Privacy Policy

1. Who we are and what this policy covers

My Dog Rules is operated by Estate Wise Limited (Company No. 9374111) ("we", "us", "our"). We are the agency responsible for your personal information under the Privacy Act 2020, and this policy explains how we collect, use, store, disclose, and protect it when you use the My Dog Rules website and web application (the "Service"). We've written it to comply with the Privacy Act's thirteen Information Privacy Principles (IPPs) — and to be actually readable.

In plain English: We collect what we need to run My Dog Rules and nothing more, we don't sell your data or run third-party ad trackers, and you can see, correct, or delete what we hold. Your data is hosted in Sydney, Australia, with some processing in the US — all under contractual safeguards.

2. The information we collect

2.1 Information you give us

• Account details: your email address, first name, and password. Passwords are handled by our authentication provider and stored on the server only as a secure cryptographic hash — we cannot see them. If you sign in with a social provider such as Google, Facebook, or Apple (where offered), that provider shares your name, email address, and a provider identifier with us — we request the minimum information only.

• Profile details: your name, contact phone number, and address details if you add them and notification preferences.

• Your dogs: each dog profile you create — name, breed, colour, gender, neuter status, age, microchip number, council tag number, and photos. Microchip and tag numbers are persistent identifiers, so we treat dog profiles as personal information linked to your account. Creating a dog profile is an optional feature.

• Reviews and photos: Any ratings, tags, comments, or photos you share about dog spaces are displayed publicly to help the community, but they will always be attributed simply to a "Visitor." We keep your actual identity securely hidden in our system and never display it to the public.

• AI chat messages: questions you send to the behaviour and nutrition assistants. Please don't put sensitive personal information in chat — it's built for dog questions, and it's best kept that way.

• Lost-dog reports: if you report your dog lost, we collect the details needed for the action plan — including the time missing, the last-seen location, and your contact phone number (pre-filled from your profile) so you can be reached if your dog is found.

• Subscription and billing: payments are handled by Stripe on its own secure, hosted checkout — your card number never touches our servers. We store only your Stripe customer and subscription identifiers, plan, and subscription status.

2.2 Location information — what's used in the moment and what's stored

Location is central to a dog-walking app, so here is exactly how we handle it:

• Permission first, always: we only access your device's precise location if you grant permission through your browser's prompt. If you decline, everything still works — you just search or drop a pin manually.

• Used in the moment: your precise position is used in your session to centre the map, find parks/venues near you, detect your local council, and power "near me" actions. We do not keep a running history of your precise movements.

• What is stored: (a) if you report a dog lost, the last-seen location you provide is saved — that's the point of the feature; (b) our analytics record rounded (approximate) coordinates with venue interactions — deliberately imprecise so they indicate an area, not your exact position (see 2.3).

• Photos: uploaded review photos are re-encoded and stripped of embedded location (EXIF/GPS) data before publication, so your photos don't reveal where they were taken beyond what's visible in the image.

2.3 Information we collect automatically

• Usage and interaction analytics: we log interactions with venues and features (for example, viewing a location or venue) together with a session identifier, your user identifier, and rounded coordinates. We use this first-party data to understand what's useful and where — for example, product improvement and marketing heat-maps. We do not use third-party advertising trackers or cross-site cookies, we don't sell this data, and we don't use it for automated decisions that have legal or similarly significant effects on you. If you'd prefer your signed-in activity excluded from behavioural analytics, you can opt out by emailing us at support@mydogrules.co.nz.

• Technical and security data: IP address, browser and device type, and request logs — used to run and secure the Service, including per-IP rate limiting to prevent abuse and scraping. IP data used for rate limiting is held transiently.

• Sign-in records: we record sign-in and sign-out timestamps on your profile as a standard security measure.

• Offline caching: if you install the app or use it offline, some static location and map data are cached on your own device. We never cache your account, billing, or authenticated data this way, and nothing extra leaves your device because of it.

2.4 Aggregated and anonymised information

We aggregate usage data to see patterns — most-viewed parks, most-searched rules, popular features. Once aggregated and anonymised so it can no longer identify you, it stops being personal information, and we may use and share it freely (for example, "the 10 most-searched dog parks in Auckland"). We design aggregation so individuals cannot be re-identified.

