Privacy Policy
Effective date: 17 May 2026
Your consent preferences
DPDP Act 2023 requires us to ask for your consent before processing optional personal data. Toggle your preferences below. Essential data processing is required to use the service and cannot be disabled.
Required to use HomePaws. Covers booking management, payment processing, OTP delivery, and in-app communications. Cannot be disabled while your account is active.
Allow HomePaws to send offers, new service announcements, and seasonal tips via WhatsApp, SMS, and email. You can withdraw this at any time.
Allow HomePaws to use anonymised usage data to understand how parents use the platform and to improve the experience. Powered by Google Analytics 4.
Marketing preferences are not yet persisted across sessions — full management will be available in account settings.
1. Data Fiduciary
The Data Fiduciary for personal data collected via HomePaws is:
- HomePaws Private Limited
- Registered office: Bangalore, India — full address available on request via support@homepaws.in until company incorporation is complete.
- Grievance Officer: Vijayan Ram (interim — final officer named on incorporation), grievance@homepaws.in.
2. Personal Data We Collect
Identity data
Name, email address.
Contact data
Phone number, service address, PIN code, locality.
Pet data
Your pet's name, species, breed, age, weight, medical notes, and photos you upload.
Payment data
We store only transaction references — Razorpay order ID, payment ID, amount, and status. No card numbers, UPI IDs, or banking credentials are stored on HomePaws servers. All payment data is processed and held by Razorpay.
Usage data
Device type, operating system, app version, IP address, pages visited, and session duration — collected to improve platform performance and security.
Communications data
In-app chat messages between you and providers, SMS and email logs sent via MSG91.
3. Purposes of Processing
We process personal data for the following lawful and specified purposes under DPDP Act 2023 §6:
- Service delivery: Matching you with providers, managing bookings, facilitating home-visit sessions.
- Payment processing: Initiating and confirming payments via Razorpay.
- Communications: Booking confirmations, OTPs, service updates via SMS/email/WhatsApp (MSG91).
- Fraud prevention and platform safety.
- Legal compliance: Retaining records as required by applicable Indian law.
- Analytics and product improvement (only with your consent — toggle below).
- Marketing communications via WhatsApp, SMS, or email (only with your explicit consent — toggle below).
4. Consent (DPDP Act 2023 §5)
We collect consent that is granular, affirmative, and withdrawable. We never use pre-ticked checkboxes. Your consent choices are shown at the top of this page and at account creation.
- Essential service data — required to use HomePaws; cannot be opted out while your account is active.
- Marketing communications (WhatsApp/SMS/email) — optional; off by default.
- Analytics and product improvement — optional; off by default.
You may withdraw optional consents at any time from the toggles above or by emailing support@homepaws.in. Withdrawal does not affect the lawfulness of processing before withdrawal.
5. Data Sharing
Service providers
We share your pet's name and relevant booking details with the confirmed provider. Your parent surname and home address are shared with the provider only for confirmed home-visit bookings, and only once payment is complete.
Third-party processors
- Razorpay — payment processing (India)
- MSG91 — SMS, email, WhatsApp, voice OTP (India)
- Cloudflare — CDN, R2 media storage, Turnstile (global CDN, media stored in closest region)
- Vercel — web hosting (global edge)
- Hetzner — backend compute and database hosting (EU region — see Section 10 on cross-border transfers)
- Sentry — error monitoring (EU region)
No sale of data
We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.
6. Cookies and Similar Technologies
HomePaws uses a small number of first-party cookies to keep you signed in, remember your cart, and remember your consent choices. Analytics cookies are set only after you accept them. We do not use cookies for advertising or retargeting.
Essential cookies — required to use the service
- homepaws_auth_token — keeps you signed in. First-party, httpOnly, secure. Duration: 7 days from last login. Lawful basis: necessary for contract performance (DPDP § 7(a)).
