Privacy Policy

Who we are

Angelica The Pet Sitter is a pet-care booking service operating in Malta. We connect pet owners with vetted sitters for live-in care, boarding, walks, visits, and wedding pet handling. We are the controller responsible for the personal data described in this policy.

Data we collect

We collect personal data in several categories depending on how you interact with us. We only collect what we need to provide our service safely and reliably.

Account information

When you register as a customer, we collect your full name, email address, phone number, home address, and (optionally) your occupation. This lets us create and manage your account, communicate with you about bookings, and - in the case of your address - facilitate live-in care or home-visit services.

Pet information

For each pet you add to your profile we collect the pet's name, species, breed, age, weight, and any relevant medical or vaccination notes you provide. You may also upload photos of your pet. This information is shared with the sitter assigned to your booking so they can provide appropriate care.

Booking data and special instructions

When you place a booking we collect the dates and times requested, the service type, any special instructions you provide (for example dietary requirements, medication schedules, or emergency contacts), and records of the booking's status as it progresses through our workflow.

Payment data

Payments are handled entirely by Stripe. When you pay for a booking you are taken to a Stripe-hosted checkout page. We do not see or store your card number, CVV, or other sensitive payment card details - Stripe processes these on their own infrastructure under PCI-DSS compliance. We do receive and store a Stripe payment-intent reference and the transaction outcome so we can manage invoicing and resolve disputes.

Sitter-applicant data

Individuals applying to become sitters on our platform provide additional data as part of our vetting process. This includes:

• A government-issued identity document (ID card or passport)
• A police conduct certificate
• Evidence of a valid first-aid certificate
• Professional or personal references
• Payout details (IBAN or Revolut handle) for service remuneration
• VAT number, where applicable

Vetting documents (ID, police-conduct certificate, first-aid certificate, and references) are used solely to assess applicants and are not shared beyond the people within our organisation responsible for sitter management. Payout details (IBAN or Revolut handle) are additionally shared with our invoicing provider, Zoho Books, to produce payment invoices - see “Who we share your data with” below.

Enquiries and messages

If you contact us via our enquiry form, by email, or via WhatsApp, we collect the content of your message and your contact details so we can respond. We retain records of communications that are relevant to an active or past booking.

Technical data

Our hosting provider (Vercel) and infrastructure partners may log your IP address and basic request metadata as part of normal server operation. We also set a small number of cookies - see the Cookies section below for detail.

How we use your data

We use the data we collect for the following purposes:

• Providing and coordinating bookings - to process your reservation, assign an appropriate sitter, and keep all parties informed as the booking progresses.
• Matching and vetting sitters - to ensure the person caring for your pet has been appropriately screened and is suited to your requirements.
• Taking payment - to collect the ATS Booking & Coordination Fee and the service fee via Stripe, and to issue invoices through Zoho Books.
• Communicating with you - to send booking confirmations, status updates, sitter updates (including photos and videos of your pet during their stay), and transactional notifications by email and WhatsApp.
• Keeping pets and people safe - to share necessary pet medical and care information with assigned sitters so they can respond appropriately in an emergency.
• Meeting legal and tax obligations - to maintain accurate financial records as required by Maltese law.
• Improving our service - to understand how the platform is used and resolve issues, without profiling individual users for marketing purposes.

Legal bases for processing

Under the General Data Protection Regulation (GDPR), we must have a legal basis for each type of processing. We rely on the following:

• Performance of a contract - the majority of our processing is necessary to fulfil the booking contract between you and us, or to take steps at your request before entering into that contract.
• Your consent - where we send optional marketing communications, we rely on your explicit opt-in consent. You can withdraw consent at any time by updating your preferences in your account settings or by emailing us.
• Our legitimate interests - we may process data where it is in our legitimate interests to do so (for example, to detect and prevent fraud, or to improve the reliability of our service), provided those interests are not overridden by your rights.
• Compliance with a legal obligation - we process data where we are required to do so by law, such as retaining financial records for tax purposes.

Who we share your data with

We do not sell your personal data to third parties under any circumstances. We share data only in the ways described below.

Assigned sitters

When a sitter is confirmed for your booking, they receive the booking details and the pet information needed to deliver care - such as your pet's name, breed, medical notes, and the address of the service location. Sitters do not receive your payment information, and they do not have access to data about other bookings or customers.

