My Little FiFi is an app for keeping your pet’s profile, health records, reminders and documents in one place. This policy explains what information is collected, why, the legal basis for it, and the rights you have. It is written in plain language, but every element required by Article 13 of the GDPR is included.
1. Who we are (data controller)
My Little FiFi is operated by a single individual — a natural person, not a company. The data controller is Umair Hassan, operating as My Little FiFi, Mechelen, Belgium. You can reach the controller about privacy at contact@mylittlefifi.com.
Being a sole operator is not an exemption: the GDPR requires the controller’s identity and contact details whether the controller is an individual or a company.
2. What we collect
- Account data — your name, email and avatar received from Google or Apple sign-in, and an account identifier. There are no password accounts.
- Pet data — name, species, breed, sex, birth and adoption dates, colour, microchip number, spay/neuter status, allergies, notes and photos.
- Health data about the animal — records, vaccinations with dates, medications and the weight log.
- Uploaded documents and attachments — files and images you add. These may contain personal data about you and about third parties such as vets, clinics or insurers. Please only upload documents you are entitled to store.
- Reminders, diet plans and notification schedules you create.
- Caregiver data — invite labels, roles, access windows and redemption records for the people you share a pet with.
- Device and push notification tokens, used to deliver notifications.
- Subscription status received from Apple or Google. Card and payment details are handled by the app stores and no card details ever reach us.
- Diagnostic and aggregate usage data to keep the app working and improve it.
- Support messages you send us by email.
3. Legal bases
We rely on the following legal bases under Article 6 of the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the core app — profiles, records, reminders, subscriptions and caregiver sharing | Performance of a contract (Art. 6(1)(b)) |
| Keeping the service secure and preventing abuse; understanding and improving how the app works | Legitimate interests (Art. 6(1)(f)) |
| Push notifications, any marketing email, and any non-essential analytics | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Keeping tax and accounting records for subscriptions | Legal obligation (Art. 6(1)(c)) |
4. Caregiver sharing
When you share a pet, the person you invite can see that pet’s data according to their role (Viewer or Contributor). You set the access and can revoke it at any time. Invite codes are time-limited, and there is a limit of five caregivers per pet. When someone redeems your invite, their own account identity (for example their name) becomes visible to you as the owner, and your pet’s data becomes visible to them for as long as access lasts.
5. Who we share data with
We use a small number of trusted providers (processors) to run the service. We do not sell personal data and we do not share it with advertisers.
| Processor | Purpose |
|---|---|
| Supabase | Database, authentication, file storage, edge functions |
| Namecheap | Website hosting and email |
| Apple | Sign in with Apple, App Store billing, push notifications (APNs) |
| Google Sign-In, Google Play Billing, push notifications (FCM) |
6. International transfers
Namecheap Inc. is a company based in the United States. Because our website hosting and email run on Namecheap, some personal data — support messages and account-deletion requests you send by email — is transferred to and stored in the United States. That transfer relies on the European Commission’s Standard Contractual Clauses (SCCs) as its safeguard.
Your pet and account data is configured to be stored on EU infrastructure (an EU region). Apple and Google may also process limited data (sign-in, billing and push tokens) outside the European Economic Area under an adequacy decision or the SCCs.
7. Retention
- Account and pet data is kept until you delete it, with a short backup window afterwards.
- Diagnostic logs are kept for a limited number of days.
- Billing and tax records are kept for the period required by law.
The exact backup window and log retention are set in our operational configuration; contact us if you need the current figures.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data erased;
- restrict how we process your data;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time (for example, push notifications or marketing email);
- not be subject to a decision based solely on automated processing — we do not make such decisions.
Most of these you can exercise directly in the app; for anything else, email contact@mylittlefifi.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.
9. Deleting your account
You can delete your account in the app at Profile → Edit Profile → Delete account. Deletion is permanent — it is not a deactivation. If you no longer have the app installed, see our data deletion page for a route that works without reinstalling, and for exactly what is removed and what is kept.
10. Security
Data is encrypted in transit and at rest. The database uses row-level security so that only you and the caregivers you choose can reach your records. Documents live in a private storage bucket reachable only through short-lived signed URLs, and access to systems follows the principle of least privilege.
11. Children
You must be at least 16 to create an account. If we learn that an account belongs to someone younger, we will delete it.
12. Cookies and website analytics
This website uses only what is strictly necessary to serve the pages. Fonts are self-hosted, so there are no external font requests. We do not set advertising or cross-site tracking cookies. Your theme and language choices are remembered only in your own browser (local storage) and are never sent to us. If we later add non-essential cookies or analytics, we will ask for your consent first through a banner, with rejecting made as easy as accepting.
Consistency with the app stores
We keep this policy consistent with the App Store privacy “nutrition” labels and the Google Play Data Safety declarations for the app.
13. Changes and contact
We may update this policy from time to time. We will revise the “last updated” date above and, for significant changes, let you know in the app. Questions? Email contact@mylittlefifi.com.