Privacy Policy

Version 2.0 · Effective 16 September 2026

This Privacy Notice explains how Petba ("Petba", "we", "us", "our") collects, uses, shares, stores and deletes your personal data when you use the Petba website (petba.in), the Petba mobile app, the vendor and service-provider portals, and the Petba delivery partner app (together, the "Services"). It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, and it is also our privacy policy under Section 43A of the Information Technology Act, 2000 and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). For personal data you give us, we are the Data Fiduciary.

1. Who we are (Data Fiduciary)

Haztech Innovation LLP (trading as "Petba")
Registered address: Flat No 1, 5th Floor, Dalal Complex, Margao, South Goa, Goa 403601, India
Email: info@petba.in
Website: https://petba.in

2. Grievance Officer

If you have a question, complaint or request about your personal data, contact our Grievance Officer:

Name: TODO_GRIEVANCE_OFFICER_NAME
Designation: Grievance Officer
Email: TODO_GRIEVANCE_OFFICER_EMAIL
Phone: TODO_GRIEVANCE_OFFICER_PHONE

We will acknowledge your grievance within 48 hours and resolve it within one month (30 days) of receiving it. If we need more information to verify your identity, we will tell you, and the period runs from when we receive it.

3. Who can use Petba

The Services are only for people who are 18 years of age or older. When you create an account (by email, Google Sign-In, at checkout, or as a vendor) you confirm that you are 18 or older. We do not knowingly collect personal data of anyone under 18 and we do not track, behaviourally monitor or target advertising at children. If we learn that an account belongs to a person under 18, we will close it and delete the associated personal data. If you believe a child has given us personal data, please contact the Grievance Officer.

4. Personal data we process

  • Account data: name, email address, mobile number, password (stored only as a one-way hash), customer group, account status, newsletter choice, and your consent records (what you agreed to, which version, when, and from which IP address).
  • Google Sign-In profile: if you choose "Continue with Google", Google shares your name, email address, email-verified status and (in the app) profile picture. We never receive your Google password.
  • Addresses and location: delivery and billing addresses, pincode, city, district and state; and, only when you tap "Use my location" or allow location in the app, your device’s GPS coordinates to find serviceable stores, services and pets near you.
  • Orders and payments: products ordered, order history, invoices, returns and delivery status. Payments are handled by Razorpay. We do not collect or store your card number, CVV, UPI PIN or net-banking password; we only receive a payment reference, status and amount from Razorpay.
  • Bookings and appointments: the service booked (grooming, veterinary, training, boarding, foster), date and time, provider, notes you add, and payment status.
  • Your pets: pet name, species, breed, age or date of birth, gender, weight, colour, photos, vaccination dates, and other health notes you add.
  • Pet health and device telemetry: if you pair a Petba-compatible pet device, readings sent by the device (such as activity, temperature or location readings) and device identifiers.
  • Rescue reports: photos, description and condition of the animal, and the GPS location and address where the animal was found, together with your account as the reporter.
  • Adoption listings and inquiries: the pet details and photos you list, and the contact name, phone number and email you choose to show on the listing; and, when you express interest in a pet, your name and contact details shared with the lister.
  • Chat messages and media: messages, images and files you send to other users, shelters or providers through in-app chat, with timestamps and read status.
  • Notifications: push notification (Firebase Cloud Messaging) device tokens and your notification preferences.
  • Technical data: IP address, device type, operating system, app version, browser, session and security cookies, login history and security logs.
  • Vendor and service-provider data: business and store name, contact email and phone, store address, pincode and GPS location, GST number, store verification photos and documents, identity and licence documents, service listings, and payout details (UPI ID or bank account number, IFSC and account holder name).
  • Delivery partner data: name, phone, email, driving licence and identity (KYC) documents (we ask for a masked Aadhaar), vehicle details, availability, earnings and payouts, and location pings while on an active delivery.

