Privacy policy — Scritches pet care software

Scritches Software, LLC (“Scritches,” “we,” “us,” or “our”) provides software that helps pet care businesses run their operations (the “Platform”). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to the Scritches website, web and mobile applications, client portals and booking pages (including those hosted on a pet care business’s own domain), and related services.

By using the Platform you agree to this Privacy Policy. If you do not agree, please do not use the Platform.

1. Who this policy covers and our role

The Platform is used by three kinds of people:

Pet Care Providers (“Providers”): businesses and their owners who create a Scritches account to manage scheduling, clients, invoicing, and payments.
Staff: people a Provider invites to work inside its account.
Clients: customers of a Provider who book services, pay invoices, sign agreements, or otherwise interact with a Provider through Scritches.

For Provider account data (for example the Provider’s own name, login email, billing details, and subscription), Scritches decides how and why the data is processed. In privacy-law terms we are the “controller” or “business.”

For Client, pet, staff, booking, and payment data that a Provider enters or collects through the Platform, the Provider decides how and why that data is collected and used. Scritches processes it on the Provider’s behalf and according to the Provider’s instructions. In privacy-law terms the Provider is the controller and Scritches is the “processor” or “service provider.”

If you are a Client and have questions about how your Provider handles your information, or you want to access, correct, or delete information your Provider holds about you, please contact your Provider first. We will help Providers respond to those requests and we will forward requests that reach us directly.

Providers who need a Data Processing Agreement (DPA) can request one at support@scritches.io.

2. Information we collect

Information you give us

Account information: name, email address, phone number, password or one-time login code, business name, business address, timezone, logo and branding, and profile photo.
Client and pet information (entered by Providers, Staff, or Clients): client names, emails, phone numbers, home and service addresses, emergency contacts, home access instructions, pet names, breeds, ages, photos, medical and behavioral notes, veterinarian details, and any custom fields or intake form answers a Provider chooses to collect.
Staff information: names, contact details, photos, roles and permissions, compensation rates, and payroll summaries entered by the Provider.
Bookings, invoices, and communications: service requests, schedules, notes, report cards, photos and videos from visits, messages, review requests, and emails or texts sent through the Platform.
Documents and signatures: agreements, documents, and e-signature records, including the signer’s name, the time of viewing and signing, and the IP address used to sign.
Payment information: when you pay or get paid through the Platform, payment details are collected directly by our payment processor, Stripe. We receive and store limited information such as card brand, last four digits, expiration date, payment status, payout status, and transaction history. We do not store full card numbers.
Support and feedback: anything you send us when you contact support, respond to surveys, or post feedback.

Information collected automatically

Usage data: pages and features used, actions taken, timestamps, referring pages, and similar interaction data.
Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, device type, language, and screen size.
Device fingerprint and fraud signals: we use a device identification service to generate an identifier for the device used to sign up or log in. We combine this with IP address, signup patterns, and account activity to detect and prevent fraudulent accounts, stolen payment cards, and abuse.
Session recordings: we use an analytics tool that records how users interact with the Platform, including page navigation, clicks, scrolling, form interactions, and browser console errors. These recordings are linked to your account so we can diagnose problems you report. Password fields are masked. Payment card details are entered in fields hosted by Stripe and are not captured. Other information you type into the Platform may appear in recordings. Recordings are retained for 90 days and are accessible only to Scritches personnel for debugging and product improvement.
Cookies and similar technologies: see Section 8.

Information from third parties

Sign in with Google: if you sign in with Google we receive your name, email address, and profile picture.
Google Calendar: if you connect Google Calendar we access and write to the calendars you choose in order to sync bookings. See Section 9.
Data imports: Providers may import client, pet, and booking data from other software or spreadsheets. Providers are responsible for having the right to import that data.
Payment processor: Stripe shares payment, payout, dispute, and verification status with us so we can show it in the Platform.