3. How we use your information

We collect and use personal information only for purposes connected with running My Dog Rules:

• Providing the Service: accounts, the map and rules, venues, reviews, dog profiles, lost & found tools, and personalisation;

• Processing subscriptions, free trials, payments, and refunds;

• Answering your AI chat questions (see section 5);

• Product and marketing analytics, as described in section 2.3;

• Communicating with you: service messages, support replies, and — only if you opt in — product news (unsubscribe any time);

• Keeping the Service safe: rate limiting, abuse and fraud detection, content moderation, and security monitoring; and

• Meeting our legal obligations.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

4. Reviews, photos, and content moderation

• Public, but pseudonymous: your reviews and photos are shown publicly credited only as "visitor". The link to your account is kept server-side under strict access controls.

• Private until clean: uploaded photos go first to private storage and are screened by an automated safety service before anything is published. A photo becomes public only after it passes screening — there is no public window beforehand. Photos are also re-encoded and stripped of embedded location metadata.

• People in photos: photos of public places can incidentally capture people. If you appear in a photo on the Service and want it removed, email support@mydogrules.co.nz and we'll review it promptly.

5. AI features and your information

When you use the behaviour or nutrition assistant, the text of your question is sent to our AI provider to generate the answer. If you use spoken playback, the AI-generated answer text (not your personal details) is sent to our text-to-speech provider. These providers process the content to deliver the feature — not to build a profile of you — and are bound by contractual data-protection terms. Some content elsewhere in the Service (such as rule summaries and safety notes) is also produced with AI assistance from public source documents; that processing doesn't involve your personal information.

6. Who receives your information — our service providers

We share personal information only with the service providers we need to run the Service, described here by category. We keep a current list of the individual providers behind each category, and you can request it at any time by emailing support@mydogrules.co.nz.

Three clarifications. First, external sites you choose to publish to — for example a lost-pet listing service or a social network when you share a poster — are your chosen destinations, not our service providers: what you post there is governed by their terms, and once shared it leaves our control. Second, information our providers hold on our behalf solely for storage or processing is treated under section 11 of the Privacy Act 2020 as held by us, and they may use it only to provide services to us. Third, we may disclose personal information to New Zealand authorities, regulators, or law enforcement where the disclosure is required or permitted by law — for example, reporting suspected illegal content to the Department of Internal Affairs, or responding to a lawful request. Providers may change as the Service evolves; the categories, countries, and safeguards described here will stay accurate, and material changes will be notified under section 15.

6.1 Overseas disclosure

To run our platform, your personal information is stored and processed outside of New Zealand:

• Primary Storage (Australia): Your account, profile, dog details, subscription status, and uploaded photos are securely stored in Sydney, Australia.

• Global Processing: As outlined in the table above, our payment, hosting, mapping, AI, and security providers operate globally, including in the United States.

• Our Privacy Safeguards: We only share your data with overseas providers when we are confident they offer privacy protections comparable to the New Zealand Privacy Act 2020 (such as Australia’s Privacy Act 1988) or are bound by strict data-protection contracts.

• Your Consent: By signing up, you agree to this overseas processing. If we ever need to use a new provider that cannot guarantee these comparable safeguards, we will always ask for your explicit authorization first.

In plain English: Your data lives in Sydney, Australia. Payments (Stripe), hosting, maps, AI, and security processing involve US/global providers. Every provider is contractually required to protect your information to NZ-comparable standards, and the current provider list is available on request.

7. How we keep your information safe

• Encryption in transit (HTTPS/TLS) for all connections;

• Passwords handled by our authentication provider and stored server-side only as secure hashes;

• Row-level security and least-privilege access controls, so accounts can only ever read and write their own records — including dog profiles and review authorship;

• Card payments handled exclusively on Stripe's PCI-DSS-compliant hosted checkout — card numbers never reach our servers;

• A private-until-clean pipeline for user photos, with automated screening before publication; and

• Per-IP rate limiting and abuse detection.

No system is perfectly secure, but we take reasonable and proportionate steps to protect your information against loss, misuse, and unauthorised access.

8. How long we keep information

• Account, profile, and dog data: kept while your account is active; deleted when you delete your account (see section 9).

