Zoolytix Privacy Policy

Applies to ShelterSync and other Zoolytix products and services

Effective date: 01/01/2026  |  Last updated: August 19, 2026

Zoolytix ("Zoolytix," "we," "us," or "our") provides software and related services to animal shelters, rescues, and similar organizations. This Privacy Policy applies to ShelterSync, our platform for managing animal intake, adoptions, fostering, donations, and related operations, together with our websites and other products and services that link to this Policy (collectively, the "Services"). It explains what personal information we collect, how we use and share it, and the rights and choices available to you.

This Policy applies to individuals who interact with the Services, including shelter and rescue staff who administer accounts ("Organization Users"), and members of the public who use the Services to adopt, foster, donate, or inquire ("End Users").

Note on roles. When an Organization uses ShelterSync to process personal information about its own contacts, that Organization is the data "controller" (or "business") and Zoolytix acts as its "processor" (or "service provider"). In those cases, the Organization's own privacy notice governs, and you should direct rights requests to them. Zoolytix is a controller with respect to account administration, billing, security, and improvement of the Services.

1. Information We Collect

We collect the following categories of personal information, depending on how you use the Services.

1.1 Account and Contact Information

Information you provide when you register, communicate with us, or use the Services, including your name, email address, phone number, mailing address, username and password, organization or shelter affiliation, and the content of messages or support requests you send us. For adopters and fosters, this may also include information you submit in applications, such as housing situation, household details, and references.

1.2 Payment and Donation Information

When you make a payment, donation, or pay adoption or service fees through the Services, we and our payment processors collect information needed to complete the transaction, such as the amount, date, billing name and address, and the last four digits of your card. Full payment card numbers are processed directly by our third-party payment processors and are not stored on our systems.

1.3 Location and Device Information

We automatically collect technical information when you use the Services, including IP address, approximate location derived from IP address, device and browser type, operating system, unique device identifiers, app version, pages or screens viewed, referring pages, and dates and times of access. Where the Services offer features that use precise geolocation (for example, mapping nearby animals or shelters), we collect that location data only with your permission, which you can control through your device settings.

1.4 Cookies and Similar Technologies

We and our service providers use cookies, pixels, SDKs, and similar technologies to operate the Services, remember your preferences, measure usage, and improve performance. See Section 7 (Cookies and Tracking) for details and your choices.

1.5 Animal and Behavioral Data

The Services store records about the animals managed by Organizations, including species, breed, age, medical and vaccination history, intake and outcome records, and behavioral assessments (for example, temperament evaluations, training notes, and compatibility with children or other animals). This animal data is generally not personal information about you. However, where animal records are linked to an identifiable person — such as a surrendering owner, adopter, foster, or veterinarian — the linked information is treated as personal information under this Policy.

1.6 Information From Other Sources

We may receive information about you from Organizations that use the Services (for example, when a shelter enters your adoption application), from payment processors, from analytics and advertising partners, and from publicly available sources. We combine this with information we collect directly.

2. How We Use Personal Information

We use personal information to:

• Provide, operate, maintain, and secure the Services;
• Create and administer accounts and authenticate users;
• Process payments, donations, and adoption or service fees;
• Facilitate adoptions, fostering, surrenders, and related communications between Organizations and End Users;
• Respond to inquiries and provide customer support;
• Send transactional messages and, where permitted, marketing communications you can opt out of;
• Monitor, analyze, and improve usage, performance, and features of the Services;
• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms; and
• Comply with legal obligations and enforce our agreements.

3. How We Share Personal Information

We do not sell your personal information for money. We share personal information as described below:

• Organizations: When you interact with an Organization through the Services, we share your information with that Organization.
• Service providers: With vendors who process information on our behalf — such as hosting, payment processing, analytics, email delivery, and customer support — under contracts that limit their use of the information.
• Other users: Information you choose to share through collaborative or public features of the Services may be visible to other users or to the public.
• Legal and safety: When we believe disclosure is necessary to comply with law, respond to lawful requests, protect the rights, property, or safety of Zoolytix, our users, animals, or the public, or enforce our terms.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent: When you ask us to share, or otherwise consent.

3.1 "Sales" and "Sharing" Under U.S. State Laws

Some U.S. state privacy laws define "sale" and "sharing" (for cross-context behavioral advertising) broadly enough to include certain uses of cookies and analytics or advertising technologies. To the extent our use of such technologies is considered a "sale" or "sharing," you may opt out as described in Section 6 and Section 7. We do not knowingly sell or share the personal information of individuals under 16.

4. Data Retention

We retain personal information for as long as needed to provide the Services, maintain your account, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and context; the periods we apply to each category are set out in Section 6.3. When information is no longer needed, we delete or de-identify it. Where Zoolytix acts as a processor for an Organization, retention is governed by that Organization's instructions and our agreement with it.

5. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

6. Your U.S. Privacy Rights (Including California)

Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable laws in other states. These rights may include:

• Right to know/access: To request the categories and specific pieces of personal information we have collected about you.
• Right to delete: To request deletion of personal information we collected from you, subject to exceptions.
• Right to correct: To request correction of inaccurate personal information.
• Right to opt out: To opt out of any "sale" or "sharing" of personal information and of certain targeted advertising.
• Right to limit: To limit the use of sensitive personal information to permitted purposes, where applicable.
• Right to non-discrimination: To not be discriminated against for exercising your rights.

