Privacy Policy

This Privacy Policy explains how Hetri Inc., a Delaware corporation ("Hetri," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use our websites (hetri.org, paw.hetri.org, grotaro.com) and our products, including Professional Animal Works ("PAW") and Grotaro (collectively, the "Services"). For most personal information processed through the Services, Hetri is the data controller. For contact and privacy requests, email privacy@hetri.org.

Where a PAW facility inputs information about its own clients into the platform, the facility determines the purposes of that processing and Hetri processes the information on the facility's behalf to provide the Services.

Information you provide. Account details (name, email address, password), profile and business information (for PAW facilities: business name, address, staff details, service listings; for pet owners: pet profiles and booking details), communications you send us, and support requests.

Payment information. Payments are handled by our payment partners (including Paddle, acting as merchant of record, and other payment processors used within PAW). We do not store full payment card numbers. We receive limited transaction information such as the item purchased, amount, transaction status, and billing country.

Information collected automatically. Log and device data such as IP address, browser type, operating system, pages viewed, referring pages, timestamps, and approximate location derived from IP address; and cookie data as described in Section 7.

TreatTap video. PAW's TreatTap feature transmits live video from participating facilities to authorized pet owners in real time. Hetri does not record or store TreatTap video streams. Facilities are responsible for providing any notices and obtaining any consents required for video streaming on their premises.

Grotaro. Grotaro displays aggregated, publicly available market data. The personal information we process for Grotaro users is limited to account, subscription, and usage information described above.

• To provide, operate, maintain, and improve the Services;
• To create and manage accounts, process subscriptions, and provide customer support;
• To send service communications such as receipts, renewal notices, and security or policy updates;
• To monitor, secure, and debug the Services, and to prevent fraud and abuse;
• To comply with legal obligations and enforce our Terms of Service;
• With your consent, where consent is required (for example, certain marketing emails, which you may opt out of at any time).

Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the Services you signed up for), legitimate interests (securing and improving the Services, preventing fraud), compliance with legal obligations, and consent where required. We do not use personal information for automated decision-making that produces legal or similarly significant effects.

We do not sell personal information. We share personal information only with:

• Service providers that process data on our behalf under contract, including cloud hosting providers (our infrastructure is hosted in the United States), payment partners (including Paddle as merchant of record), and email delivery providers;
• Between users, as the Services require. For example, a pet owner's booking details are shared with the facility they book, and a facility's public listing information is shown to pet owners;
• Legal and safety recipients, when required by law, legal process, or to protect the rights, safety, or property of Hetri, our users, or the public;
• Business transfers, in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to previously collected information.

We are based in the United States and process and store information on servers located in the United States. If you use the Services from outside the U.S., your information will be transferred to and processed in the U.S. Where required for transfers of personal data from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA, as applicable).

We retain personal information for as long as your account is active or as needed to provide the Services, comply with legal obligations (such as tax and accounting requirements), resolve disputes, and enforce agreements. When information is no longer needed, we delete or de-identify it. TreatTap video is streamed live and is not retained or recorded by Hetri.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and network security measures. No system is completely secure, and we cannot guarantee absolute security.

We use cookies and similar technologies that are necessary to operate the Services (such as session and authentication cookies) and, where applicable, analytics cookies to understand how the Services are used. Essential cookies cannot be disabled without affecting site functionality. You can control cookies through your browser settings, and where required by law we will request consent for non-essential cookies.

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent where processing is based on consent (without affecting prior processing).

EEA / UK / Switzerland. You may exercise your rights under the GDPR or UK GDPR by contacting privacy@hetri.org. You also have the right to lodge a complaint with your local supervisory authority.

California. Under the CCPA/CPRA, California residents have the right to know, access, correct, and delete personal information, the right to opt out of "sale" or "sharing" of personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. Authorized agents may submit requests on your behalf with proof of authorization.

To exercise any right, email privacy@hetri.org from the address associated with your account (or provide information sufficient for us to verify your identity). We will respond within the timeframe required by applicable law.

The Services are not directed to children under 13 (or under 16 where a higher age applies), and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@hetri.org and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by email or a prominent notice on the Services) before the changes take effect. The effective date at the top of this page indicates when this Policy was last revised.

Hetri Inc.: privacy@hetri.org (privacy requests) · legal@hetri.org (legal notices) · support@hetri.org (support). See also our Terms of Service and Refund Policy.