Privacy Policy

1 Scope

This Policy applies to information collected through:

• the Koby App,
• our support channels (e.g., email), and
• our websites/pages that link to this Policy (if any).

2 Information We Collect

2.1 Information you provide

Account information

• Email address
• Password (stored using secure hashing; we do not store plaintext passwords)
• Login method (email/Apple/Google)
• Basic profile information (e.g., name if provided)

Pet and usage information you enter

• Pet profile details (e.g., name, breed, age, weight, diet notes, activity notes)
• Vaccination and medication reminders/schedules you set
• Photos and files you upload related to pets (if you choose to upload)

User-generated content (UGC)

• Posts, comments, messages, and other content you submit (if community features are enabled)

Support communications

• Content you send us via email (and any attachments)

AI chat inputs

• Messages you type into the AI chat and any information you choose to include

2.2 Information collected automatically

Device and app information

• Device model, operating system, app version, language settings, time zone

Usage and diagnostics

• Features used, screens viewed, actions taken
• Crash logs, performance metrics, and diagnostic events

Log information

• IP address (often), timestamps, error logs, security events

Identifiers

• App instance IDs and similar identifiers used for security and analytics

(We avoid collecting advertising identifiers unless explicitly needed and disclosed.)

2.3 Subscription and transaction information

If you subscribe via Apple/Google:

• We may receive subscription status (active/expired), product IDs, and transaction metadata required to unlock premium features.
• We do not receive your full payment card number.

3 How We Use Information

We use information to:

• Create and manage accounts
• Provide core app features (pet profiles, reminders, personalized settings)
• Provide AI features (responding to prompts; improving reliability and safety)
• Send service messages (security alerts, verification messages)
• Deliver push notifications only if you enable them
• Operate analytics and improve the App (feature adoption, debugging, performance)
• Prevent fraud, abuse, and security incidents
• Enforce Terms and comply with legal obligations
• Provide partner offers/benefits (see Section 5.3)

4 Legal Bases (GDPR/UK GDPR)

Where GDPR/UK GDPR applies, we process personal data under:

• Contract: to provide the App and features you request
• Legitimate interests: to secure, measure, and improve the App (balanced with your rights)
• Consent: where required (e.g., certain marketing, push permission prompts, and some regional requirements)
• Legal obligation: to comply with laws and lawful requests

5 How We Share Information

5.1 Service providers (processors)

We share information with vendors that help us operate the App (cloud hosting, analytics, push notifications, authentication, support, AI processing). They are authorized to use your data only as needed to provide services to us.

5.2 Legal, safety, and enforcement

We may disclose information if needed to:

• comply with law, regulation, or legal process,
• respond to lawful requests,
• protect the security and integrity of the App,
• prevent fraud or abuse,
• protect rights, safety, and property of users, Krava, or others.

5.3 Partner offers

We partner with companies to provide:

• exclusive offers,
• product recommendations,
• cross-sell/upsell opportunities.

This may involve sharing user and pet information with partners (for example: city/region, pet type/breed/age, plan eligibility signals, and contact details where permitted).

Your choices: Where required by law, we will provide appropriate consent and/or opt-out mechanisms before sharing data for such partner marketing/offer purposes.

5.4 Business transfers

If Krava undergoes a merger, acquisition, restructuring, or asset sale, information may be transferred as part of that transaction, subject to appropriate protections.

6 Analytics, SDKs, and Service Providers

We use analytics and infrastructure tools to run and improve the App. Examples include:

• AWS (hosting and storage)
• Firebase (analytics, crash reporting, performance monitoring, depending on configuration)
• Mixpanel (product analytics, depending on configuration)
• Metabase (internal analytics dashboards; typically operates on aggregated/internal datasets)
• Expo (push notification delivery infrastructure)

Typical data processed by analytics SDKs includes:

• device/app identifiers,
• feature usage events,
• performance and crash logs,
• approximate location derived from IP (depending on configuration).

7 Push Notifications

If you enable notifications:

• We collect and store push token(s) (including via Expo) to deliver notifications to your device.
• You can disable notifications in your device settings at any time.
• Notification events (delivery/open) may be measured depending on configuration.

8 AI Features and Processing

8.1 What AI features do

AI features may help with:

• answering pet-care questions,
• summarizing your notes,
• suggesting routines/reminders.

