Privacy

Data controller

Clevo AS is the data controller for Potepass. Questions about privacy go to hei@potepass.no.

Data we process

App lock with Face ID or fingerprint happens only on your phone. We never receive biometric data.

• Account: email and name.
• Your pet: details, treatments, weight and symptoms.
• Photos and documents you upload, and the fields read from them, such as date, clinic and treatment. We do not store the full text from the photo. The photo itself may include your name and address.
• Mobile number when you transfer a pet, and family members you invite.
• Breeder profile: kennel name, municipality, breeds and NKK or NRR registration number.
• Share log: when a share was opened, not who opened it.
• A key for push notifications to your phone.
• Subscription status. We never see card details.
• Email on the waiting list, with consent.
• Technical logs at the hosting provider, such as IP address and time, for security.

Purpose and legal basis

• Health record, reminders, sharing and subscription: contract with you (GDPR art. 6(1)(b)).
• Reading with artificial intelligence, waiting list and push notifications: consent (art. 6(1)(a)).
• Security and logging: legitimate interest (art. 6(1)(f)).
• Accounting: legal obligation (art. 6(1)(c)).

Reading with artificial intelligence

When you scan a document, the photo is sent to Google (Gemini) through Lovable AI Gateway. We only store the fields that are read, not the full text. This only happens after you consent in the app. You can withdraw consent under Me.

The reading only gives suggestions that you check. No automated decisions with legal effect are made about you.

Processors

The database and files are stored in the USA (AWS, region us-east-1).

Transfers to the USA rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU standard contractual clauses.

• Lovable: hosting of the website, database and file storage (provided through Supabase), email sending and Lovable AI Gateway.
• Google (Gemini, through Lovable AI Gateway): reading photos.
• Expo (650 Industries): sending push notifications.
• Apple and Google: subscription payment and delivery of notifications to your phone.
• RevenueCat: subscription status.

Who sees the data

You, the people you share with, family members you invite, and a new owner on transfer. Only approved breeder profiles are public.

Retention

• As long as you have an account.
• Transfer codes expire after 7 days.
• When you delete your account, data is deleted from the database straight away, and from backups within 30 days.
• Accounting records of purchases are kept as long as the Bookkeeping Act requires, up to 5 years.
• Waiting list: until you unsubscribe.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object. You can withdraw consent at any time. Write to hei@potepass.no and we reply within 30 days.

If you believe we process data unlawfully, you can complain to the Norwegian Data Protection Authority at datatilsynet.no.

Children

The service is not aimed at children under 13.

We never sell data

We do not sell personal data or your pet's data, and do not use it for advertising.

Cookies

The website only uses necessary cookies and necessary storage. The list is on the Cookies page (potepass.no/informasjonskapsler, in Norwegian).

Security

• Encrypted transfer.
• Access rules in the database.
• Private storage buckets for files.
• Share links that expire.
• Keys on the phone are stored in Keychain and Keystore.

Changes to this policy

We update this policy when the processing changes. We give notice of significant changes in the app or by email.