To exercise these rights, contact us using the details in Section 10. We will verify your request, typically by confirming information associated with your account. You may use an authorized agent to submit a request on your behalf, subject to verification. California residents may also request information about disclosures for direct-marketing purposes under California's "Shine the Light" law.

6.1 Categories Collected, Disclosed, and Their Purposes

The table below summarizes the categories of personal information (using CCPA/CPRA categories) we have collected and disclosed for a business purpose in the preceding 12 months.

CCPA Category	Collected	Disclosed for a Business Purpose To
Identifiers (name, email, IP, account ID)	Yes	Service providers; Organizations
Customer records (phone, address, payment info)	Yes	Service providers; payment processors
Commercial information (transactions, donations)	Yes	Service providers; payment processors
Internet/network activity (usage, cookies)	Yes	Analytics and advertising providers
Geolocation data (approximate; precise if enabled)	Yes	Service providers
Inferences (preferences, usage patterns)	Yes	Service providers

6.2 What Deletion Means, and What We Keep

When you delete your account, or ask us to remove your information from a particular Organization, we anonymize your record rather than erase the underlying history. We destroy your password, PIN, sign-in sessions, registered devices, two-factor enrolment and one-time codes; we remove your name, email address, phone numbers, postal address, date of birth and profile photo, including the stored image itself; and your account can no longer be used or restored.

What remains is the Organization's own record of its animals. An entry recording that an animal was walked, fed, fostered or transported on a given date is the shelter's operational and animal-welfare record, which it may need or be required to keep. After deletion those entries survive with no person attached to them.

We cut off access immediately. The irreversible removal of your information completes within 30 days, and copies held in our encrypted backups expire within 35 days. The delay protects you: it means a stolen account cannot be used to destroy a shelter's records, and it gives you time to change your mind.

You can cancel during those 30 days. Signing in during that period will not restore the Services to you, but it will let you cancel the deletion and nothing else. We email you when a deletion request is accepted, and again before it becomes permanent, so a request you did not make does not pass unnoticed. Once the 30 days elapse the removal cannot be undone, by you or by us.

Four narrow exceptions. We keep the following despite a deletion request, and nothing else:

• Security accountability. Our audit trail records who made each change to a shelter's records. If every account could erase that link, deleting an account would become a way to hide a security incident or the misuse of an animal's records. We therefore retain, in encrypted form, enough information to identify who took a recorded action. It is held under an encryption key that the Services themselves cannot decrypt: no Organization, no user, and no part of the running platform can read it. Opening it requires a named individual at Zoolytix acting on a specific security incident, and every such access is recorded independently of us. It expires on the schedule below.
• Safety and incident records. Where a record concerns an injury, a bite, or a similar safety incident, we retain it for as long as it may be needed, because those records may carry their own legal retention obligations. We will notify you if this applies to your request.
• Backups. Copies of your information persist in our backups until they expire, within 35 days.
• Billing and tax records. Where we hold financial records relating to a paying Organization, tax and accounting law requires us to keep them.

If you have an active responsibility — an animal currently in your foster care, or an activity you have started and not finished — we cannot complete your deletion until it ends, because an animal would otherwise be in a home with no record of who has it. We will notify you of exactly what is outstanding and who to contact.

If you cannot sign in, contact us in Section 10. We verify a request against the email address or phone number already on your account before acting on it, since a deletion we cannot undo must not be triggered by someone impersonating you.

6.3 How Long We Keep Information

Records about animals, and the care history attached to them, are kept for the life of the Service and are not deleted on a schedule. They are the shelter's welfare record, they support long-term reporting and the identification of an animal that moves between shelters, and after a deletion request they carry no personal information about you.

Other categories are kept only as long as they are useful for the purpose that created them: security audit entries for two years, sign-in and security event records for twelve months, imported source files for 90 days after import, notifications for twelve months, and support and feedback submissions for two years after they are resolved. Operational system logs are kept for 30 days and backups for 35 days.

7. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary: Required to operate the Services, such as authentication and security.
• Functional: Remember your preferences and settings.
• Analytics: Help us understand how the Services are used so we can improve them.
• Advertising: May be used to measure and, where applicable, deliver relevant ads.

You can control cookies through your browser settings, our cookie banner or preference center where available, and device-level controls for advertising identifiers. We honor recognized opt-out preference signals such as Global Privacy Control (GPC) where required by law. Note that disabling some cookies may affect how the Services function.

8. Children's Privacy

The Services are intended for users who are at least 13 years old. The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will take appropriate steps to delete it; if you believe a child under 13 has provided us personal information, please contact us. For users who are minors (13 to 17 years old), we encourage the involvement of a parent or guardian, and we do not knowingly sell or share their personal information, as described in Section 3.1.

Individual Organizations may set a stricter minimum age for their own users. Where an Organization does so, its own requirement applies to you in addition to this minimum.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice (such as by email or an in-product notice). Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy.

10. How to Contact Us

If you have questions, concerns, or requests regarding this Policy or your personal information, contact us at:

Zoolytix Inc. Attn: Privacy 2810 N Church St. PMB 216425 Email: platform@zoolytix.com

We will respond to requests within the timeframes required by applicable law.