Privacy policy

1. Who we are

Mabel is made by GNK Softworks Ltd, a company registered in England and Wales (company number 15699902). We decide how and why your personal data is used, which makes us its “controller” under UK data protection law (the UK GDPR and the Data Protection Act 2018).

This policy covers the Mabel website at mabelpets.app and the Mabel apps for iPhone, iPad and Android. Questions about it, or about your data, go to [email protected].

2. What we collect

Your account

• Your name and email address, and the timezone your browser or phone was set to when you signed up (you can change it).
• Your password, stored only as a hash. We can't read it. If you switch on two-step sign-in, its secret is stored encrypted and your recovery codes as hashes.
• Your plan, where it came from, and the pets your credits pay for.
• Your reminder settings: when the daily reminder comes, which kinds you want, which pets you've muted, and whether email and push are on.
• Whether you've agreed to marketing emails, and when.

What you record about your pets

Everything you and the people on a pet add: their profile and photo, routines and what was ticked off, weights, medicines, vaccinations and treatments, allergies and conditions, the health journal and its photos, vet visits, events, documents and their files, insurance details, notes for sitters, and the lost-pet card.

Other people's details you add

• The email address of anyone you invite to a pet.
• Contacts you save for a pet, such as a vet, groomer, walker or neighbour, with the phone numbers, emails and addresses you type.
• The contact name and phone number you put on a lost-pet card.

Only add someone else's details if they're happy for you to.

Purchases

Paid plans are bought in the Mabel app, through Apple's App Store on iPhone and iPad or Google Play on Android, so Apple or Google takes the payment. We never see your card or bank details. The store sends us the subscription's details (which plan, its transaction or purchase number, when it renews or ends) so we can switch your plan on.

Your devices

• When you sign in to the app with notifications allowed, the push token Apple or Google gives your phone or tablet, the app version, and when it was last seen.
• A sign-in session for each browser or phone you use, which records whether it's the website or the app and when it expires. We don't store your IP address or browser details with your account.

What we don't collect

No analytics trackers, no precise location, no contacts from your phone, and nothing from other apps or websites. The one exception is the ads shown in the apps on the free Basic plan, which come from Google: see Ads in the apps for what Google collects to show them.

3. How we use it, and why we're allowed to

• To run Mabel for you (to perform our contract with you): your account, your pets' records, sharing them with the people you invite, reminders, and your plan.
• To send emails you need (contract): confirming your address, resetting your password, invites, security notices when something about how you sign in changes, and the reminders you choose.
• To keep Mabel safe and working (our legitimate interests in security and preventing abuse): checking sign-ins, stopping misuse, suspending accounts that break our terms, and fixing faults.
• Push notifications (your consent): only once you allow them on your phone. You can turn them off in Mabel or in your phone's settings at any time.
• Ads in the apps on Basic (our legitimate interest in keeping a free plan free; your consent for personalised ads): see Ads in the apps.
• Marketing emails (your consent): news about Mabel, tips and the occasional offer, only if you tick “Email me news, tips and offers” when you sign up or on your Account page. The box is never ticked for you. Untick it any time, or use the unsubscribe link in any marketing email, and they stop. We don't share your address with anyone to market to you.
• To meet the law (legal obligation): keeping records we're required to keep, and answering lawful requests.

We don't sell your data, we never give advertisers your name, email address or anything you record about your pets, and we don't make automated decisions about you that have legal or similar effects.

4. Who can see it

The people on your pets

Everyone you add to a pet sees that pet's records, what each role allows, and the names of the people who did things. Their name and email show to the others on the pet. If you join someone else's pet, the same goes for you.

Anyone who scans a lost-pet card

A lost-pet card is public while you have it switched on: anyone with its link or QR code sees the pet's photo, name and kind, microchip number, the contact name and phone number you typed, your email only if you chose to show it, your message, and whether the pet is missing and where it was last seen. Turn the card off or replace its link and the old link stops working.

Companies that help us run Mabel

We use a small number of service providers, who may only use your data to provide their service to us:

• Hosting and database providers, where Mabel runs and your records are stored.
• A file storage provider, for pet photos, journal photos and documents. Files are private and only reach you through Mabel.
• An email delivery provider, for the emails above.
• Apple, for App Store purchases and for delivering push notifications to iPhones and iPads.
• Google AdMob, which shows the ads in the apps on the free Basic plan (see Ads in the apps).
• Google, for Google Play purchases and for delivering push notifications to Android phones and tablets (Firebase Cloud Messaging).

