRA requests, we will respond within 45 calendar days.

If you are not satisfied with our response, you have the right to file a complaint with the applicable regulatory authority:

• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca | 1-800-282-1376
• Quebec: Commission d'accès à l'information du Québec — cai.gouv.qc.ca
• California: California Privacy Protection Agency — cppa.ca.gov

BossPaws™ is a registered business name of FlexPilot Inc., Toronto, Canada. © 2026 FlexPilot Inc. All rights reserved.

This Privacy Policy is effective as of the "Last Updated" date above and applies to all users of the BossPaws Service worldwide.