• Billing and transaction records: retained for approximately 7 years to meet New Zealand tax and record-keeping law (Tax Administration Act 1994 and GST legislation). Stripe also retains transaction records under its own legal obligations as an independent controller.

• Reviews and review photos: retained after account deletion, as public contributions displayed without your name (see section 9). Note you can edit or delete any of your contributions at any time prior to account deletion via the edit review feature.

• Lost-dog reports: kept while relevant, and deleted with your account.

• Security and rate-limiting data (IPs): held transiently and for short retention periods, for security purposes only.

• Content preserved for legal reasons: material we are required or permitted to preserve by law — for example, suspected illegal content quarantined under the Films, Videos, and Publications Classification Act 1993, or records subject to a lawful preservation request — is retained for as long as the law requires, and may be provided to New Zealand authorities.

• Aggregated statistics: kept indefinitely — they no longer identify anyone.

9. Deleting your account — what goes and what stays

You can delete your account yourself at any time from account settings. Honesty matters more than tidiness here, so precisely:

• Deleted: your profile, your dog profiles, your dog photos, your lost-dog reports, your sign-in identity, and our copy of your subscription record. Any active Premium subscription is cancelled as part of deletion, so you won't be charged again.

• Retained — tax records: billing and transaction records are kept for ~7 years as the law requires (section 8).

• Retained — public contributions: review text and review photos remain on the Service after deletion. They are displayed without your name (credited as "visitor"), and the licence you grant us for them survives deletion, as our Terms explain. If you'd like specific reviews or photos removed as well, tell us when you delete your account (or any time) and we'll action it.

• Retained — legal holds: content that we are required or permitted by law to preserve — including suspected illegal material that has been quarantined, and anything subject to a lawful preservation or production request — is retained and may be disclosed to New Zealand authorities notwithstanding a deletion request. Quarantined material is never publicly visible.

• Anything shared externally: posters or posts you published to other platforms are outside our control and are not affected by deleting your My Dog Rules account.

10. Cookies and local storage

We use essential cookies and local storage for login sessions and security — the Service can't work without them — plus first-party analytics as described in section 2.3. We don't use third-party advertising cookies, and no cookie-consent banner is required under New Zealand law for this setup. You can control cookies in your browser; blocking essential ones will stop you staying signed in. The app's offline cache (section 2.3) also lives on your device and can be cleared through your browser at any time.

11. Your rights

• Access: ask us to confirm whether we hold personal information about you, and to see it. You can also view and edit most of it directly in your account settings.

• Correction: correct your details yourself in the app, or ask us to correct anything else; if we don't agree to a correction, you can require a statement of correction to be attached.

• Deletion: delete your account yourself, or ask us to (subject to section 9).

• Opt-outs: unsubscribe from non-essential communications, and opt out of behavioural analytics, at any time.

To exercise any right, email support@mydogrules.co.nz. We'll respond as soon as practicable and no later than 20 working days after receiving your request, as the Privacy Act requires. We may need to verify your identity first — that's to protect you. There's no charge.

12. Children

The Service is intended for adults aged 18 and over, and we ask you to confirm your age at signup. We don't knowingly collect personal information from anyone under 18, and we don't market the Service to them. If you believe anyone under 18 has created an account, contact us and we'll delete it.

13. If something goes wrong — privacy breaches

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, as Part 6 of the Privacy Act 2020 requires — telling you what happened, what information was involved, and what we're doing about it. You can always reach us about a privacy concern at support@mydogrules.co.nz.

14. Complaints

If you're unhappy with how we've handled your personal information, please contact us first — we'll investigate promptly and take it seriously. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner: www.privacy.org.nz, 0800 803 909, PO Box 10094, Wellington 6143.

15. Changes to this policy

We'll update this policy as the Service and the law evolve — including keeping the provider categories, countries, and safeguards in section 6 accurate. For material changes we'll notify you by email or in-app notice before they take effect. The date at the top always tells you the current version.

How to contact us

Questions, feedback, or a wagging complaint? We would genuinely like to hear from you.

• Company: Estate Wise Limited (Company No. 9374111), trading as My Dog Rules

• Email: support@mydogrules.co.nz

• Phone: +64 21 205 6078

• Address: 123 Grovenor Drive, Orewa, Auckland, New Zealand