Pup Notes Privacy Policy

This policy explains how Odd Bird Labs LLC, a Kentucky limited liability company ("Pup Notes", "we"), handles personal information in the Pup Notes website (pupnotes.com), the trainer web app, the native trainer app, the client portal and practices' booking pages.

1. Who is responsible for your information

Pup Notes is software that dog-training practices use to run their business. Who is responsible depends on your relationship with us.

If you are a client of a practice, the practice's own privacy practices also apply. The best first contact for questions about your training records is the practice. See section 12.

2. Information we collect

From trainers, owners and staff

• Name, email address, phone number and sign-in details.
• Practice details: business name, locations, services, prices, policies, staff and roles, and the information needed for carrier text registration (such as business name, address and, if you have one, your EIN).
• Subscription and billing records. Card payments are handled by Stripe; we receive only limited details such as the card brand and last four digits.
• Your Stripe connection status. Identity and bank details you give Stripe stay with Stripe.
• Calendar connection details, if you connect Google or Microsoft: which calendar you chose and the access token for it, stored encrypted. We read only busy times, not event titles, attendees or descriptions.
• Dictation audio and the notes you create (see section 6).
• Records of your consents, such as automatic-renewal consent, and of your use of the service.

From clients and caregivers, on the practice's behalf

• Contact details: name, email address, phone number and, for in-home sessions, your address (visible only to the staff assigned to your appointments).
• Dog profiles: name, photo, breed or mix, sex and spay/neuter status, age or date of birth, weight, veterinary clinic and contact, medications, known triggers and bite history.
• Intake questionnaire answers and vaccination records, including the photos or PDFs of vet records you upload.
• Appointments, bookings, attendance, packages and credits.
• Session notes, client summaries, training programs, homework and your practice check-ins.
• Behavior incident reports.
• Messages between you and the practice, including email and text replies, and attachments.
• Signed agreements and waivers, with the evidence of signing: your typed name, time, signed-in account, a fingerprint (hash) of the document and limited technical information.
• Invoices, payments, refunds and, if a service requires one, your authorization to charge a saved card for late-cancellation or no-show fees. Your card details go directly to Stripe and never reach Pup Notes.
• Your text and email preferences, and records of your consents and opt-outs (see section 7).
• If a practice imports records from another system, the client, dog, package and appointment details in that file.

From website visitors and the waitlist

• Your email address if you join the waitlist.
• Product analytics events that don't include the content of your records (see section 9).

From everyone who uses the apps

• Device and technical information such as browser, operating system, app version, IP address and error reports, used for security and to fix problems.
• If you allow notifications on a phone, a push-notification token for that device.

3. How we use information

• To provide the service: scheduling, booking, notes, homework, messages, reminders, payments, agreements, reports, import and export.
• To send messages: sign-in links, appointment reminders and confirmations, receipts, homework and vaccination reminders, and messages from practices.
• To bill practices for their subscription.
• To secure the service, prevent abuse and fraud, and investigate incidents.
• To provide support when you ask for it.
• To understand which features are used and improve them, using analytics events that don't include record content.
• To send Pup Notes news to trainers and waitlist members who agreed to receive it. Every such email has an unsubscribe link.
• To meet legal, tax and accounting obligations.

We use clients' and caregivers' information only to provide the service to the practice and as the practice instructs. We don't use it to market Pup Notes to you.

4. How information is shared

• With the practice. Caregivers' information is available to the practice's staff. Every active caregiver on a client account can see that account's dogs, appointments, shared notes, homework, incidents, messages and billing. Trainers' private notes are visible only to the practice's staff.
• With our service providers. We use the subprocessors listed on our subprocessor list to host and run Pup Notes, process payments, deliver messages, transcribe and draft notes, report errors and measure usage. Providers acting on our instructions may use the information only to provide their service to us. Stripe also uses payment information as an independent company for its own purposes, such as fraud prevention, security and legal compliance, under Stripe's privacy policy.
• With services you connect. If a trainer connects a calendar, appointment details go to that calendar. If a practice accepts payments, payment details go to Stripe for the practice's Stripe account.
• For legal reasons. When the law requires it, or to protect the rights, safety and security of our users, the public or Pup Notes.
• In a business transfer. If Pup Notes is sold or merged, under the same protections as this policy.

We do not sell personal information.

Mobile phone numbers and text-message opt-in data and consent are not shared with any third parties or affiliates for marketing or promotional purposes. Our service providers process them only to provide the service: for example, Twilio delivers the texts you agreed to receive, and AWS hosts the records where phone numbers and consent records are stored.

5. Your practice's records stay separate

Each practice has its own separate records. If you work with more than one practice, one practice cannot see your records or dogs at another practice. Pup Notes does not merge them.

6. Dictation, transcription and AI drafting

Trainers can dictate notes after a session and ask Pup Notes to draft notes from the dictation or typed notes.

