Privacy Policy — Furriel
Last updated: 17 October 2026
This is a translation of the Portuguese text. If they differ, the Portuguese version prevails.
This Privacy Policy describes how the Furriel application (“Application” or “Service”) collects, uses, shares and protects the personal data of its users, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Law no. 58/2019 of 8 August, and Law no. 41/2004 of 18 August.
This Policy forms an integral part of the Terms and Conditions and must be read together with them.
1. Controller
The controller of the personal data is:
| Name | Diogo Ribeiro |
| Address | Rua António Lago Cerqueira, 72, 2.º Esq., 4600-017 Amarante |
| General contact | apoio@furriel.pt |
| Data protection contact | rgpd@furriel.pt |
No Data Protection Officer (DPO) has been appointed, as the conditions for mandatory appointment under Article 37 of the GDPR are not met. All questions relating to personal data should be addressed to rgpd@furriel.pt.
2. Scope
This Policy applies to all personal data processed in the context of the use of the Application by pet owners. It does not apply to third-party websites, applications or services that may be linked from the Application, which have their own privacy policies.
3. Categories of data processed
We process the following categories of personal data:
3.1. Account and identification data
- Email address (required for authentication);
- First name, surname and display name;
- Date of birth (optional);
- Phone number (optional);
- Profile photo (optional);
- Language/location preference (locale);
- Record of acceptance of the Terms and the Privacy Policy;
- Address, town, postcode and country (optional, in the customer profile).
3.2. Technical and session data
- Device information (model, operating system) and data on the last sign-in;
- Push notification identifier (token) (Firebase Cloud Messaging);
- Technical and diagnostic/error logs (crash reports).
3.3. Data about the animals and health records
- Animal profile: name, species, breed, sex, neutering, date of birth, microchip number, passport number, photo and notes;
- Health and monitoring records: weight, mood, diary, physical activity, vaccines, deworming, medications, feeding, conditions/allergies;
- Insurance and expenses: the animal’s insurance policies (insurer, policy number, start and end dates, notes) and expenses associated with the animal (category, amount, date, title and notes);
- Records (consultations, examinations, surgeries and others) and attached files (PDF, images), as uploaded by the user.
Health data concern the animal, not a natural person, and therefore do not constitute “special categories of data” within the meaning of Article 9 of the GDPR. However, some files uploaded by the user (for example, clinical documents) may contain personal data of the user or of third parties (such as the veterinary doctor); such data are processed as provided by the user, who is responsible for the lawfulness of the upload.
3.4. Service usage data
- Reminders created and their delivery history;
- Insurance quote requests;
- Support messages (“Contact us”);
- Notifications shown in the Application’s notification centre.
3.5. Location data
- Approximate or precise geographical location of the device, depending on the permission granted, only when the user authorises it, to show nearby service providers. This location is used in real time for the search and is not stored on our servers.
3.6. Usage analysis data (analytics)
- Aggregated data and usage events (screens visited, key interactions), collected only with consent — see Clause 6.
4. Purposes and lawful bases
| Purpose | Data involved | Lawful basis (GDPR) |
|---|---|---|
| Create and manage the account and authenticate access | 3.1, 3.2 | Performance of the contract (Art. 6(1)(b)) |
| Provide the features of the Service (records, files, export) | 3.1, 3.3, 3.4 | Performance of the contract (Art. 6(1)(b)) |
| Send reminders and push notifications | 3.1, 3.2, 3.4 | Consent (notification permission) and performance of the contract (Art. 6(1)(a) and (b)) |
| Search for nearby providers | 3.5 | Consent (location permission) (Art. 6(1)(a)) |
| Share data with insurers at the user’s request | 3.1, 3.3 | Consent (Art. 6(1)(a)) |
| Respond to support requests | 3.1, 3.4 | Performance of the contract / legitimate interest (Art. 6(1)(b) and (f)) |
| Usage analysis, error diagnosis and improvement of the Service | 3.2, 3.6 | Consent (Art. 6(1)(a)) |
| Security and fraud prevention | 3.2 | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations | As applicable | Legal obligation (Art. 6(1)(c)) |
Where the basis is consent, it is freely given, specific, informed and may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
5. Source of the data
Most of the data are provided directly by the user (when creating the account, filling in animal profiles and records, or requesting quotes or support). Technical, session and analysis data are generated automatically through use of the Application, by means of the services described in Clause 7.
6. Consent to analytics and notifications
6.1. Usage analysis (analytics). The collection of analytics data (PostHog) is disabled by default and is only enabled if the user gives their express consent, through an active choice (“Accept” or “Decline”) presented in the last welcome step of the Application, with no option pre-selected. Declining does not prevent use of the Application. These data are not used for advertising. With the same consent, PostHog also records technical errors in the Application, so that we can fix them.
6.2. Notifications. The sending of push notifications depends on the permission granted by the user at the level of the device’s operating system, which may be revoked at any time in the device settings.
6.3. Withdrawal. Consent may be withdrawn at any time in the Application or device settings, or by contacting rgpd@furriel.pt.