When the law requires it

We'll share data if we're legally required to, or to protect someone's safety, and only what's needed.

If GNK Softworks Ltd is ever sold or merged, your data would pass to the new owner under this policy, and we'd tell you first.

5. Ads in the apps

To keep Basic free, the Mabel apps for iPhone, iPad and Android show ads while you're on the Basic plan. The ads come from Google AdMob. Family and Professional have no ads, and the website never shows them.

What Google collects

AdMob runs inside the app and collects some information directly from your device to choose ads, count how often they're shown and stop fraud: your device's advertising identifier (if you allow it), your IP address, which gives a rough location such as your town, information about your device and the app, and how you interact with the ads. Google uses this as a controller in its own right, under Google's privacy policy for partner apps.

We don't give Google your name, email address, or anything you or the people on your pets record in Mabel, and ads never appear in emails or on the lost-pet card.

Personalised or not, your choice

• The first time an ad would show, the app asks whether you agree to personalised ads, which are chosen using information about you and your activity in other apps and websites. On iPhone and iPad, Apple's “Allow tracking” question also asks before your advertising identifier can be used.
• If you say no, you still see ads on Basic, but they're non-personalised: chosen from things like the app and your rough location, without a profile of you.
• You can change your mind at any time from Privacy and ads in the app's Account screen, in your phone's settings (Privacy & Security → Tracking on iPhone and iPad; Privacy → Ads on Android), or by moving to a paid plan, which removes ads altogether.

6. Data outside the UK

Some of our providers, including Apple and Google, process data outside the UK. When they do, we make sure it's protected as UK law requires: the country is covered by UK adequacy regulations, or the transfer is made under the UK International Data Transfer Agreement or Addendum, or an equivalent safeguard.

7. How long we keep it

• Your account and everything in it, for as long as you have the account.
• Records you delete are removed straight away. Routines you change keep their history, so past days show what happened then.
• Sign-in links and codes expire within a day, invites after two weeks, and sign-in sessions when you sign out or they run out.
• When you delete your account, we delete it and everything hanging off it, including pets you chose to delete and their files. What you wrote on pets that carry on with other people (ticks, notes, journal entries) stays with the pet but no longer shows your name.
• Backups and server logs are kept for a limited time for security and recovery, then deleted.

8. Your rights

Under UK data protection law you can:

• get a copy of your data;
• have wrong data corrected;
• have your data deleted;
• take your data elsewhere (portability);
• object to, or ask us to restrict, how we use it;
• withdraw consent you've given, such as for push notifications or marketing emails.

You can do the most common ones yourself, on your Account page or in the app's Account screen: downloading your data gives you everything you can see in Mabel as a ZIP file, and deleting your account removes it. For anything else, email [email protected]. We'll answer within a month.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. Cookies

The website uses two cookies, both strictly necessary for signing in, so we don't ask before setting them:

• mabel_session keeps you signed in. It lasts until you sign out or the session expires.
• mabel_2fa holds your place for ten minutes while you enter a two-step sign-in code.

The website has no advertising, analytics or third-party cookies.

The apps don't use cookies, but on the Basic plan Google's ad service uses your device's advertising identifier and similar technology to show ads, as Ads in the apps explains.

10. Children

You need to be 13 or older to have a Mabel account. If you think a younger child has an account, email [email protected] and we'll delete it.

11. Keeping it safe

Mabel is served over HTTPS. Passwords are hashed, two-step secrets are encrypted, files are kept in private storage and only streamed to people allowed to see them, and every request checks you're on the pet before showing anything. Two-step sign-in is available to everyone, and we email you whenever how you sign in changes. No system is perfectly secure, but if something goes wrong that puts your data at risk, we'll tell you and the regulator as the law requires.

12. Changes to this policy

When we change this policy we'll update the date at the top. If a change matters, such as a new kind of data or a new way it's used, we'll tell you by email or in Mabel before it takes effect.

13. Contact us

GNK Softworks Ltd, England and Wales, company number 15699902. Email [email protected].