LEGAL

Privacy policy

Last updated 10 November 2026

Who we are

Puppup is run by Brandon Mojica, a sole trader trading as Puppup, based in the United Kingdom. For this policy, “we”, “us” and “our” mean Puppup. We are the controller of the personal data about our members described here. For people who book events on a member’s booking page, see People who book events.

What we collect and why

Data	Why we use it	Lawful basis
Account details: email address, a unique account ID, and your name if you sign in with Google. Passwords are handled by Google Firebase; we never see them.	To create and secure your account and let you sign in on any device.	Contract
Membership and payment details: your subscription status, plan, renewal and cancellation dates, and the billing details you give our payment provider, Stripe. Your card details go straight to Stripe; we never receive or store them.	To take payment, give you access while your membership is active, and keep tax and accounting records.	Contract; legal obligation (records)
Your search area: the postcode or town you enter, its approximate map location, your chosen radius and any counties you skip.	To show you litters near you. Saved to your account so it works on any device.	Contract
Your board: the litters you save, their status and any notes you write.	To provide the planner. Please don’t put sensitive personal information in your notes.	Contract
Your venues: venues you save, their checklist answers, costs, contact details and notes.	To provide the venue board.	Contract
Your business profile and events: business name, booking link, town, Instagram, about text, contact email, licence number, council and expiry, refund policy, and your events.	To publish your booking pages. These details are shown publicly on your booking pages.	Contract
Your Stripe connection: your connected Stripe account ID and whether it can take payments, and records of the bookings and ticket fees on it. Stripe collects your identity and bank details directly; we don’t see them.	To take bookings for you, collect our ticket fee and keep accounting records.	Contract; legal obligation (records)
Visit times: when you last opened the app.	To tag litters that are new since your last visit.	Legitimate interests (a useful service)
Messages you send us: emails and anything you include in them.	To answer you and provide support.	Legitimate interests
Technical data: IP address, browser type and request logs kept by our hosting and security providers.	To run the website securely and prevent abuse.	Legitimate interests (security)

We don’t sell your personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

Puppy listings

The litters shown to members come from public listings on Pets4Homes. We show a limited summary (breed, town and county, litter size, approximate location and the date it was listed) and link to the original listing. We don’t collect breeders’ names or contact details. If you’re a breeder and want a listing removed from Puppup, email us and we’ll remove it.

People who book events

When you book an event on a Puppup booking page, the host business named on that page is the controller of your booking information, and we handle it on their behalf to run the booking. We collect your name, email address, your answers to the host’s questions, the tickets and session you chose, whether you’ve paid or been refunded, and whether you’ve been checked in on the day. If you join a waitlist we collect your name, email and how many places you want. If you buy a gift voucher we collect your name and email, and the name, email and message you give for the person it’s for (we use the recipient’s email only to send them the voucher, if you ask us to). We use these details to send your tickets, voucher, waitlist alerts and a reminder the day before your event. Your payment is taken by Stripe on the host’s Stripe account; we never see your card details.

Your booking information is shared with the host so they can run the event and contact you about it. We keep it while the host has a Puppup account and delete it within 30 days of them closing it, except records of our ticket fees, which we keep for 6 years for tax. To use your data rights, contact the host; you can also email us and we’ll pass your request on and help.

We also use limited booking information as a controller ourselves, to prevent fraud and abuse of the platform and to keep our fee records, on the basis of our legitimate interests and legal obligations.

Who we share data with

We use trusted providers (“processors”) to run Puppup. They only use your data to provide their service to us:

Google (Firebase Authentication, Cloud Firestore, Google Cloud): sign-in, and storing your account, board, venues, search area, business profile, events and bookings. Your saved data is stored in Google’s London region.
Google Maps Platform (Places): when you search for venues, our server sends the map location of your search area to Google to find venues nearby. Nothing that identifies you is sent.
Stripe: payments, subscriptions, the billing portal, and ticket payments on hosts’ own Stripe accounts. Stripe is also an independent controller for some data, such as fraud prevention; see Stripe’s privacy policy.
Resend: sending booking emails (tickets and refund notices) to the name and email address given when booking.
Vercel: hosting the website.
postcodes.io: when you set your area, your browser sends the postcode or town you typed to this free UK postcode service to find its map location. Nothing else about you is sent.

We may also share data if the law requires it, or to protect our rights or the safety of others.

International transfers

Some of our providers are based in, or may access data from, the United States or other countries. Where that happens, transfers are protected by UK adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement or Addendum, as appropriate.

How long we keep it

Account, board, venues, search area, business profile and events: while your account is open. If you ask us to delete your account, we delete them within 30 days.
Bookings made on your booking pages: while your account is open, then deleted within 30 days of it closing (fee records are kept for 6 years).
Payment and invoice records: 6 years after the end of the tax year they relate to, as UK tax law requires.
Support emails: up to 2 years after we last hear from you.
Hosting and security logs: kept by our providers for short periods, usually days to weeks.

Cookies and storage on your device

We only use storage that’s needed for Puppup to work: keeping you signed in (Firebase), remembering your search area and membership on this device, and the secure checkout and billing pages run by Stripe. We don’t use analytics or advertising cookies, so we don’t ask for cookie consent. If we ever add optional cookies, we’ll ask first.

Your rights

Under UK data protection law you can ask to access your data, correct it, delete it, restrict or object to how we use it, or receive a copy in a portable format. Email bmojica1234@gmail.com and we’ll reply within one month. You can update your email and payment details at any time from your account and the billing portal.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Security

Your account data can only be read by you once you’re signed in, and every request is checked on our server. Booking details are only shown to the host who owns the event, and to the guest through their private confirmation link. Payments are handled entirely by Stripe. No system is perfectly secure, but we’ll tell you and the ICO promptly if a breach puts your data at risk.

Children

Puppup is for businesses and adults aged 18 or over. We don’t knowingly collect data from children.

Changes

If we change this policy we’ll update the date at the top, and tell members by email or in the app about any significant change.