Service providers (data processors)

We use a small number of trusted third-party providers who process personal data on our behalf under data-processing agreements. These are:

• Stripe - payment processing. Stripe is PCI-DSS compliant and handles all card data directly. We do not store card numbers.
• Resend - transactional email delivery (booking confirmations, password resets, status notifications).
• Uploadthing / Cloudflare R2 - secure cloud storage for user-uploaded files such as pet photos, vaccination documents, and sitter identity documents.
• Neon - managed PostgreSQL database hosting where your account and booking data is stored.
• Vercel - application hosting and edge delivery. Vercel may log IP addresses and request metadata as part of normal infrastructure operation.
• Twilio - WhatsApp message delivery for booking notifications and sitter updates sent via WhatsApp.
• Zoho Books - invoice generation and delivery. We share the billing details needed to produce a formatted invoice PDF.

Each of these providers is engaged under a contract that restricts them to processing data only for the purposes we specify.

International transfers

Some of our service providers operate infrastructure outside the European Union and European Economic Area. Where personal data is transferred to a country that does not have an adequacy decision from the European Commission, we ensure that appropriate safeguards are in place - typically the European Commission's Standard Contractual Clauses (SCCs). You may request more information about the safeguards applicable to a specific transfer by contacting us at hello@angelicathesitter.com.

How long we keep your data

We keep your personal data for as long as your account is active or as needed to provide you with our services. If you request deletion of your account, we will soft-delete your data (making it invisible in the application) and then permanently remove it in accordance with our internal retention schedule.

Some data may be retained for longer where we are required to do so by law. For example, financial records and invoices are retained for at least five years to comply with Maltese tax and accounting obligations. Sitter vetting documents may be retained for up to two years after the sitter relationship ends in case of any dispute.

Data that is no longer needed for any lawful purpose is deleted securely.

Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access - you may request a copy of the personal data we hold about you.
• Right to rectification - you may ask us to correct inaccurate data or complete incomplete data.
• Right to erasure - you may ask us to delete your data where there is no longer a legal basis for us to hold it.
• Right to data portability - you may request your data in a structured, machine-readable format so you can transfer it to another service.
• Right to restriction - you may ask us to restrict processing of your data in certain circumstances, for example while we investigate a dispute.
• Right to object - you may object to processing based on our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent - where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please email us at hello@angelicathesitter.com. We will respond within one month. If you are not satisfied with our response, or if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Maltese Information and Data Protection Commissioner (IDPC). The IDPC can be reached at idpc.org.mt.

Cookies

We use a minimal set of cookies. We do not use any analytics cookies, advertising cookies, or marketing/tracking cookies of any kind. We do not share cookie data with advertising networks.

The cookies we set are:

• Auth.js session cookie - an essential, secure, HttpOnly cookie that keeps you signed in. It is set when you log in and expires after 30 days of inactivity. Without it, the authenticated parts of the site cannot function.
• ats_cookie_consent - a small preference cookie that records that you have acknowledged the cookie notice, so we do not show it to you again. It contains no personal data.
• Cloudflare Turnstile cookies - when our anti-spam captcha verification is enabled (for example on the sitter application form), Cloudflare Turnstile may set cookies to verify that you are human. These are functional cookies required for the form to operate and are not used for tracking.

Because all cookies we use are strictly necessary or functional, we do not require your consent to set them under the ePrivacy Directive. We do, however, inform you of their presence via our cookie notice.

Children

Our services are intended for adults. Customers must be at least 18 years old to create an account and make a booking. Sitters must also be at least 18 years old to apply to join our platform. We do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us with personal data without appropriate parental consent, please contact us and we will delete it promptly.

How we protect your data

We take security seriously and apply appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

• All data in transit between your browser and our servers is encrypted using HTTPS (TLS).
• Sensitive data at rest - such as sitter payout details - is encrypted in the database.
• Access to personal data within our organisation is restricted to those who need it to carry out their responsibilities.
• We use managed infrastructure providers (Neon, Vercel) that maintain industry-standard security practices including encryption at rest, automated backups, and access controls.
• Passwords are stored as one-way hashes (bcrypt) - we cannot retrieve your password.

Despite these measures, no system is completely secure. If you have reason to believe that your interaction with us has been compromised, please contact us immediately.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. When we make material changes we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

If changes are significant, we may also notify you by email or via a notice on the platform. Your continued use of Angelica The Pet Sitter after any changes take effect means you have had the opportunity to review the updated policy; where we rely on your consent for a specific use, we will ask for it again rather than assume it from continued use.

Contact us

If you have any questions about this Privacy Policy, would like to exercise any of your data-protection rights, or wish to make a complaint, please contact us at:

hello@angelicathesitter.com

We aim to respond to all data-protection requests within one calendar month. If you are not satisfied with our response, you may escalate your complaint to the Maltese Information and Data Protection Commissioner (IDPC) at idpc.org.mt.