3. How we use information

We use information to:

Provide, operate, maintain, and improve the Platform, including scheduling, invoicing, payments, client portals, booking pages, report cards, and messaging.
Create and manage accounts, authenticate users (including one-time codes sent by email or SMS), and provide customer support, which may include a Scritches support team member viewing your account with your knowledge to troubleshoot an issue.
Process payments and payouts, manage subscriptions and free trials, and handle refunds, credits, and disputes.
Send transactional communications on behalf of Providers to their Clients, such as booking confirmations, reminders, invoices, receipts, report cards, agreement requests, and review requests.
Send service communications about your account, such as security alerts, billing notices, and changes to the Platform or these terms.
Send product updates, tips, and marketing about Scritches to Providers, which you can opt out of at any time.
Advertise Scritches on Meta (Facebook and Instagram) to people who have visited our marketing website, and measure which ads lead to sign-ups (see Section 8).
Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms, including through device fingerprinting and IP analysis.
Analyze usage to understand how the Platform performs and to plan improvements, including through aggregated statistics and session recordings.
Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we never use Client, pet, or Staff data to advertise to anyone. Information about visitors to our marketing website and about Providers who sign up is used only to advertise Scritches itself, as described in Section 8.

Between Providers and their Clients and Staff: information a Client enters is visible to their Provider and the Provider’s authorized Staff. Information a Provider enters about a Client (such as bookings, invoices, report cards, and agreements) may be visible to that Client in the client portal, according to the Provider’s settings.
Publicly, where a Provider chooses: Providers can publish booking pages, service menus, and business profiles, including on custom domains. Information on those pages is public. Review Booster may help Providers request public reviews from Clients on third-party sites.
Service providers (sub-processors): companies that help us run the Platform, bound by contracts that limit their use of your data. They currently include:
- Stripe (payments, payouts, subscription billing, identity verification for Providers)
- Amazon Web Services (hosting, file storage, email delivery)
- Cloudflare (networking, security, custom domain hosting)
- Mux (video processing and delivery)
- PostHog (product analytics and session recording)
- Sentry (error monitoring)
- Fingerprint (device identification for fraud prevention)
- Google (sign-in and calendar sync, where you connect them)
- Twilio (text message delivery)
- Featurebase (support, feedback, and help center)
- Contentful (marketing site content) We will update this list as our vendors change.
Advertising partner: Meta Platforms, to show Scritches ads to people who have visited our marketing website and to measure sign-ups from those ads. Details and how to opt out are in Section 8.
Legal and safety: when we believe disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of Scritches, our users, or the public, or to enforce our Terms.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change in ownership or in how your information is handled.
With your consent: for anything not covered above, we will ask first.

5. Data retention

Provider account data: kept while the account is active. After a Provider cancels its subscription, we keep the account and its data so the Provider can export or reactivate, until the Provider asks us to delete it, at which point we delete it within 30 days, except as noted below.
Client, pet, booking, and document data: kept for as long as the Provider keeps it in the Platform, then deleted on the schedule above when the Provider’s account is deleted. Providers can delete individual Clients, pets, documents, and media at any time.
Payment and invoice records: kept for 7 years to meet tax, accounting, and dispute obligations.
E-signature records: kept for as long as the related agreement is kept by the Provider, to preserve the evidentiary value of the signature.
Fraud and security data: device fingerprints, IP addresses, and related signals may be kept for up to 2 years after the related account is closed to prevent repeat abuse.
Session recordings: 90 days. Server logs and error reports: 90 days.
Backups: deleted data may persist in encrypted backups for up to 35 days before being overwritten.

6. Security

We use industry-standard safeguards including encryption in transit (TLS) and at rest, access controls and role-based permissions, one-time login codes, rate limiting, fraud monitoring, and logging of administrative access. Scritches personnel access customer accounts only to provide support, investigate abuse, or maintain the Platform. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information we will notify you and any relevant authorities as required by law.

7. Your rights and choices

Depending on where you live, you may have the right to:

Access the personal information we hold about you and receive a copy in a portable format.
Correct inaccurate or incomplete information. Most account information can be edited directly in the Platform.
Delete your information. Providers can request deletion of their account by emailing support@scritches.io; Clients can ask their Provider or contact us. Some information may be retained as described in Section 5.
Object to or restrict certain processing, and withdraw consent where processing is based on consent.
Opt out of marketing: use the unsubscribe link in any marketing email. You will still receive transactional and account messages while you use the Platform.
Opt out of SMS: reply STOP to any text message from us or a Provider sent through the Platform.
Opt out of advertising sharing: email support@scritches.io (see Section 8).
Not be discriminated against for exercising these rights.

