Zoolytix Privacy Policy

Applies to ShelterSync and other Zoolytix products and services

Effective date: 01/01/2026  |  Last updated: October 14, 2026

Zoolytix ("Zoolytix," "we," "us," or "our") provides software and related services to animal shelters, rescues, and similar organizations. This Privacy Policy applies to ShelterSync, our platform for managing animal intake, adoptions, fostering, donations, and related operations, together with our websites and other products and services that link to this Policy (collectively, the "Services"). It explains what personal information we collect, how we use and share it, and the rights and choices available to you.

This Policy applies to individuals who interact with the Services, including shelter and rescue staff who administer accounts ("Organization Users"), and members of the public who use the Services to adopt, foster, donate, or inquire ("End Users").

Note on roles. When an Organization uses ShelterSync to process personal information about its own contacts, that Organization is the data "controller" (or "business") and Zoolytix acts as its "processor" (or "service provider"). In those cases, the Organization's own privacy notice governs, and you should direct rights requests to them. Zoolytix is a controller with respect to account administration, billing, security, and improvement of the Services. Zoolytix also lets you get a copy of your own part of an Organization's records about you, such as what you did, when, and with which animal (Section 6.4). If you cannot sign in, that copy also covers an Organization that has restricted you, marked you inactive or removed you, and one that has closed. No copy includes anything an Organization recorded about you before your details were removed from it at your request (Section 6.2).

1. Information We Collect

We collect the following categories of personal information, depending on how you use the Services.

1.1 Account and Contact Information

Information you provide when you register, communicate with us, or use the Services, including your name, email address, phone number, mailing address, username and password, organization or shelter affiliation, and the content of messages or support requests you send us. For adopters and fosters, this may also include information you submit in applications, such as housing situation, household details, and references. When you set up your account, we ask for your date of birth if we don't already have it, and an Organization may enter it when it adds you. We use it to check that you meet the minimum age (Section 8) and to make the profiles of users under 18 more private by default.

1.2 Payment and Donation Information

When you make a payment, donation, or pay adoption or service fees through the Services, we and our payment processors collect information needed to complete the transaction, such as the amount, date, billing name and address, and the last four digits of your card. Full payment card numbers are processed directly by our third-party payment processors and are not stored on our systems.

1.3 Location and Device Information

We automatically collect technical information when you use the Services, including IP address, device and browser type, operating system, unique device identifiers, app version, pages or screens viewed, referring pages, and dates and times of access. Where the Services offer features that use precise geolocation (for example, mapping nearby animals or shelters), we collect that location data only with your permission, which you can control through your device settings.

1.4 Cookies and Similar Technologies

We use browser storage and similar technologies to operate the Services and remember your preferences, and a Google component in our Android app measures its own use and performance (Section 3). See Section 7 (Cookies and Tracking) for details and your choices.

1.5 Animal and Behavioral Data

The Services store records about the animals managed by Organizations, including species, breed, age, medical and vaccination history, intake and outcome records, and behavioral assessments (for example, temperament evaluations, training notes, and compatibility with children or other animals). This animal data is generally not personal information about you. However, where animal records are linked to an identifiable person — such as a surrendering owner, adopter, foster, or veterinarian — the linked information is treated as personal information under this Policy.

1.6 Information From Other Sources

We may receive information about you from Organizations that use the Services (for example, when a shelter enters your adoption application) and from publicly available sources. We combine this with information we collect directly.

1.7 Trial and Demo Requests

When you ask for a ShelterSync trial or pilot through our website (www.mysheltersync.com), we collect your name, email address, phone number if you give one, your organization's name and approximate size, your role, the software or process you use today, anything you write in the message box, and a promotional code if you enter one, together with the version of this Policy you acknowledged, the time you sent the request, and a hashed form of your IP address. We use this to review the request, set up a trial organization if we approve it, and contact you about it. The website itself stores none of this; it is held on the ShelterSync platform. See Section 6.3 for how long we keep it.

2. How We Use Personal Information

We use personal information to:

• Provide, operate, maintain, and secure the Services;
• Create and administer accounts and authenticate users;
• Process payments, donations, and adoption or service fees;
• Facilitate adoptions, fostering, surrenders, and related communications between Organizations and End Users;
• Respond to inquiries and provide customer support;
• Send transactional messages and, where permitted, marketing communications you can opt out of;
• Monitor, analyze, and improve usage, performance, and features of the Services;
• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms; and
• Comply with legal obligations and enforce our agreements.

3. How We Share Personal Information

We do not sell your personal information for money. We share personal information as described below:

• Organizations: When you interact with an Organization through the Services, we share your information with that Organization.
• Service providers: With vendors who process information on our behalf — such as hosting, email and text-message delivery, and customer support — under contracts that limit their use of the information.
• Google, through parts of the Services it provides: Our Android app uses Google's ML Kit to scan barcodes. The scanning happens on your device. ML Kit sends Google information about the device and the app, such as the type of device, the app version, an identifier for that installation, and performance and error data. Google says it uses this for diagnostics and usage analytics. When you visit our websites, your browser fetches fonts from Google, which receives your IP address and browser details.
• Other users: Information you choose to share through collaborative or public features of the Services may be visible to other users or to the public.
• Legal and safety: When we believe disclosure is necessary to comply with law, respond to lawful requests, protect the rights, property, or safety of Zoolytix, our users, animals, or the public, or enforce our terms.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction or consent: When you ask us to share, or otherwise consent.

