Privacy Policy

Last Updated: April 08, 2026

Aurélie Duynslaeger, trading under the commercial name Motion Lab ("PawTracker", "we", "us", or "our"), places the utmost importance on the protection of your personal data and privacy.

This Privacy Policy explains how we collect, use, store, disclose, and safeguard your personal data when you use our software-as-a-service platform, website, and related services (collectively, the "Service"). It also details your privacy rights under applicable data protection laws, including the European Union General Data Protection Regulation (EU GDPR - Regulation UE 2016/679), the UK GDPR, the French Data Protection Act (Loi Informatique et Libertés), and applicable US State Privacy Laws (including the CCPA/CPRA).

Data Controller Identity

Unless specified otherwise, PawTracker acts as the Data Controller for personal data collected about our account holders, website visitors, and prospective clients.

Data Controller Entity: Aurélie Duynslaeger t/a Motion Lab (SIRET: 937 550 333 00010)
Registered Address: 3 avenue Albert Bourgois, 59390 Sailly-lez-Lannoy, France
Privacy Inquiry Email: contact@pawtracker.fr

1. Data Collection Purposes and Legal Bases

We collect only personal data that is strictly necessary to fulfill specific, legitimate business purposes.

1.1 Account Creation and Management

Data Categories: Email address, full name, business or organization name, business logo (optional user upload).
Purpose: Creating and managing your administrative account, providing access to the Service, and authenticating users.
Legal Basis: Performance of a Contract (Art. 6.1.b EU/UK GDPR).

1.2 Billing and Subscription Management

Data Categories: Payment information (processed exclusively via Stripe Inc.; PawTracker never stores raw credit card details or CVVs), transaction identifiers, subscription status, invoice history.
Purpose: Processing subscription payments, managing billing plans (monthly subscriptions, lifetime licenses, or promotional offers), and fulfilling legal accounting obligations.
Legal Basis: Performance of a Contract (Art. 6.1.b EU/UK GDPR) and Legal Obligation (Art. 6.1.c EU/UK GDPR for tax/accounting records).

1.3 Core Application Functionality (Customer Data Processing)

Data Categories: Information entered by the User regarding their end-clients and animals (e.g., dog profiles, pet owners' names and contact details, training session notes, behavioral assessment reports).
Role Clarification: As set forth in Section 7 of this Policy, you act as the Data Controller for all end-client data you enter into PawTracker. PawTracker acts exclusively as a Data Processor (or "Service Provider" under US law) executing technical operations on your behalf.
Legal Basis: Performance of a Contract (Art. 6.1.b EU/UK GDPR).

1.4 Service Communications

Data Categories: Email address, system interaction logs.
Purpose: Sending essential operational emails, such as purchase confirmations, password resets, account security alerts, and automated client session follow-ups or reminders configured by the User.
Legal Basis: Performance of a Contract (Art. 6.1.b EU/UK GDPR). These operational emails are mandatory for proper Service delivery.

1.5 Marketing Communications

Data Categories: Email address, preference settings.
Purpose: Sending newsletters, product update announcements, and promotional content.
Legal Basis: Consent (Art. 6.1.a EU/UK GDPR). You may withdraw your consent at any time by clicking the "unsubscribe" link included in every marketing email.

Authentication: If you choose to log in via Google, we collect only the necessary credentials returned by Google OAuth (full name, email address, Google user ID, and profile picture).
Google Calendar Synchronization: If you enable Google Calendar integration, PawTracker accesses only the specific calendar data required to create, display, and synchronize appointments managed within PawTracker. We do not access, scan, or read any unrelated calendar entries or Google account data.
Google API Use Disclosure: PawTracker’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is never used for advertising, marketing, or training artificial intelligence / machine learning models.

2. Data Recipients and Third-Party Sub-Processors

We do not sell, rent, lease, or trade your personal data to third parties for commercial or advertising purposes.

To operate the Service, we share data with trusted technical third-party sub-processors bound by strict confidentiality and data protection agreements:

Recipient / Sub-Processor	Role / Service Provided	Location / Transfer Safeguards	Privacy Policy
Vercel Inc.	Application Hosting & Infrastructure	EU Region hosting / EU-U.S. Data Privacy Framework (DPF)	Vercel Privacy
Stripe Inc.	Payment Processing & Billing	US / EU / EU-U.S. DPF & Standard Contractual Clauses	Stripe Privacy
Brevo (Sendinblue SAS)	Transactional & Operational Email Delivery	France (EU) / GDPR Compliant	Brevo Privacy
Scaleway SAS	Media File & Document Storage (S3 Object Storage)	France (EU) / Localized Infrastructure	Scaleway Privacy
Umami Analytics	Privacy-focused Privacy Analytics	EU-Hosted / Fully Anonymized (No Personal Data)	Umami Privacy

3. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA) or the United Kingdom (UK) to third parties (such as Vercel or Stripe in the United States), we ensure appropriate legal safeguards are in place pursuant to Chapter V of the GDPR:

EU-U.S. Data Privacy Framework (DPF) & UK Extension: Our US sub-processors are certified under the DPF framework established by the US Department of Commerce;
Standard Contractual Clauses (SCCs): Where DPF certification is not applicable, transfers are secured using the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

4. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with statutory legal, accounting, and reporting obligations:

Account Data: Retained for the duration of your active subscription, plus three (3) years following account closure or inactivity for litigation defense purposes.
Financial & Billing Records: Retained for five (5) to ten (10) years pursuant to mandatory French tax and accounting requirements (Code de commerce).
Application Data (Pet Profiles, Client Logs): Retained during active platform use. Permanently deleted within thirty (30) days upon account deletion or written request, unless legal retention applies.
Technical Activity Logs: Retained for a maximum period of twelve (12) months.

5. Your Privacy Rights

Under applicable data protection legislation (EU/UK GDPR), you possess the following legal rights regarding your personal data:

Right of Access: The right to request a copy of the personal data we hold about you.
Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten"): The right to request deletion of your personal data, subject to statutory retention obligations.
Right to Restriction of Processing: The right to request that we temporarily suspend processing your personal data in certain circumstances.
Right to Data Portability: The right to receive your personal data in a structured, commonly used, and machine-readable format for transfer to another service provider.
Right to Object: The right to object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please submit a request to our privacy team at: contact@pawtracker.fr. We will evaluate and respond to your request within one (1) calendar month of receipt.

Supervisory Authority Right

If you believe that our processing of your personal data violates applicable privacy laws, you have the right to lodge a complaint with your local supervisory authority:

France: Commission Nationale de l'Informatique et des Libertés (CNIL) – www.cnil.fr
United Kingdom: Information Commissioner’s Office (ICO) – www.ico.org.uk
EU/EEA: Your local national Data Protection Authority.

6. Data Security Practices

We implement industry-standard technical and organizational measures to safeguard your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

Encryption in Transit & at Rest: End-to-end encryption using HTTPS/TLS protocols; signed URLs for S3 document access.
Access Control: Administrative access restricted strictly to authorized personnel under multi-factor authentication.
Password Hashing: Passwords stored using industry-standard secure cryptographic hash algorithms; never stored in plaintext.
Secure Client Sharing: Read-only, tokenized secure links for sharing reports with end-clients.
No Profiling or Selling: PawTracker does not perform automated profiling or monetize user data.

When you input personal data regarding your clients, pet owners, or animals into PawTracker:

You act as the Data Controller (or "Business" under CCPA/CPRA). You are responsible for ensuring a legal basis exists to collect and process your end-clients' data.
PawTracker acts strictly as a Data Processor (or "Service Provider" under CCPA/CPRA). We process such data solely on your documented instructions to provide the Service.

8. Analytics and Tracking Technologies

Our website uses privacy-first analytics powered by Umami Analytics to evaluate visitor interaction and optimize user experience.

No Cookies Placed: Umami Analytics operates without depositing any persistent cookies or tracking IDs on your terminal device.
Complete Anonymization: Umami does not collect Personally Identifiable Information (PII) or track users across third-party websites. Session metrics are aggregated using short-lived cryptographically hashed identifiers.
Consent Exemption: Because Umami Analytics processes fully anonymized statistical data without depositing cookies, it is exempt from consent requirements under EU ePrivacy directives and CNIL guidelines. No cookie consent banner interaction is required for this tool.

9. US Privacy Rights Notice (California & US Residents)

For residents of California and states with comprehensive consumer privacy laws:

No Sale or Sharing: PawTracker has not sold, rented, or shared personal information for cross-context behavioral advertising in the preceding 12 months.
Service Provider Designation: When processing data on behalf of business users, PawTracker acts as a Service Provider under the California Consumer Privacy Act (CCPA/CPRA).

10. Protection of Minors

The Service is intended exclusively for adult business professionals. PawTracker does not knowingly collect or solicit personal data from children under sixteen (16) years of age. If we become aware that we have inadvertently collected data from a minor under 16, we will take immediate steps to purge such data from our systems.

11. Amendments to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect platform evolution, operational changes, or new regulatory obligations. Material changes will be communicated to you via email or a prominent notification dashboard banner at least thirty (30) days prior to taking effect. Your continued use of the Service following an update signifies your acknowledgment of the revised Policy.

12. Contact Information

For any questions, requests, or privacy concerns regarding this Policy, please contact us at:

Email: contact@pawtracker.fr
Data Controller Entity: Aurélie Duynslaeger t/a Motion Lab (SIRET: 937 550 333 00010)
Postal Address: 3 avenue Albert Bourgois, 59390 Sailly-lez-Lannoy, France