5. Sensitive personal data (IT Act, 2000 and SPDI Rules, 2011)

Some of the data in section 4 is "sensitive personal data or information" under the SPDI Rules. This is what we handle, why, and how we protect it:

  • Passwords: used only to sign you in. They are stored only as a one-way hash and cannot be read by anyone at Petba.
  • Financial information: the payout UPI ID or bank account number, IFSC and account holder name of service providers and vendors, used only to pay them. It is stored encrypted, shown back only in masked form, and shared only with our payout processor Razorpay (RazorpayX) to make the payout. Delivery partners’ bank proof images are part of their encrypted KYC documents. We never collect or store customers’ card numbers, CVV, UPI PIN or net-banking passwords; card and UPI payments are handled by Razorpay.
  • What we do not collect: biometric information, sexual orientation, or information about your own physical, physiological or mental health or medical records. Health notes and records in Petba are about your pets, not about you.

We collect sensitive personal data only with your consent, given in writing (electronically) at the point you provide it, only for the lawful purpose stated above, and only where it is necessary for that purpose. We keep it only as long as that purpose or the law requires (section 11). You can review and correct it at any time (section 12).

Choosing not to provide information: you may choose not to give us any personal data or sensitive personal data, and you may withdraw consent you have given (section 8). If you do, we may be unable to provide the service that needs it; for example, we cannot make payouts without payout details, or verify a vendor, provider or delivery partner without the required documents.

6. Why we use it (purposes)

  • To create and secure your account, verify your email by OTP, and let you sign in (including with Google).
  • To show products, services, pets and stores that can serve your pincode or location.
  • To take, deliver and support your orders and bookings, process payments and refunds, and issue invoices.
  • To run pet adoption, foster and rescue features: publishing listings, routing rescue reports to nearby helpers, and connecting adopters with listers.
  • To deliver chat messages and send service notifications (order, booking, delivery, reminder and chat alerts).
  • To send marketing emails or offers, only if you opted in.
  • To verify and pay vendors, service providers and delivery partners.
  • To prevent fraud and abuse, keep the Services secure, and investigate incidents.
  • To meet legal obligations, such as tax, accounting and CERT-In log retention, and to respond to lawful requests.

7. Legal basis: consent and legitimate uses

We process your personal data on the basis of your consent, given when you create an account and accept this notice, when you opt in to marketing, or when you allow location or notifications. Your consent is specific to the purposes above and is recorded with the policy version and time.

Some processing is for legitimate uses permitted by Section 7 of the DPDP Act without separate consent, for example: using data you voluntarily provided for the purpose you gave it (such as your delivery address for your order), complying with law or a court order, responding to a medical emergency or threat to life, and keeping records we are required to keep for tax or accounting purposes.

8. Withdrawing consent

You can withdraw consent at any time, and withdrawing is as easy as giving it:

  • Marketing: untick "Subscribe" in My Account > Newsletter on the website, use the unsubscribe link in any marketing email, or switch marketing off in the app under Settings > Privacy & your data.
  • Location and push notifications: switch them off in the app or in your device settings. Push can also be switched off in Privacy & your data, which deletes your push tokens from our servers.
  • Everything else: delete your account (see section 12). Withdrawal does not affect processing that happened before it, and we may keep data we are legally required to keep (section 11).

9. Who we share it with

We do not sell your personal data, and we do not publish sensitive personal data. We disclose it only with your consent, as described below, or where the law requires it. Our processors may use it only on our instructions, and everyone we share it with must protect it with at least the same level of data protection as this notice:

  • Vendors and service providers fulfilling your order or booking receive your name, contact details, delivery address and the details of what you ordered or booked.
  • Petba delivery partners receive only your name, phone number and delivery address, and only for the delivery they are actively carrying out.
  • Razorpay (payment processing, and RazorpayX payouts to service providers and vendors using their payout details).
  • Google (Google Sign-In; Google Maps links where you use them).
  • Firebase / Firebase Cloud Messaging (Google) (push notifications and chat authentication).
  • Hostinger (SMTP email delivery for OTPs, order and account emails).
  • OpenStreetMap Nominatim (turning map coordinates into an address, and address search, only when you use the map or "Use my location").
  • Cloudflare (content delivery and security, and encrypted off-site backups on Cloudflare R2 / S3-compatible storage).
  • Adoption and rescue community: the pet details, photos, approximate location and the contact details you choose to publish on a listing are visible to other users.
  • Authorities: when required by law, court order or a lawful request from a government agency, or to protect life or safety.

