Privacy Notice
Last updated: November 13, 2026
Who we are
Tuft Global Ltd (“Tuft”, “we”, “us”) runs the Tuft app and website. The app connects pet parents with pet services, such as nearby groomers, and provides pet services software to manage bookings.
- Registered office: Office A07, 35 Bow Road, London, E3 2AD, England. Company number 12262645
- Data controller: Tuft is registered with the Information Commissioner’s Office (ICO) under reference ZC275538.
- Data Protection Officer: Chloe Smith, dpo@tuftapp.com
- Where we operate: the United Kingdom, Ireland and the European Union, and the United States.
This notice explains what personal data we collect, why, who we share it with, how long we keep it, and your rights. If anything is unclear, email dpo@tuftapp.com.
The personal data we collect (Pet parents)
| Type of data | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, phone number, password (stored encrypted) | You |
| Location | Postcode and address; your device’s location if you allow it | You and your device |
| Pet details | Name, species, breed, age, and any notes on health, behaviour or coat | You, or the pet service you book with |
| Bookings | Appointments, services, prices, cancellations, no-shows | You, the pet service, and the app |
| Payments | Amounts, payment status and refunds. Card details go straight to our payment provider; we never see or store the full card number | You and our payment provider |
| Messages and reviews | Messages with pet services and reviews you write | You |
| How you use Tuft | Searches, the pet services you were shown, profiles you opened, how you reached a pet service, the date you were last active | The app and website |
| Device and technical | Device type, operating system, app version, push notification token, IP address, cookies | Your device |
| Marketing choices | Your email, SMS and push preferences, and your consent records | You |
| Pet service details | Business name, address, contact details, opening hours, services, prices, staff names. | The pet service, and public sources for unclaimed listings |
Pet health and behaviour notes are not special category data under data protection law, because they are about the pet, not you. Even so, we share them only with the pet services you book with.
How we use your data and our lawful basis (Pet parents & services)
The law requires a lawful basis for every use of personal data. Here is the basis for each thing we do.
| What we do | Who it applies to | Lawful basis |
|---|---|---|
| Create and run your account, take bookings, send booking confirmations and reminders | Pet parents, pet services | Contract |
| Take payments and pay pet services | Pet parents, pet services | Contract |
| Let you message pet services and leave reviews | Pet parents, pet services | Contract |
| Show pet services near you using your postcode or location | Pet parents | Contract. Device location only with your permission (consent) |
| Record how you found a pet service, to work out Introduction Fees (see Introductions) | Pet parents | Legitimate interests |
| Keep financial and tax records | Everyone who pays or is paid | Legal obligation |
| Keep Tuft secure and stop fraud and misuse | Everyone | Legitimate interests |
| Improve the app using usage data, for example which features are used and where sign-ups stall | Everyone | Legitimate interests |
| Send service messages, for example security alerts or changes to these terms | Everyone | Contract or legitimate interests |
| Send marketing by email, SMS or push (see Marketing) | Pet parents, pet services | Consent, or the “soft opt-in” for existing customers |
| Measure our adverts using cookies and similar tools | Website and app visitors | Consent |
| Publish free listings of pet services from public sources | Pet services | Legitimate interests |
| Deal with complaints, disputes and legal claims | Everyone | Legitimate interests or legal obligation |
Where we rely on legitimate interests, we have weighed our interests against yours. You can ask us for that assessment, and you can object at any time (see Your rights).
Introductions: how we record that Tuft introduced you (Pet parents)
When Tuft introduces you to a pet service you hadn’t used before, that pet service pays Tuft an Introduction Fee. You never pay this fee, and it does not change the price you pay. To charge the fee fairly, we have to be able to show that the introduction came through Tuft.
What we record
- Which pet services appeared in your search results, and when.
- Which pet service profiles you opened, and when.
- How you reached a pet service: through Tuft search, a Tuft link, the pet service’s own booking link, or the pet service adding you as a client.
- Your answer to “How did you find this pet service?”, if you give one.
- The date of your first booking with that pet service.
Who sees it
- The pet service you book with sees a short summary, for example “Found you through Tuft search on 3 Oct”. They do not see your other searches or the other pet services you looked at.
- If a pet service disputes a fee, Tuft staff review the evidence. The pet service may send its own evidence, such as earlier records showing you were already their client.
Lawful basis: legitimate interests. We need these records to run a fair marketplace and charge pet services correctly. The records only show how you used Tuft to find a pet service.
How long we keep it
- Discovery records that never lead to a booking are deleted after 12 months.
- An introduction ends 12 months after it starts. After that, no fee is charged.
- Records behind a fee that was charged are kept with our financial records (see How long we keep your data).
- Evidence sent in for a dispute is deleted 90 days after the decision.
Your choice: you can object to these records by emailing dpo@tuftapp.com. Search and booking keep working either way. We will stop recording your discovery activity unless we have a compelling reason to continue, for example a fee dispute that is already open.
Marketing, notifications and personalisation
Email and push marketing. We may tell you about pet services near you, offers, and features you haven’t tried yet. We only do this if you agreed, or if you’re an existing customer and it is about services like the ones you’ve used (the “soft opt-in”). Every email has an unsubscribe link. You can turn off push notifications in the app or in your phone’s settings.
Personalised messages. We use your postcode, the pet services near you, your bookings and when you were last active to choose which messages to send. For example, we may tell you when a new pet service opens nearby, or remind you if you haven’t booked for a while. These messages do not affect your legal rights. You can object to them at any time.
Pet services. Pet services on Tuft may receive emails that depend on how far they’ve got with setting up, for example reminders to finish their profile. They can unsubscribe from non-essential emails.
