Privacy Policy

• We collect what we need to run the service and nothing for advertising.
• We don't sell personal information, and we don't share it for targeted advertising.
• Each business owns the records it keeps about its clients and pets. We store and process them for the business, on its instructions.
• We use no advertising or tracking cookies.
• We're a US service for US businesses.

When you sign up or are invited to a business's account, we collect:

• Your name, email address and password (stored only as a secure hash), and your two-step sign-in settings if you turn it on.
• Your business's details: its name, address, phone, email, hours, services and prices, and its website content.
• What you do in the app, kept in an audit log so the business can see who changed what (for example, who confirmed a booking or edited a vaccine record).
• Time clock records, if your business uses the time clock: clock-in and clock-out times, breaks and approvals. Clock PINs are stored only as secure hashes.
• Sign-in details: the time, your internet address and your browser, kept with your session for security.
• Messages you send us for support.

We use this to run your account, keep it secure, send you service emails (sign-in, password reset, invitations, billing), support you and improve the service. We'll only send you product news if you've agreed, and you can stop it any time.

Our marketing site doesn't use analytics, advertising or tracking cookies. Our host keeps standard server logs (internet address, browser, pages requested, time) for security and to fix problems, and deletes them on its own schedule.

If you email us or start a trial, we use what you send to reply and to set up your account.

Businesses use Tailbunk to keep records about their clients and pets. Depending on what the business collects, that can include:

• Owner name, email, phone, address, emergency contacts and who may pick up.
• Pet details: photos, breed, age, medical notes, vaccines, vet details, care plans (meals, medicines), behavior notes, incidents and report cards.
• Bookings, invoices, the payments a business records, and messages between the business and the family.
• Agreements signed online: the signer's typed name, the time, and details of the device used (internet address and browser).
• Newsletter sign-ups from the business's website.

For this information, the business is in charge. It decides what to collect and why, and it's responsible to its clients for how it uses it. Tailbunk acts as the business's service provider (a "processor"): we store and process the information only to provide the service to that business, under our Data Processing Terms. We don't sell it, use it for our own marketing, or combine it across businesses.

Every business website we host includes a privacy notice, built from that business's details, that explains this to its clients. If you're a client and want a copy of your information, a correction or a deletion, please contact the business. If you contact us, we'll pass your request to the business and help it respond.

Families sign in to a business's portal with a one-time code sent to their email. There's no password to remember or leak.

If a business has AI features turned on, uploaded vet records, vaccine certificates and care instructions may be sent to Anthropic to read them into forms, along with the pet details needed to read them. Report card notes and website wording can also be drafted this way. Staff check every result before it's saved or sent.

Anthropic processes this data for us under its commercial terms, which don't allow it to train its models on it. A business can turn AI features off, and then nothing is sent.

We use a small number of providers to run the service. Each one only gets what it needs for its job, and is bound by a contract to protect it.

• Vercel: Hosting: runs the app, the family portal and every business website. Always.
• Neon: Database (Postgres) where records are stored. Always.
• Cloudflare: File storage (R2), the bot check on public forms (Turnstile) and DNS for our addresses. Always.
• Resend: Sending email. Always.
• Anthropic: AI: reads uploaded vet records, vaccine certificates and care instructions into forms, and drafts report card notes and website wording. Only for businesses that have AI features turned on.

When a business turns on online payments, card payments are processed by Stripe under the business's own Stripe account and Stripe's terms. Tailbunk takes 0% of those payments and never sees full card numbers.

The full list, with what each provider handles, is on our subprocessors page. See the list.

We also share information if the law requires it (for example, a valid court order), to protect someone's safety, or as part of a sale or reorganization of our business, in which case this policy keeps applying to it.

We use only what the service needs to work:

• Sign-in cookies (their names start with "tailbunk") that keep you signed in to the app or the family portal. A session lasts up to 7 days.
• A cookie that remembers you've entered a business website's password, if the business has set one. It lasts 30 days.
• Browser storage for small conveniences: whether you've already seen a website's newsletter pop-up, your light or dark display choice, and care entries saved while a staff device was offline.

There are no advertising or tracking cookies.

• Everything is encrypted in transit (HTTPS).
• Each business's data is kept apart in the database by row-level security, so one business can never see another's.
• Uploaded files are private. They're only shown after checking that the person may see them, and photo location data is removed when they're uploaded.
• Staff can use two-step sign-in, and owners and managers must.
• An audit log records important changes, and key records like vaccines and signatures can't be quietly edited or deleted.

No system is perfectly secure. If a security incident affects your information, we'll tell the business concerned (and you, where we're the right one to tell you) as the law requires.

We keep a business's account and data while the account is open. When it closes, we offer the business an export and delete its data 30 days after that. Encrypted backups roll over within 35 days after deletion.

Within an open account, the business decides how long to keep its clients' records. We keep a small amount of information longer when we need it for legal, tax or billing reasons.

You can see and update most of your own account details in the app. You can ask us for a copy of your information, to correct it, or to delete it, by emailing legal@tailbunk.com. Depending on where you live, you may have further rights under state privacy laws, and we'll honor them. We won't treat you differently for using them.

If you're a client of a business that uses Tailbunk, please send these requests to the business, which controls your information. We'll help it respond.

Tailbunk is offered to businesses in the United States, and information is stored and processed in the United States.

Tailbunk isn't directed to children under 13, and we don't knowingly collect their personal information. If you think a child has given us information, email us and we'll delete it.

We'll update this page when our practices change and change the date at the top. For changes that matter, we'll also email business owners before they take effect.

TruePoint Companies LLC, 6200 School Road, Unit 6102, Austin, TX 78735. Email: legal@tailbunk.com.