8.2 AI is not professional advice

AI outputs are informational only and may be inaccurate or incomplete. Do not rely on AI for diagnosis or emergency decisions.

8.3 Data used for AI

AI features process:

• your chat messages,
• related context you choose to provide (such as pet profile details, if the feature supports this),
• limited technical data needed for reliability and abuse prevention.

8.4 Third-party AI providers

AI functionality may be supported by third-party LLM providers acting as our service providers/processors. These providers may change from time to time.

When you use AI Features, we may share your AI chat inputs and any optional context you choose to provide (such as pet profile details, if the feature supports it) with these providers to generate responses, maintain safety, prevent abuse, and improve reliability.

We require third-party AI processors to protect information and process it only on our instructions. However, their services and terms may evolve, and we may update our provider list and this Policy as needed.

9 Children's Privacy

Koby is intended for general audiences, including families. Children under 13 may use the App only with parental supervision and consent.

We do not knowingly collect personal data from children under 13 without parental consent. If you believe a child has provided personal data without consent, contact admin@kravalabs.com.

10 Account Deletion, Anonymization, and Retention

10.1 Retention while active

We retain personal data as needed to provide the App.

10.2 What happens when you delete your account

When you delete your account:

• your account is disabled, and
• your personal data is irreversibly anonymized, meaning it can no longer reasonably identify you.

10.3 Data we may still retain

We may retain certain information as required or permitted by law, including for:

• security and fraud prevention,
• compliance and audits,
• dispute resolution,
• enforcing our Terms.

Where possible, we keep retained information in anonymized or aggregated form.

11 Data Access and Portability (Including GDPR)

11.1 How to request your data

To request a copy of your personal data (including under GDPR), email admin@kravalabs.com with the subject line: "Data Access Request" or "Data Portability Request".

There is currently no in-app "download my data" feature.

11.2 Identity verification

To protect your privacy, we may ask you to verify your identity (for example, by confirming account details or completing a verification step) before we provide data.

11.3 Response time

Where GDPR/UK GDPR applies, we respond without undue delay and within one month of receiving your request. If your request is complex or you submit multiple requests, we may extend by up to two additional months, and we will notify you within the first month if an extension is needed.

11.4 Format of your data

Where the right to data portability applies, we will provide the data you have provided to us in a structured, commonly used, and machine-readable format (for example, CSV or JSON), and where technically feasible, we can transmit it directly to another controller if you ask.

11.5 Fees and exceptions

We do not charge a fee in most cases. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, as permitted by applicable law. If we refuse, we will explain why and tell you about your options to challenge the decision.

12 Your Rights by Region

12.1 GDPR / UK GDPR (EU/EEA/UK users)

Depending on your location and circumstances, you may have rights to:

• access your personal data,
• correct inaccurate data,
• request deletion/erasure (where applicable),
• restrict processing,
• object to processing (where applicable),
• data portability,
• withdraw consent (where processing is based on consent),
• lodge a complaint with a supervisory authority.

You can exercise these rights by emailing admin@kravalabs.com.

12.2 CCPA / CPRA (California users)

California residents may have rights to:

• know what personal information we collect, use, and share,
• request deletion (subject to exceptions),
• correct inaccurate personal information,
• opt out of "sale" or "sharing" (as defined by California law),
• limit the use/disclosure of sensitive personal information (if applicable),
• non-discrimination for exercising rights.

Do Not Sell or Share: If our partner-sharing is considered a "sale" or "sharing" under CPRA, you may opt out by emailing admin@kravalabs.com with subject: "Do Not Sell or Share".

12.3 India DPDP Act, 2023 (India users)

Where DPDP applies, you may have rights to:

• access information about processing,
• correction and updating,
• erasure (as applicable),
• withdraw consent (where processing is based on consent),
• grievance redressal.

You can exercise rights by emailing admin@kravalabs.com.

13 International Data Transfers

We are based in India and may process data in India and other countries where our service providers operate.

Where GDPR applies, we use appropriate safeguards for cross-border transfers where required.

14 Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. However, no method of transmission or storage is completely secure.

15 Grievance Officer (India - DPDP)

16 Changes to This Policy

We may update this Policy. If changes are material, we will provide notice (e.g., in-app). Continued use after the effective date means you accept the updated Policy.

17 Contact