3.1 "Sales" and "Sharing" Under U.S. State Laws

Some U.S. state privacy laws define "sale" and "sharing" (for cross-context behavioral advertising) broadly enough to include certain uses of cookies and analytics or advertising technologies. To the extent our use of such technologies is considered a "sale" or "sharing," you may opt out as described in Section 6 and Section 7. We do not knowingly sell or share the personal information of individuals under 16.

4. Data Retention

We retain personal information for as long as needed to provide the Services, maintain your account, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and context; the periods we apply to each category are set out in Section 6.3. When information is no longer needed, we delete or de-identify it. Where Zoolytix acts as a processor for an Organization, retention is governed by that Organization's instructions and our agreement with it.

5. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

6. Your U.S. Privacy Rights (Including California)

Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable laws in other states. These rights may include:

• Right to know/access: To request the categories and specific pieces of personal information we have collected about you.
• Right to delete: To request deletion of personal information we collected from you, subject to exceptions.
• Right to correct: To request correction of inaccurate personal information.
• Right to opt out: To opt out of any "sale" or "sharing" of personal information and of certain targeted advertising.
• Right to limit: To limit the use of sensitive personal information to permitted purposes, where applicable.
• Right to non-discrimination: To not be discriminated against for exercising your rights.

To exercise these rights, contact us using the details in Section 10. We will verify your request, typically by confirming information associated with your account. You can also ask for a copy of your personal information from your profile in the ShelterSync web app, as described in Section 6.4. You may use an authorized agent to submit a request on your behalf, subject to verification. California residents may also request information about disclosures for direct-marketing purposes under California's "Shine the Light" law.

6.1 Categories Collected, Disclosed, and Their Purposes

The table below summarizes the categories of personal information (using CCPA/CPRA categories) we have collected and disclosed for a business purpose in the preceding 12 months.

CCPA Category	Collected	Disclosed for a Business Purpose To
Identifiers (name, email, IP, account ID)	Yes	Service providers; Organizations; Google (Section 3)
Customer records (phone, address)	Yes	Service providers; Organizations
Protected classification characteristics (age, from date of birth)	Yes	Service providers; Organizations
Commercial information (trial requests)	Yes	Service providers
Internet/network activity (usage, app diagnostics)	Yes	Service providers; Google (Section 3)
Inferences (preferences, usage patterns)	Yes	Service providers

6.2 What Deletion Means, and What We Keep

When you delete your account, or ask us to remove your information from a particular Organization, we anonymize your record rather than erase the underlying history. We destroy your password, PIN, sign-in sessions, registered devices, two-factor enrolment and one-time codes; we remove your name, email address, phone numbers, postal address, date of birth and profile photo, including the stored image itself; and your account can no longer be used or restored.

What remains is the Organization's own record of its animals. An entry recording that an animal was walked, fed, fostered or transported on a given date is the shelter's operational and animal-welfare record, which it may need or be required to keep. After deletion those entries name nobody: your name is not on them, and searching for you will not find them. Where a record notes that an account acted, it is the anonymized account — see the first exception below, which is the only thing that can put a name to one.

We cut off access immediately. The irreversible removal of your information completes within 30 days, and copies held in our encrypted backups expire within 35 days. The delay protects you: it means a stolen account cannot be used to destroy a shelter's records, and it gives you time to change your mind.

You can cancel during those 30 days. Signing in during that period will not restore the Services to you, but it will let you cancel the deletion and nothing else. We email you when a deletion request is accepted, and again before it becomes permanent, so a request you did not make does not pass unnoticed. Once the 30 days elapse the removal cannot be undone, by you or by us.

Five narrow exceptions. We keep the following despite a deletion request, and nothing else:

• Security accountability. Our audit trail records who made each change to a shelter's records. If every account could erase that link, deleting an account would become a way to hide a security incident or the misuse of an animal's records. We therefore retain, in encrypted form, enough information to identify who took a recorded action. It is held under an encryption key that the Services themselves cannot decrypt: no Organization, no user, and no part of the running platform can read it. Opening it requires a named individual at Zoolytix acting on a specific security incident, and every such access is recorded independently of us. It expires on the schedule below.
• The shelter's record of changes to its own information. So that a shelter can see how its records reached their current state, we store a copy of a record as it stood immediately before and after each change, together with the account that made the change. We do not rewrite those stored copies when an account is deleted, so a reference to your deleted account can remain inside them. The reference is to the anonymized account and names nobody: it cannot be used to identify you, and putting a name to it would require the encrypted record described above, on the same terms and for the same narrow purpose. We keep these copies for the reason above — a history of changes that anyone could edit out would not be a history — and because they are the shelter's own operational record of its animals' information, in the same way the care history is. Unlike the encrypted record, they carry no expiry and are not deleted on a schedule (Section 6.3).
• Safety and incident records. Where a record concerns an injury, a bite, or a similar safety incident, we retain it for as long as it may be needed, because those records may carry their own legal retention obligations. We will notify you if this applies to your request.
• Backups. Copies of your information persist in our backups until they expire, within 35 days.
• Billing and tax records. Where we hold financial records relating to a paying Organization, tax and accounting law requires us to keep them.