10. Transfers outside India

Some processors (for example Google, Firebase and Cloudflare) may store or process data on servers outside India. We transfer personal data only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and we require these processors to protect it with safeguards at least as strong as this notice.

11. How long we keep it (retention)

  • Account, profile, addresses, pets and preferences: while your account is active. After you ask us to delete your account there is a 30-day grace period in which you can cancel by signing in; then the data is deleted.
  • Orders, invoices and payment records: kept for 8 years as required by tax and accounting law, with your name, contact and address details anonymised once your account is deleted.
  • Chat messages and media: until you delete your account; your messages are then removed or anonymised.
  • Security, login and server logs: 180 days.
  • Delivery location pings: 30 days.
  • OTPs and password-reset codes: deleted within 1 day.
  • Consent records: kept in pseudonymised form as proof of consent after account deletion.
  • Backups: deleted data may remain in encrypted backups until those backups expire on their normal rotation.

12. Your rights and how to use them

  • Access and export: get a summary and a copy of your personal data.
  • Correction and completion: fix or update inaccurate or incomplete data.
  • Erasure: ask us to delete your personal data, subject to the legal retention above.
  • Withdraw consent: see section 8.
  • Grievance redressal: complain to our Grievance Officer (section 2).
  • Nomination: nominate another person to exercise your rights if you die or become incapacitated, by writing to the Grievance Officer with the nominee’s name and contact details.

How to exercise them:

  • In the app: Settings > Privacy & your data (download my data, marketing and push switches, delete account).
  • On the website: My Account (edit details, addresses, newsletter, Delete my account) and the Data request (GDPR) page to request an export or deletion by email confirmation, which also works for accounts created with Google.
  • By email: write to the Grievance Officer at TODO_GRIEVANCE_OFFICER_EMAIL.

We may need to verify your identity before acting on a request. We do not charge for these requests.

13. Complaints to the Data Protection Board of India

You should first contact our Grievance Officer. If you are not satisfied with our response, or we do not resolve it within one month (30 days), you can complain to the Data Protection Board of India (https://www.dpb.gov.in).

14. Security and breach notification

We protect personal data with reasonable security practices and procedures under Rule 8 of the SPDI Rules. We follow a documented information security programme and policies aligned with the international standard ISO/IEC 27001, covering risk assessment, access control, incident response and review. Safeguards include encryption in transit (HTTPS), hashed passwords, encryption of financial and identity documents at rest, strict access controls, security logging and monitoring, and encrypted backups. No system is completely secure. If a personal data breach occurs, we will inform the Data Protection Board of India and every affected user without delay, as required by the DPDP Act and its rules, describing what happened, the likely impact, what we are doing about it and what you can do to protect yourself. We also report cyber incidents to CERT-In where required.

15. Cookies

Our website uses strictly necessary cookies to keep you signed in, protect forms, remember your cart, language, currency and delivery pincode. These are needed for the site to work. We show a cookie notice on your first visit where you can accept or decline non-essential cookies. You can also delete or block cookies in your browser, though the site may not work properly without the necessary ones.

16. Changes to this notice

We may update this notice when our Services or the law change. The version number and effective date at the top will change. If the change is material, we will tell you by email or in the app and, where required, ask for your consent again before the new processing starts.

17. Contact

Haztech Innovation LLP
Flat No 1, 5th Floor, Dalal Complex, Margao, South Goa, Goa 403601, India
General enquiries: info@petba.in
Grievance Officer: TODO_GRIEVANCE_OFFICER_NAME, TODO_GRIEVANCE_OFFICER_EMAIL, TODO_GRIEVANCE_OFFICER_PHONE