Privacy

This policy explains what personal data PawOnTop collects, why, and your rights. PawOnTop is run by Nabanita Nath, an individual (sole proprietor) based in Guwahati, Assam, India, who decides how your data is used (the "data controller", called a "data fiduciary" under Indian law). Contact: pawontop26@gmail.com.

1. What we collect

Data	Where it comes from	Why we use it
Email address	You, when you sign in, or Google if you choose Continue with Google	To sign you in, and to send sign-in links, receipts and important notices about your account, listings and purchases
Account details: role, adult confirmation, the policy versions you accepted and when	You, at sign-up	To run your account and record your agreement to our terms
Pet listings: pet name, description, photo, Instagram handle	You	To show your pet on PawOnTop (only the approved version is public)
Orders and payments: amounts, dates, order and receipt references, provider references, refunds	You and our payment provider	To process purchases, provide receipts, handle refunds and disputes, and keep required accounting records
Sign-in and security data: session records, device/browser type, IP address	Your browser	To keep you signed in, protect accounts, limit abuse and investigate problems
Usage data: pet page views and Instagram button clicks, counted with a pseudonymous visitor code	Your browser	To show owners approximate views and clicks, and to understand how the site is used
Reports and support messages	You	To review reported listings and answer you

Sign in with Google (optional). If you choose Continue with Google, we ask Google only for your email address and confirmation that Google has verified it. We do not receive your Google password, contacts or other Google account data, and we do not store your Google account identifier. You can stop using Google sign-in at any time and sign in with an emailed link instead; you can also remove PawOnTop's access in your Google account settings.

We do not receive or store your full card details; payments are handled by PayPal. We do not sell your personal data and do not use advertising trackers.

Your email address is never shown publicly. Public listings show only the pet's approved name, description, photo and Instagram handle, and whether it is the founder's pet.

2. Legal bases

[To be confirmed by counsel.] We process personal data in line with India's Digital Personal Data Protection Act, 2023 and, where they apply to you, other data-protection laws such as the UK and EU GDPR. We rely on: contract (running your account and purchases), legal obligation (accounting and tax records), and legitimate interests (security, fraud prevention, abuse limits, approximate view counts and improving the service). Where consent is required, we will ask for it.

3. Cookies

We use only cookies that are strictly necessary for the site to work:

Cookie	Purpose	Lifetime
`pot_session`	Keeps you signed in (random identifier, HttpOnly)	Up to 30 days
`pot_csrf`	Protects your account from cross-site request forgery	Same as the session
`pot_google`	Only during Continue with Google: links Google's reply to your browser so nobody else can finish your sign-in (HttpOnly)	10 minutes, deleted once you are signed in

We do not use advertising or third-party analytics cookies.

We use service providers who process data on our behalf: payment processing (PayPal); hosting, database and photo storage (Hostinger, on a server in Mumbai, India); email delivery (Google, through Gmail); and, only if you choose it, sign-in with Google (Google). They may only use the data to provide their service to us. We may also share data where the law requires it, or to protect our users or PawOnTop. PawOnTop is run from India, and your account, listing, photo and order data is stored in India. Google (email and sign-in) and PayPal may process data in other countries, including the United States. Where the law requires it, we use appropriate safeguards for these transfers [to be confirmed].

5. How long we keep data

Account and listings: while your account is open.
Orders, payments, refunds and audit records: for as long as Indian tax and accounting law requires [8 years: confirm with our accountant], even after an account is deleted.
Raw page-view events: 30 days. After that only daily totals per pet are kept.
Sign-in links: expire after 15 minutes and are stored only as a one-way hash.
Security logs: [90 days: confirm].

6. Your rights

Depending on where you live, you may have the right to access, correct or delete your data, object to or restrict some processing, and receive a copy of your data. To make a request, use Request account deletion on your account page or contact pawontop26@gmail.com. We reply within 30 days. When we delete an account we remove or anonymise your email and hide your pets, but we keep the financial records we are legally required to keep.

If you are not satisfied with our answer, contact our grievance officer, Nabanita Nath, at pawontop26@gmail.com. You can also complain to your data-protection authority: the Data Protection Board of India, the ICO in the UK, or the authority in your EU country.

7. Children

PawOnTop accounts are for adults only (18+). We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.

8. Security

We use HTTPS, hashed sign-in tokens and session identifiers, owner-only access to account data, and multi-factor authentication for staff admin accounts. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

9. Changes

We will post any changes here with a new version number, and ask you to accept material changes.

10. Contact

pawontop26@gmail.com · Nabanita Nath (individual, sole proprietor), Ashirwad Bhawan, Near Maligaon Overbridge, Guwahati, Assam 781012, India.