If you have an active responsibility — an animal currently in your foster care, or an activity you have started and not finished — we cannot complete your deletion until it ends, because an animal would otherwise be in a home with no record of who has it. We will notify you of exactly what is outstanding and who to contact.

If you cannot sign in, contact us in Section 10. We verify a request against the email address or phone number already on your account before acting on it, since a deletion we cannot undo must not be triggered by someone impersonating you.

6.3 How Long We Keep Information

Records about animals, and the care history attached to them, are kept for the life of the Service and are not deleted on a schedule. They are the shelter's welfare record, they support long-term reporting, and after a deletion request they carry no personal information about you. They are also kept so that an animal's history is still there should ShelterSync later offer a way to recognize an animal that has moved between shelters; the Service does not identify animals across shelters today.

Copies of records as they stood immediately before and after each change (Section 6.2) are kept with the shelter's own records and are not deleted on a schedule.

Trial and demo requests (Section 1.7) that do not become a trial organization — declined, withdrawn, or never approved — are kept for twelve months after the last change to the request, then deleted; a request that becomes a trial is kept as part of that organization's record. You can ask us to delete a request sooner at privacy@zoolytix.com.

Other categories are kept only as long as they are useful for the purpose that created them: security audit entries for seven years, with the details of each change removed after two years so that only which record was changed, by which account and when, remains; the encrypted record that identifies who took an action (Section 6.2) for two years; sign-in and security event records for twelve months; imported source files for 90 days after import; notifications for twelve months; and support and feedback submissions for two years after they are resolved. Operational system logs are kept for 30 days and backups for 35 days.

A copy of your information that you ask for (Section 6.4) is deleted after seven days; the copy kept in our file storage for recovery is removed shortly after that.

6.4 Getting a Copy of Your Information

You can ask for a copy of your personal information from your profile in the ShelterSync web app. You enter your password to confirm.

The copy covers your ShelterSync account (your account details, your sign-ins and your devices) and your records at the Organization you are signed in to. For another Organization you belong to, sign in there and ask there.

When the copy is ready, we email a link to the email address on your account. The email does not contain the copy. Open the link while you are signed in to ShelterSync at that Organization, and you get a download that works for five minutes. The link stops working seven days after we make the copy, and the copy is deleted after seven days. After that, you can ask again.

The copy is one file that you open in a web browser and can read. The same information is inside it in a machine-readable format (JSON). It does not include information about other people. It includes your profile photo and any screenshots you sent with feedback, up to 5 MB each and 15 MB in all. A file larger than that is listed instead, and you can ask us for it. If we cannot read a file when we make the copy, the copy says so.

The copy includes your own part of the Organization's records: what you did, when, and with which animal, and your check-in times. It leaves out two kinds of record that are the Organization's own:

• notes the Organization's staff wrote about you, such as the reason for a restriction;
• what you recorded about an animal, such as ratings, safety flags, notes and survey answers.

To ask for those, contact the Organization (see the Note on roles at the start of this Policy). The copy says the same.

If you ask us instead (Section 10), we check the request against your account before we act on it, and we send the link only to the email address on your account. If you cannot sign in to ShelterSync, the copy covers your account and your own part of the records at every Organization you belong or belonged to, including one that has restricted you, marked you inactive or removed you, and one that has closed. No copy includes anything an Organization recorded about you before your details were removed from it at your request (Section 6.2); records made there after that are included. The link we send works once, without signing in, and the copy is deleted after seven days.

7. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary: Required to operate the Services, such as authentication and security.
• Functional: Remember your preferences and settings.
• Analytics: Google's barcode scanner in our Android app sends Google diagnostics and usage data, as described in Section 3.

You can control cookies through your browser settings and our cookie banner or preference center where available. We honor recognized opt-out preference signals such as Global Privacy Control (GPC) where required by law. Note that disabling some cookies may affect how the Services function.

8. Children's Privacy

The Services are intended for users who are at least 13 years old. The Services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will take appropriate steps to delete it; if you believe a child under 13 has provided us personal information, please contact us. For users who are minors (13 to 17 years old), we encourage the involvement of a parent or guardian, and we do not knowingly sell or share their personal information, as described in Section 3.1.

Individual Organizations may set a stricter minimum age for their own users. Where an Organization does so, its own requirement applies to you in addition to this minimum.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice (such as by email or an in-product notice). Your continued use of the Services after the changes take effect constitutes acceptance of the updated Policy.

10. How to Contact Us

If you have questions, concerns, or requests regarding this Policy or your personal information, contact us at:

Zoolytix Inc. Attn: Privacy 2810 N Church St #216425, Wilmington, DE 19802 Email: platform@zoolytix.com

We will respond to requests within the timeframes required by applicable law.