Privacy Policy

1. Who we are

Ploof Pet Ltd (trading as Ploof+) is a company registered in England and Wales under company number 16084031. Our registered office is 21 Warriner Gardens, Battersea, London SW11 4EA. We are the data controller for the personal data we hold about you. Our ICO registration number is ZC131487.

You can contact us about anything in this policy at hello@ploof.co.uk.

2. What data we collect

We collect the following categories of personal data:

Account data: name, email address, phone number, password (hashed), marketing preferences, and a referral code.
Profile & pet data: any information you add about your pets or yourself.
Receipt data: images of receipts you upload, and the merchant, amount, date and category we extract from them using AI.
Transaction data: points earned, vouchers redeemed, and the date and value of each.
Affiliate tracking data: a click ID, the partner brand, a hashed IP address, user agent and timestamp when you click an affiliate link, and the order value if a partner reports a conversion back to us.
Technical data: IP address (hashed before storage), browser type, device, and pages visited.
Communications: emails you send us and our replies.

3. How we use it and our lawful basis

To run your Ploof+ account (contract): sign-in, points balance, redemptions, history.
To verify receipts and award points (contract): we send receipt images to our AI provider for extraction.
To track affiliate purchases (legitimate interest in operating the rewards programme).
To prevent fraud (legitimate interest): hashing IPs, deduplicating receipts, checking voucher abuse.
To send marketing emails (consent): only if you opt in. You can opt out anytime.
To meet legal obligations (legal obligation): accounting, tax, responding to lawful requests.

4. Who we share data with

We never sell your personal data. We share it only with the processors needed to run the service:

Lovable Cloud / Supabase — hosting, database, authentication, file storage (EU region).
Google AI (Gemini) and OpenAI — receipt image analysis. Receipts are sent for processing and not used to train their models.
Tillo — gift card / voucher fulfilment when you redeem points.
Awin and other affiliate networks — to attribute qualifying purchases back to your account.
Email providers — to send transactional and (if opted in) marketing emails.

5. International transfers

Some of our processors are based outside the UK/EEA (notably the United States). Where this applies we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses to keep your data protected to UK GDPR standards.

6. How long we keep it

Account data: while your account is open, plus 12 months.
Receipts: 24 months (for fraud prevention & tax).
Voucher / redemption records: 6 years (UK accounting law).
Affiliate clicks: 12 months.
Marketing data: until you withdraw consent.

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Have your data deleted (the "right to be forgotten").
Restrict or object to our processing.
Receive your data in a portable format.
Withdraw consent for marketing at any time.

To exercise any of these, email hello@ploof.co.uk. We'll respond within 30 days.

If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.

8. Cookies

We use a small number of cookies and similar technologies to run the site and (with your consent) measure usage. See our Cookie Policy for details.

9. Children

Ploof+ is not intended for anyone under 18. We do not knowingly collect personal data from children.

10. Changes to this policy

If we make material changes we'll let you know by email or in the app. The "effective" date at the top of this page will always reflect the latest version.