To exercise a right, email support@scritches.io. We may need to verify your identity before acting. We respond within the time required by applicable law, generally within 30 days. If you are a Client of a Provider, we may refer your request to the Provider or coordinate with them, because the Provider controls that data.

You can also lodge a complaint with your local data protection authority.

8. Cookies and tracking

We use cookies, local storage, and similar technologies for:

Essential: keeping you logged in, remembering preferences, security, and fraud prevention. These cannot be turned off.
Analytics and session recording: understanding how the Platform is used and diagnosing bugs (PostHog). You can opt out by emailing support@scritches.io or by blocking analytics in your browser; the Platform will still work.
Advertising (marketing website only): our marketing website, scritches.io, uses the Meta pixel. It sets cookies and tells Meta which pages you visit, so we can show Scritches ads on Facebook and Instagram to people who have visited our website and measure how those ads perform. When a Provider starts a free trial or subscribes, our servers also tell Meta, sending the Provider’s email address and name in hashed (one-way encoded) form, along with the identifiers the Meta pixel set and the browser’s IP address and user agent, so we can see which ads led to sign-ups. Meta uses this information under its own Privacy Policy.

We do not use advertising cookies inside the app, client portals, or booking pages, and we never send Client, pet, or Staff information to Meta.

To opt out of advertising sharing, email support@scritches.io. You can also adjust your ad preferences in your Facebook or Instagram settings. You can control cookies through your browser settings, but disabling essential cookies may prevent the Platform from working.

9. Google API Services and Google Calendar

When you sign in with Google or connect Google Calendar, we request access only to the scopes needed: your basic profile and email for sign-in, and calendar read/write access to sync bookings to the calendars you select. Scritches’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or to comply with law. You can disconnect Google Calendar in the Platform or revoke access at any time in your Google Account settings.

10. Text messages (SMS)

Providers may enable text messages to their Clients through the Platform, and we may send one-time login codes by text. Messages are one-way notifications such as booking confirmations, reminders, report cards, and invoices. Message frequency depends on your bookings. Message and data rates may apply. Reply STOP to opt out or HELP for help; replies other than STOP and HELP are not monitored. Carriers are not liable for delayed or undelivered messages. Mobile phone numbers and opt-in status are not shared with third parties for marketing purposes. Providers are responsible for obtaining consent from their Clients before enabling texts to them.

11. International users and data transfers

Scritches is based in the United States and stores and processes data in the United States. If you use the Platform from outside the US, your information is transferred to and processed in the US, where privacy laws may differ from those in your country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland, and we will enter into a DPA with Providers on request.

EEA, UK, and Switzerland. Our legal bases for processing are: performance of our contract with you (providing the Platform); our legitimate interests (securing and improving the Platform, preventing fraud, and marketing to business customers); compliance with legal obligations; and consent, where we ask for it (for example, optional analytics and marketing). You have the rights described in Section 7.

California. The categories of personal information we collect are described in Section 2, the purposes in Section 3, and the recipients in Section 4. We do not sell personal information. We do “share” personal information, as California law defines that term, for cross-context behavioral advertising: identifiers (cookie IDs, IP address, and, for Providers who sign up, hashed email address and name) and activity on our marketing website are shared with Meta to advertise Scritches, as described in Section 8. You can opt out of this sharing by emailing support@scritches.io. We do not use or disclose sensitive personal information for purposes other than providing the Platform. California residents can exercise their rights as described in Section 7 and may designate an authorized agent to do so.

Canada, Australia, and other regions. We comply with applicable privacy laws in the regions where we operate and will honor rights requests as described in Section 7.

12. Children’s privacy

The Platform is for adults. We do not knowingly collect personal information from children under 16 (or under 13 in the United States). If we learn we have collected such information we will delete it. Pet information is not considered children’s information.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “Last Updated” date. Continued use after the effective date means you accept the updated policy.

14. Contact us

Scritches Software, LLC
30 N Gould St Ste N, Sheridan, WY 82801
support@scritches.io