Privacy Policy

Last updated: 24 September 2026

1. Who we are

This Privacy Policy explains how Dot Squad Ltd ("we", "us", "our") collects, uses, stores and shares personal data when you use UnLostPaws at unlostpaws.com, whether you use the free features or Premium.

Dot Squad Ltd is the controller of your personal data. We are registered in England and Wales under company number 15906946.

We are based in the United Kingdom. We follow the UK GDPR and the Data Protection Act 2018 as our main rules, and we apply this Policy to users worldwide. If you are in the European Economic Area (EEA) or Switzerland, we apply equivalent standards; the EU GDPR or Swiss FADP may also give you rights (see section 13).

For any privacy question or request, use our contact form or email hi@dotsquad.net.

2. What we collect

Depending on how you use the Service, we collect:

• Account data: your name or display name, email address, a secure hash of your password (never the password itself) and your settings. If you sign in with Google, Facebook, X or Microsoft, we receive basic profile details from that provider, such as your name, email address and profile picture.
• Month and year of birth: after you sign up, we ask for these so we can confirm you are 13 or older. We do not show them publicly.
• Phone number: if you verify your phone for Premium, we collect your number and pass it to our SMS provider to send the code.
• Alerts and pet profiles: photos, descriptions, the location you pin, the contact options you choose, and pet details you add, such as a microchip number.
• Premium and payments: your subscription status and limited billing details from Stripe. We never see or store your full card number.
• Technical data: IP address, device and browser details, logs and security events.
• Cookies: see section 9.
• Messages and reports: what you send us through the contact form or by email, and any reports you submit about alerts.

Information about other people: an alert may include a photo in which a person appears, or details a finder gives about where a pet was found. If you appear in someone else's alert and want it removed, contact us.

3. Why we use your data and our legal bases

Under the UK GDPR we need a legal basis for each use of your data. We rely on:

• Contract: to create and run your account (including checking you are 13 or older), provide the features you ask for and supply Premium.
• Legitimate interests: to publish alerts so the public can help, run matching, send match emails, keep the Service secure, prevent abuse and fraud, and understand overall usage so we can improve. We only rely on this where your rights do not outweigh our interests.
• Consent: for optional analytics cookies and anything else where we clearly ask you. You can withdraw consent at any time.
• Legal obligation: where the law requires us to process or keep data, for example tax records for payments or responding to lawful requests.

4. Public alerts

Alerts are designed to be public so people can help. Anything you include, such as photos and the location you pin, can be seen by anyone and may be indexed by search engines or copied by others.

The pin is shown on the map exactly where you place it. Unless it matters for the search, pin a nearby street, park or landmark rather than your home.

Your phone number and email are not displayed on the alert page. A visitor has to pass an automated bot check before they can see them, and you can switch either one off at any time. Digital Collar pages are set to stay out of search results, although we can't fully control how search engines behave.

Please don't put sensitive information, such as health details or your home address, in an alert.

5. Matching and automated processing

We use automated systems, including AI, to turn photos and text into numerical image data (known as embeddings). We compare this data across alerts to suggest possible matches. We also use automated filters to catch spam and nudity.

Matching only makes suggestions; people decide what to do with them. It does not make decisions that have legal or similarly significant effects on you. Automated moderation can remove content, and you can ask us to review any such decision.

We use this data only to reunite pets, keep the Service safe and improve it. We do not sell personal data or use it to build advertising profiles.

6. Who we share data with

What you publish in an alert is visible to the public. Beyond that, we share data only as needed with service providers who process it for us under contract:

• Hosting and storage: Vercel (website hosting), MongoDB (database), Upstash (temporary caching), S3-compatible cloud storage (photos) and Qdrant (image matching data).
• Our email delivery provider, for account emails and match notifications.
• Stripe, for payments.
• Prelude, to send phone verification codes by SMS.
• Cloudflare Turnstile, to check that visitors are human.
• Google Tag Manager, the analytics tools it loads, and Vercel Web Analytics, only if you accept analytics cookies.
• Google, Facebook, X or Microsoft, if you choose to sign in with them.
• OpenStreetMap's Nominatim service, which turns the addresses you search for into map locations.

We may also share data where the law requires it, to protect people's safety or rights, or as part of a sale or reorganisation of our business, with suitable protections in place. We do not sell your personal data.

7. International transfers

Our providers store and process data in the UK, the EU, the US and sometimes other regions. When data leaves the UK, we rely on UK adequacy regulations or use safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep data

We keep personal data only for as long as we need it:

• Account data, alerts and pet profiles: while your account is open. When you delete your account, we remove them from our live systems straight away.
• Backups: deleted data can remain in backups for a limited period until they are overwritten.
• Payment records: for as long as tax and accounting law requires, usually six years.
• Security logs, reports and messages to us: only as long as needed to deal with the issue or protect the Service.

Deleting data from our systems doesn't remove copies held by search engines or other websites. You can delete your account at any time from your profile.

9. Cookies

We use necessary cookies to keep you signed in and protect the site. These don't need your consent. Analytics cookies and tools (Google Tag Manager and what it loads, plus Vercel Web Analytics for page views) are used only if you accept them in the cookie banner. Analytics data can still be personal data even when identifiers are shortened, so we treat it as such. You can change your choice at any time in the cookie settings.

10. Your rights

You have the right to access your data, correct it, have it deleted, restrict how we use it, object to how we use it, and receive a copy in a portable format. Where we rely on legitimate interests, you can object and we will stop unless we have compelling reasons to continue. Where we rely on consent, you can withdraw it at any time. Some of these rights have legal limits.

To use your rights, contact us through the contact form or at hi@dotsquad.net. We will reply within one month. If your request is complex, we may extend this by up to two more months and will tell you why.

If you are unhappy with how we have handled your data, please complain to us first and we will look into it. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live outside the UK, to your local data protection authority.

11. Security

We use technical and organisational measures suited to the risks, including access controls and encryption of data in transit. No system is completely secure, so please use a strong password and keep your login details private.

12. Children

UnLostPaws is for people aged 13 and over. After you create an account, we ask for the month and year of your birth to check you meet that age. We do not publish this information. We do not knowingly keep accounts for children under 13; if the details show you are under 13, we close the account and delete related personal data. If you think a child under 13 has given us personal data, contact us and we will delete it.

13. Users outside the UK (including the EEA and Switzerland)

Our home base is the United Kingdom, and the UK GDPR is the standard we apply to everyone. We also welcome users in the EEA, Switzerland and elsewhere. If you live in the EEA, the EU GDPR may also apply to you; if you live in Switzerland, the Swiss Federal Act on Data Protection may apply. Those laws may give you extra rights. You can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EEA or Switzerland, to your local data protection authority. Contact us first via the contact form or hi@dotsquad.net so we can try to help.

14. Changes to this Policy

We may update this Policy from time to time and will change the date at the top when we do. For significant changes, we will let you know, for example with a notice on the site or by email. If the law requires your consent to a change, we will ask for it.

15. Contact us

For questions or privacy requests, use our contact form or email hi@dotsquad.net.