- medusa_cart_id — remembers your cart between page loads. First-party, httpOnly. Duration: browser session. Lawful basis: necessary for contract performance.
- wedge_invite — unlocks the platform when you have a valid invite code (used during the closed-circle launch phase only). First-party, httpOnly, secure. Duration: 30 days. Lawful basis: necessary for contract performance.
- hp_shell — identifies whether you are using HomePaws inside our parent app (versus a regular web browser), so we can hide duplicate chrome. Set by the parent app on first load. Duration: persistent until uninstall. Lawful basis: necessary for contract performance.
Functional storage — improves your experience
- hp_consent_analytics (browser localStorage, not a cookie) — records your analytics consent choice from the banner or this page. Duration: persistent until cleared. Lawful basis: necessary to honour your consent.
- hp_active_pet_id — when you have more than one pet, remembers which one is currently selected. Stored only on your device; never sent to service providers or to our backend. Duration: 30 days. Lawful basis: necessary for contract performance.
Analytics cookies — only with your consent
- _ga, _ga_* (Google Analytics 4) — anonymised usage measurement to help us improve the platform. Third-party (Google LLC). Duration: up to 2 years. Lawful basis: your consent (DPDP § 6). Toggle via the banner or the analytics switch at the top of this page.
Third-party cookies during payment
- Razorpay cookies — set by Razorpay during the checkout flow to process your payment securely. Governed by Razorpay's privacy policy. Duration: per Razorpay's terms. Lawful basis: necessary for contract performance (payment).
No third-party advertising cookies. HomePaws does not use cookies for ad targeting or retargeting and does not share cookie data with advertising networks.
To withdraw your analytics consent at any time, toggle the analytics switch at the top of this page, or clear the hp_consent_analyticsentry in your browser's storage and refresh — the banner will reappear.
7. Your Rights Under DPDP Act 2023
As a Data Principal under the DPDP Act 2023, you have the right to:
- Access — request a summary of personal data we hold about you.
- Correction and completion — update inaccurate or incomplete data.
- Erasure — request deletion of your data, subject to retention obligations under applicable law.
- Grievance redressal — raise a complaint with our Grievance Officer (see Section 1).
- Nominate — nominate a person to exercise your rights in the event of your death or incapacity.
- Withdraw consent — for optional processing purposes at any time.
Exercise any right by emailing support@homepaws.in or contacting our Grievance Officer at grievance@homepaws.in.
8. Children's Data
HomePaws services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If a parent registers to manage pet care on behalf of a minor household member, verifiable parental consent is required under DPDP Act 2023.
9. Data Retention
- Account data: Retained while your account is active, and for 7 years after account deletion as required under the Income Tax Act and Companies Act.
- Transaction records: Retained for 8 years per RBI merchant terms and Razorpay requirements.
- Chat and communication logs: Retained for the duration of the booking plus 1 year for dispute resolution.
10. Cross-Border Data Transfer
Our backend infrastructure is hosted on Hetzner servers in the EU. Some data (error logs, performance traces) may be processed by Sentry in the EU. These transfers are made under the framework established by DPDP Act 2023 §16 and applicable data processing agreements with each processor.
We have chosen EU-based processors that operate under GDPR, which provides an equivalent or higher level of data protection.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data:
- Encryption in transit (TLS 1.2+) and at rest.
- Access controls — only authorised personnel can access personal data.
- Regular security reviews and dependency audits.
In the event of a personal data breach that is likely to cause harm, we will notify affected Data Principals and the Data Protection Board of India as required under DPDP Act 2023 §8(6).
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or in-app notice at least 7 days before taking effect. Continued use after the effective date constitutes acceptance of the revised policy.
13. Grievance Officer
- Name: Vijayan Ram (interim — final officer named on company incorporation).
- Email: grievance@homepaws.in
- Response SLA: 30 days from receipt of complaint (DPDP Act 2023 §13 standard).
You may also contact the Data Protection Board of India once established if your grievance is not resolved to your satisfaction.