7. Data sharing, processors and partners
We do not sell personal data. Data are shared only in the following situations:
7.1. Processors (process data on our behalf)
- Supabase — hosting infrastructure, database, authentication, file storage and server functions;
- Google / Firebase — sending of push notifications (Firebase Cloud Messaging);
- PostHog — with consent, usage analysis and logging of technical errors, with the data hosted in the European Union.
These processors process the data only in accordance with our instructions and under data processing agreements that comply with Article 28 of the GDPR.
7.2. Partners and third parties (independent controllers)
- Insurers — when the user requests a quote, we share the necessary data (name, email, phone number, if available, and the animal’s data). From that moment on, the insurer processes those data as an independent controller, in accordance with its own policy;
- People with whom the user shares an animal — when the user generates a share code and another person uses it (for example, a pet sitter, a clinic or a family member), that person can see the animal’s data permitted by the chosen access level (health and routine records and, for a Co-owner, also expenses and insurance), and may receive the notifications relating to that animal. The person with access sees the name of the user who shared the animal, and the user sees the name of whoever has access. The user chooses with whom they share and until when, and may remove access at any time, with immediate effect. Records added by the person with access remain associated with the user’s animal.
7.3. Other disclosures
We may disclose data where required by law or by a competent authority, or for the protection of rights, security and fraud prevention.
8. International transfers
Data hosted on the Supabase infrastructure are stored in a region located in the European Union. Data processed by PostHog are likewise hosted in the European Union.
Some processors, namely Google/Firebase, may, however, process certain data outside the European Economic Area, in particular in the United States. In such cases, transfers are carried out on the basis of appropriate safeguards under Chapter V of the GDPR — namely Standard Contractual Clauses approved by the European Commission and/or the EU-U.S. Data Privacy Framework.
9. Retention periods
| Data | Retention period |
|---|---|
| Account data, animal profiles and records | For as long as the account remains active |
| Reminder delivery history (delivery log) | 60 days |
| Notifications in the notification centre | 30 days |
| Insurance quote leads | For the period necessary to process them and manage the request |
| Support messages | For the period necessary to reply to and manage the request |
| Data after an account deletion request | Permanent deletion after a safety period of 30 days (see Clause 10) |
At the end of these periods, the data are deleted or anonymised, unless there is a legal obligation to retain them for longer.
10. Account deletion
The user may request the deletion of the account through the Application. Deletion is subject to a safety period of 30 days, during which it can be reversed by signing in again. At the end of that period, the account and the associated data — including stored files (avatars and record files) — are permanently and irreversibly deleted, without prejudice to any legal retention obligations and to the keeping of anonymised or aggregated records.
11. Security
We adopt appropriate technical and organisational measures to protect personal data, in particular:
- Passwordless authentication, by means of a one-time code (OTP) sent by email;
- Row-Level Security rules that ensure each user can only access their own data;
- Storage of files in private areas, accessible only through signed temporary links (valid for a limited time);
- Encryption of data in transit.
No system is completely impregnable; in the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, we will comply with the notification duties laid down in Articles 33 and 34 of the GDPR.
12. Rights of the data subject
Under Articles 15 to 22 of the GDPR, the user is entitled to:
- Access to their personal data;
- Rectification of inaccurate or incomplete data;
- Erasure (“right to be forgotten”);
- Restriction of processing;
- Portability of the data;
- Objection to processing based on legitimate interest;
- Withdrawal of consent at any time, where processing is based on it.
To exercise these rights, simply contact rgpd@furriel.pt. We will respond within the legal period of one month, which may be extended under Article 12(3) of the GDPR. We may request additional information to confirm the identity of the requester.
Many of these rights can also be exercised directly in the Application (editing the profile, editing/deleting records and deleting the account).
13. Complaint to the supervisory authority
Without prejudice to any other remedy, the user has the right to lodge a complaint with the competent supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa · geral@cnpd.pt
14. Minors
The Application is intended for persons aged 16 or over. We do not knowingly collect data from children under the age of 16. If it is found that data of a child under the age of 16 have been collected without an appropriate legal basis, we will delete them.
15. On-device technologies and identifiers
The Application does not use browser cookies. It does, however, use third-party identifiers and SDKs (Firebase and PostHog) for notifications and, with consent, for usage analysis and error diagnosis. It also stores preferences locally on the device (for example, the analytics consent choice), for the proper functioning of the Service.
16. Automated decision-making and profiling
No automated decisions, including profiling, are taken that produce legal effects concerning the user or similarly significantly affect them. Analytics data are used in aggregate form, to understand usage and improve the Service.
17. Changes to this Policy
This Policy may be updated to reflect legal, technical or Service changes. The version in force is the one published in the Application, with the date of the update indicated. Substantial changes will be communicated by appropriate means (for example, a notice in the Application or an email).
18. Contacts
- Data protection questions: rgpd@furriel.pt
- General support: apoio@furriel.pt
Furriel — 5 October 2026