• Recording. Dictation is intended for the trainer's own voice. If anyone else may be heard, the trainer must confirm before recording that they told everyone present and got their agreement.
• Transcription. Audio is sent to OpenAI in the United States and converted to text. OpenAI does not keep the audio or use it to train its models. We delete the raw audio within 24 hours of recording.
• No voice identification. Pup Notes does not identify or separate speakers by their voice and doesn't create voice profiles.
• Drafting. The transcript or typed notes are sent to OpenAI in the United States to draft private notes, a client summary, homework suggestions and exercise scores. OpenAI does not use this content to train its models. OpenAI may keep drafting requests for up to 30 days to monitor for abuse, then deletes them.
• Review. Every draft is private to the practice's staff until a trainer reviews and accepts it. Nothing is shared with a client automatically. Client summaries written with AI assistance are labeled as such unless the practice turns that setting off.
• Retention. Drafts a trainer discards are deleted, and drafting inputs and outputs are kept no longer than 30 days unless accepted. Accepted text becomes part of the session record.

AI drafts can be wrong, and they are not veterinary or medical advice.

7. Text messages and email

• Text messages are optional. A practice texts you only if you opt in by ticking a box that isn't ticked for you. Reminder and appointment texts and marketing texts have separate checkboxes, and you don't have to agree to marketing texts to book. Contacts a practice imports are never texted until they opt in themselves.
• What we keep. For each opt-in we keep your phone number, the practice, the exact wording you agreed to, the time and where you opted in. We keep consent records for as long as you have a relationship with the practice plus 4 years.
• Opting out. Reply STOP to any text, or tell the practice in plain words, and texts from that practice stop. See the messaging terms.
• Timing. Reminder texts are sent only between 8 a.m. and 8 p.m. in your local time.
• Email. Practices email you through Pup Notes as "{practice name} via Pup Notes". Rebooking and similar outreach emails always include an unsubscribe link.
• Push notifications. If you allow notifications, they say only that something is waiting, such as "You have a new message in Pup Notes". They don't include names, details or message text.

8. Payments

Payments to practices are processed by Stripe on the practice's own Stripe account. Card numbers are entered directly into Stripe's forms and never reach Pup Notes' servers. Stripe's privacy policy applies to the information it collects. If you authorize a practice to charge a saved card for late-cancellation or no-show fees, we keep the authorization (its wording, time and your account); the card itself stays with Stripe.

9. Analytics, error reports and cookies

• We use PostHog to count how features are used. We send only a reviewed list of events, and they never include note, message, incident or transcript content, or names, addresses and phone numbers. The one exception is the waitlist: if you join it, your email address is recorded in PostHog so we can contact you about Pup Notes. We don't record screen sessions in the signed-in apps.
• We use Sentry to diagnose errors. Error reports are configured to exclude personal information and record content.
• We use only essential cookies, which keep you signed in and secure, plus the allowlisted PostHog analytics events described above, including on pupnotes.com. We don't use advertising cookies or sell data for advertising.

10. Where information is stored and how it is protected

• Pup Notes stores and processes data in the United States, with one exception: push notifications are delivered through Google Firebase Cloud Messaging and, on iPhones, Apple's push notification service. These are global services that process device push tokens and installation identifiers. Notification text contains no names, details or message content.
• We encrypt data in transit and at rest, including backups.
• Each practice's data is separated by access controls that are tested, and staff access within a practice depends on their role.
• Photos, videos and documents are private and delivered through short-lived links.
• Access by Pup Notes personnel is limited to what support and security need and is recorded in an audit log.

No system is perfectly secure. If a security incident affects information we hold for a practice, we notify that practice so it can notify the people affected, and we notify people directly when the law requires us to.

11. How long we keep information

We apply one retention schedule to every practice. The main periods are:

When a practice closes its account, its data is deleted 30 days later, except records we must keep for financial, tax, legal or security reasons. Backups are deleted automatically within 35 days, and deleted data is not restored from a backup.

12. Your choices and rights

You can ask to see, correct, export or delete your personal information.

• Clients and caregivers: you can update your contact details, communication preferences, your dogs' profiles and intake answers in the client portal. For other requests, contact the practice, which controls your records. If you contact us instead, we will pass your request to the practice and help it respond. Some records may be kept where the law or the practice's legitimate needs require it, such as payment records.
• Trainers and staff: contact us at privacy@pupnotes.com. Practice owners can export the practice's data and close the practice from settings.
• Deleting your account: you can delete your Pup Notes account. Records a practice must keep about its work with you remain with that practice under the schedule above.
• Marketing: unsubscribe from any Pup Notes or practice marketing email with its link, and reply STOP to stop texts.

We verify requests in proportion to their risk, usually by confirming you control the account's email address. We aim to complete requests within 7 days, and to respond within 30 days or the period the law in your state requires.

13. Age limit

Pup Notes accounts, the client portal and booking are for people 18 or older. We don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We will post any update here with a new effective date, announce material changes on pupnotes.com, and keep earlier versions available. For a material change, we will also email practice owners and show a notice in the app at least 30 days before it takes effect.

15. Contact

Odd Bird Labs LLC · Lexington, Kentucky · [OWNER: postal address, required before publishing and for CAN-SPAM marketing email footers] · privacy@pupnotes.com