Privacy Policy
Draft — for legal review before publishing. Last updated: 6 September 2026
Havefoi ("we", "us") operates pet ID tags linked to online profiles. This policy explains what personal data we collect, why, and how you can control it, in line with India's Digital Personal Data Protection Act, 2023 (DPDPA).
What we collect
When you create an account and set up a pet profile, we collect:
- Account data: your email and a password (stored as a secure hash, never in plain text)
- Public profile data (visible to anyone who scans your pet's tag): your pet's name, a contact phone number, an optional photo, and any notes you choose to add
- Private profile data (visible only to you, never shown publicly): your full name, home address, alternate phone number, your pet's breed, age, medical notes, vet contact details, and microchip ID, if you choose to provide them
- Order data: delivery address and contact details needed to ship your tag
- Scan-location data (only if a finder chooses to share it): if someone finds your pet and consents to sharing their current location, that location is included in the one-time notification sent to you — we don't store it beyond that notification, and we never track your pet's location continuously
Why we collect it
We use this data solely to: operate your pet's public identification page, notify you by SMS or email when your pet's tag is scanned, let you manage and update your profile, fulfil and ship your order, and provide customer support.
Third-party services we use
To provide the service, we share limited data with:
- Supabase (database hosting) — stores your account and profile data securely
- Razorpay (payment processing) — handles your payment details directly; we never see or store your card/UPI information
- MSG91 (SMS) and Resend (email) — used only to send you scan notifications, order confirmations, and password reset links
None of these providers are permitted to use your data for their own purposes.
Consent
We ask for your explicit consent before storing your pet's profile information. You can withdraw consent at any time by deleting the profile from your account.
Your rights
Under the DPDPA, you have the right to:
- Access the personal data we hold about you
- Correct or update inaccurate data
- Request erasure of your data — deleting a pet profile permanently removes its personal data from our systems
- Withdraw consent at any time
What we don't do
- We never display your home address, medical notes, or full name on the public tag-scan page
- We don't sell your personal data to third parties
- We do not use your data for marketing communications — every message we send you is tied to a specific action (a scan notification, an order update, a password reset)
Data security
Passwords are hashed using scrypt and never stored in plain text. Your data is stored on Supabase's managed Postgres infrastructure with Row-Level Security enabled and encrypted connections (TLS) for all data in transit.
Contact us
For any privacy questions or to exercise your rights under the DPDPA, contact: support@havefoi.com
This is a starting draft, not legal advice. Have it reviewed by a lawyer familiar with the DPDPA before publishing, especially the sections on data retention periods and grievance redressal (which the DPDPA requires you to name a specific contact for).