Campus pet care hub

1. Introduction and Scope

PawTrace ("the App", "we", "us", or "our") respects personal data and privacy. We process personal data in accordance with Singapore's Personal Data Protection Act ("PDPA") and other applicable laws. Where the App is provided in the People's Republic of China, or where we process personal information of individuals located in the People's Republic of China, we also comply with applicable PRC laws and regulations, including the Personal Information Protection Law, Data Security Law, Cybersecurity Law, Civil Code, Law on the Protection of Minors, Regulations on the Protection of Minors in Cyberspace, E-commerce Law, and Consumer Rights and Interests Protection Law.

This Agreement explains what data may be collected, why it is used, how it is stored, when it may be shared or transferred, and what rights you have. We will notify you of the purpose, method, scope, and necessity of personal data processing before collecting, using, or disclosing personal data where required by law.

2. Guest Mode

Guest mode is designed for preview use. When you continue as a guest, PawTrace does not create an account for you, does not log you in to any backend account, and does not store a guest profile in persistent browser storage. If you run chat, photo, video, or AI features, the specific text, image, or video you choose is sent to the backend and AI service for that request only, without saving it to an account.

Data you type or select in guest mode is kept in the current browser session where possible. AI requests are sent only when you actively press a chat, photo, video, or AI analysis action. Basic technical requests needed to load the web app, static assets, or public non-personal data may still occur.

3. Types of Information We May Collect

• Identity and account information: username, display name, avatar, contact details, account credentials, and authentication information.
• Device and technical information: device model, operating system, device identifiers, IP address, browser type, network quality data, crash logs, and security logs.
• Usage information: app actions, page or feature interactions, search terms, access time, feature frequency, and diagnostic information.
• Location and pet-care information: pet profiles, photos, health or care notes, location or campus position information, and emergency contact details that you choose to provide.
• Transaction information: order records, payment-related information, invoice details, and after-sales support records.
• Communication and feedback content: text, images, audio, video, files, customer support messages, chat content, camera input, album selections, or file uploads that you choose to provide.

Under applicable PRC law, precise location, payment information, health information, and personal information of minors may be sensitive personal information. We process sensitive personal information only for a specific purpose and only where necessary, and we obtain separate consent where required by law.

4. Purposes of Collection and Use

1. Core services: account creation, authentication, pet profile management, map features, chat, image sharing, health records, and AI-assisted features.
2. Transactions and support: order processing, payment handling, invoicing, after-sales support, and dispute handling.
3. Service improvement and security: product analytics, bug fixing, performance optimization, fraud prevention, account protection, and system security.
4. Customer service and communication: responding to questions, complaints, feedback, and rights requests, including identity verification where necessary.
5. Legal compliance and risk control: complying with applicable laws, regulations, regulatory requirements, court orders, or other lawful procedures.
6. Other consented purposes: marketing messages, user surveys, or feature testing where you have given consent. You may withdraw consent at any time.

5. PRC Personal Information Processing Rules

Where PRC law applies, we follow the principles of legality, legitimacy, necessity, good faith, openness, transparency, purpose limitation, data minimization, accuracy, accountability, and security. We do not collect personal information unrelated to the stated purpose.

Our legal bases may include your consent, necessity for entering into or performing a contract with you, fulfillment of statutory duties, emergency protection of life, health, or property, reasonable processing of information you have made public or that has been lawfully made public, and other circumstances permitted by law. Where separate consent, written consent, or renewed consent is required, we will obtain it as required.

6. Sharing and Disclosure

We do not sell your personal data. Except as described in this Agreement, with your authorization, or as required or permitted by law, we do not provide or publicly disclose your personal data to third parties.

• Service providers: payment processors, cloud services, analytics providers, customer support providers, and security or risk-control providers may process necessary information for specified purposes only.
• Affiliates or business partners: where necessary to provide services or perform a contract, we may share necessary data subject to appropriate data protection obligations.
• Legal disclosure: we may disclose necessary information when required by laws, regulations, regulators, courts, or lawful requests from enforcement authorities.

7. Data Security

We use reasonable technical and organizational measures to protect personal data, including encryption, access control, least-privilege permissions, logging, staff training, security reviews, and incident response procedures. No internet transmission or storage system can be guaranteed to be absolutely secure.

If a personal data breach, alteration, loss, or similar security incident occurs or may occur, we will activate our incident response process, take remedial measures, and notify regulators and affected individuals where required by applicable law.

8. Retention Period

We retain personal data only for as long as necessary to achieve the collection purpose, unless a longer retention period is required by law. When the purpose has been achieved, cannot be achieved, or is no longer necessary, we will delete, anonymize, or otherwise de-identify the relevant data as required by law.

9. Cross-Border Transfers

If personal data must be transferred outside Singapore or outside the People's Republic of China for business purposes, we will comply with the PDPA and applicable PRC cross-border personal information transfer rules. Where PRC law applies, we will provide required notices, obtain separate consent where required, conduct personal information protection impact assessments, and complete applicable procedures such as security assessment, certification, or standard contractual arrangements.

10. Your Rights

• Access and copy: you may request access to or a copy of personal data we hold about you, subject to applicable law.
• Correction or supplementation: you may request correction or supplementation if personal data is inaccurate or incomplete.
• Deletion or anonymization: you may request deletion or anonymization in circumstances provided by law.
• Withdrawal of consent: you may withdraw consent for specific processing activities. Withdrawal does not affect processing already carried out based on consent before withdrawal.
• Restriction or refusal: where permitted by applicable law, you may request restriction of processing or refuse certain non-essential processing.
• Account cancellation and portability: where legal and technical conditions are met, you may request account cancellation or transfer of personal information to another personal information processor.
• Explanation and complaints: you may request an explanation of our processing rules or submit a complaint using the contact details below.

11. Minors

We do not intentionally provide services to minors under 14 years old and do not intentionally collect their personal data. If PRC law requires us to process personal information of a minor under 14, we will obtain consent from the minor's parent or guardian and follow the principle of the best interests of the minor. If we discover that we collected a minor's information without valid consent, we will delete it or take other necessary measures after verification.

12. Updates and Notices

We may update this Agreement due to business changes, legal developments, or regulatory requirements. If an update reduces user rights or expands the scope of personal data processing, we will provide notice through the App or another reasonable method before the update takes effect. Continued use of the App means you accept the revised Agreement. If you do not agree, you should stop using the relevant service and exercise your rights under this Agreement.

13. Governing Law and Dispute Resolution

This Agreement is generally governed by Singapore law. Mandatory PRC laws and regulations also apply to matters involving network services, data processing, consumer rights, or personal information protection within the People's Republic of China. Any dispute should first be resolved through friendly negotiation. If negotiation fails, either party may submit the dispute to a court with proper jurisdiction, unless mandatory law provides otherwise.

14. Contact Us

If you have questions, suggestions, rights requests, or complaints about personal data processing or this Agreement, please contact the data protection contact:

• Email: jeremyzhao613@gmail.com
• Phone: +852 61334511
• Address: Xi'an Jiaotong-Liverpool University, Taicang

Please include your identity, contact details, and the specific request so that we can verify your identity and respond in a timely manner.

15. Disclaimer

This Agreement describes general policies for data collection, use, storage, management, and the main obligations that may apply under the PDPA and PRC laws. We try to keep it accurate and complete, but it is not professional legal advice. You should consult a qualified legal professional based on your own business circumstances to ensure full compliance. We are not liable for direct or indirect losses caused by using or relying on this template.