Privacy Policy

TailRoster, Inc. ("TailRoster," "we," or "us") provides the SaaS platform operated at www.tailroster.com and the related pet-parent portal. This Privacy Policy explains what personal data we collect, why we collect it, how we share it, and the rights you have over your data.

TailRoster serves two distinct categories of users: (1) facility operators — the kennel, daycare, grooming, and training businesses who sign up for our software, and (2) pet parents — the customers of those facilities who interact with us through the parent portal, SMS, email, and (where enabled) the iOS app. Where this policy differs by audience, we say so explicitly.

1. Data we collect

From facility operators

• Account data — business name, owner name, email, password hash, role, facility addresses, hours.
• Billing data — Stripe customer + subscription identifiers, last-four digits of payment instruments, billing address. Raw card numbers are tokenized by Stripe and never touch our servers.
• Operational data — customer roster, pet records, reservations, payments, messages, staff timeclock entries, and anything the operator inputs to run their facility.
• Usage telemetry — page views, feature usage, performance metrics, error reports. Used to improve the product.

From pet parents

• Identity — name, email, phone number, mailing address (when you provide one), emergency contact.
• Pet information — name, breed, photos, vaccination records, behavioral notes, medical notes, dietary needs.
• Reservation and payment history with the facilities you patronize.
• Consent records — when, where, and what disclosure text you agreed to for marketing email and SMS.
• Device data when you use the iOS app — device model, OS version, push notification token, and (with your permission) camera access for photo uploads.

2. How we use data

• To provide the service the facility operator hired us for, including messaging you on their behalf about your reservation.
• To send transactional communications (booking confirmations, vaccine reminders, reservation changes). Operators can opt their tenant out; you can opt yourself out per-channel.
• To send marketing communications only with your explicit opt-in consent. We honor STOP, UNSUBSCRIBE, and HELP keywords in SMS and honor unsubscribe links in email immediately.
• To process payments through Stripe (we do not store raw card data).
• To monitor the security and reliability of the platform.
• To comply with legal obligations (TCPA consent recordkeeping, tax records, lawful requests from authorities).

3. Sub-processors

We share personal data with the following vendors solely to operate the service:

4. Your rights

Pet parents

You have the right to:

• Access a copy of the personal data we hold about you — available in-app at Preferences → Export my data or by emailing privacy@tailroster.com.
• Delete your account and associated personal data — available in-app at Preferences → Delete my account. We will anonymize identifying fields within 30 days while retaining financial records required by tax authorities (typically 7 years) in a non-identifying form.
• Correct inaccurate data — edit directly in the parent portal, or contact the facility.
• Opt out of marketing — reply STOP to any SMS, click unsubscribe in any email, or toggle preferences in-app.
• Restrict / object to processing — contact us at the email above.

Residents of California (CCPA / CPRA) and the EEA / UK (GDPR) have additional rights including data portability and the right not to be discriminated against for exercising rights. Submit requests to privacy@tailroster.com. We respond within the timeframe required by the applicable law (45 days under CCPA, 30 days under GDPR).

Facility operators

Operators are data controllers for their customer and pet records; TailRoster is the data processor. If a pet parent makes a deletion or access request, the operator is the primary recipient — TailRoster provides the tools to fulfill it within the platform.

5. Data retention

• Marketing SMS logs: 24 months from send, then PII fields are nulled.
• Marketing email content: 13 months from send, then bodies are nulled (delivery metadata retained for compliance).
• NPS / survey free-text responses: 24 months.
• Reservation + payment records: 7 years (tax-record obligations).
• Audit logs: 7 years.
• Error logs: 90 days.
• Deleted-account anonymization: 30-day SLA.

6. Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 via Supabase). Access to production data is limited to authorized TailRoster personnel and audited via our internal access log. We use row-level security in our database to enforce tenant isolation: one facility cannot read another facility's data. We run continuous monitoring for unauthorized access patterns.

Report a security vulnerability: security@tailroster.com.

7. Children

TailRoster is not directed to children under 13 and we do not knowingly collect personal data from children. If you believe we have collected such information, please contact us and we will delete it.

8. International transfers

Our infrastructure is hosted in the United States. Personal data submitted by users outside the United States will be transferred to, processed in, and stored in the United States, subject to Standard Contractual Clauses or equivalent transfer mechanisms where required.

9. Changes to this policy

We will post the updated policy here with a new "last updated" date. Material changes (new sub-processors, broader categories of data, changes to your rights) will be notified by email to facility operators and via in-app notice to pet parents at least 30 days before taking effect.

10. Contact

See also: Terms of Service.