Ads and measurement. With your consent, our website uses tools from Google and Meta to tell whether our adverts led to an app install, a sign-up or a booking. You can change your choice at any time in the cookie settings or your phone’s privacy settings. See our Cookie Policy.
App. Our app uses Google Analytics for Firebase to count how the app is used, for example how many people open it, sign up and make a booking, so we can improve it. We also tell Google Ads how many people installed and first opened the app after our Google ads, so we can see which ads work. We don’t send your name, email or phone number to Google for this, and we don’t share this information with any other ad company. You can object at any time by emailing dpo@tuftapp.com, and we’ll stop collecting it for you and delete what’s linked to your account.
Where you joined from. If you join Tuft through a link from one of our ads, we note the ad channel (for example “reddit”), the campaign and the area, and keep this with your account. On Android, the Tuft app finds this out once, when you first open it, from the link information Google Play keeps for the app. We keep only the ad channel, campaign and area, and drop everything else.
It travels in the link itself: we don’t read anything from your phone or save anything in your browser to do this, and we don’t keep the codes ad companies add to their links. We never tell ad companies about you, and never send them your name, email, phone number, a scrambled (“hashed”) copy of these, or a device ID. We never upload customer lists to ad companies.
We do this because it’s in our legitimate interests to know which ads are worth paying for, and we only use it in totals. We keep it for as long as your account exists and remove it when the account is anonymised. To object, email dpo@tuftapp.com and we’ll remove it.
Automated decisions. We do not make decisions about you by automated means alone that have legal or similarly significant effects on you.
SMS (United States only)
Pet parents are not automatically signed up for SMS reminders. A booking confirmation email includes a link to your notification preferences, and SMS reminders are sent only after you opt in there. We keep records of SMS opt-ins and opt-outs.
We send transactional SMS, including verification codes, booking confirmations, appointment reminders, updates and cancellations, and important service notices. How often depends on your activity and preferences. Marketing SMS is sent only with your explicit consent. Message and data rates may apply.
Reply STOP to unsubscribe from marketing SMS, or HELP for help, or contact support@tuftapp.com. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent are never shared with any third party.
If you are a pet service
Free listings. We create some listings from public sources such as Google Business Profiles and pet services’ own websites. A listing shows the business name, address, contact details and opening hours. Many pet services trade under their owner’s own name, so a listing can include personal data. We rely on legitimate interests: helping pet parents find local pet services. To have your listing removed, email support@tuftapp.com. We remove it within 5 working days.
Claimed profiles and public pages. When you claim a listing or sign up, your profile can appear on public Tuft pages, including our online directory. Search engines and AI search tools can find these pages.
Your account. We use your business, staff, payout and subscription details to provide the software under our contract with you. Payouts and Introduction Fees are handled through our payment provider, Ryft. Fee records are kept with our financial records.
Demos that don’t go further. If you book a demo but don’t become a member, we send you no more than 4 follow-up emails.
Your clients. When you add or import clients into Tuft, you decide why their data is used. You are their data controller, and Tuft processes that data for you under our terms with you. When one of your clients also uses the Tuft app as a pet parent, Tuft is the controller of their app account. It is your responsibility to tell your clients that you use Tuft and link to this notice.
Who we share your data with
We never sell your personal data. We share it only with the people and companies below, and only what they need.
| Who | What they get | Why |
|---|---|---|
| Pet services you book or message | Your name, contact details, pet details, bookings, messages, and an introduction summary | To provide the service you booked |
| Ryft (payments) | Payment and payout details | To take payments and pay pet services |
| AWS – Amazon Web Services, Cloudflare. | All app data, stored for us | To run Tuft |
| Google (Drive backups, Google Ads, Firebase, Analytics) | Backups; with consent, ad and app-install measurement | Backups and ad measurement |
| Meta | With consent, ad measurement | To measure our adverts |
| Cloudflare | Website traffic, including IP addresses | Security and fast page loading |
| SMS Works | Phone number and message content | To send SMS |
| Gmail | Email address and message content | To send email |
| Google Firebase | Device token and message content | To send push notifications |
| Our contractors, including developers in India | Access to systems as their work needs, under contract and a confidentiality agreement | To build and support Tuft |
| Our professional advisers, the police, regulators and courts | Only what is required | Legal obligations and legal claims |
| A buyer of Tuft’s business | Data relevant to the sale | If Tuft is sold or merged; we will tell you first |
Companies that process data for us must follow our instructions and keep it secure under a written contract.
International transfers
Your data is stored in the UK, London. Some of it is accessed or processed outside the UK:
- India: our development contractors. We protect these transfers with the UK International Data Transfer Agreement (IDTA).
- United States: some of our providers, such as Google, Meta and Cloudflare. We rely on the UK–US Data Bridge where the provider is certified, or on contractual safeguards where it isn’t.
- EU and US customers: your data may be stored and processed in the UK. The UK has an adequacy decision from the EU.
To ask for a copy of these safeguards, email dpo@tuftapp.com.
How long we keep your data
| Data | How long |
|---|---|
| Your account, pets and bookings | While your account is open, then 36 months after it closes. Records we must keep for audit purposes are kept but restricted (see below) |
| Payment, fee and payout records | 6 years after the end of the financial year (UK tax law) |
| Discovery records that never led to a booking | 12 months |
| Introduction records behind a charged fee | With the payment records: 6 years |
| Fee dispute evidence | 90 days after the decision |
| Messages | 6 months after the last message, or while the account is open |
| Marketing consents and opt-outs | As long as we contact you, plus 2 years as proof |
| Device and usage data | 36 months |
| Free listings | Until the pet service asks us to remove it, or the business closes |
When you close your account, we remove or anonymise data we no longer need. We do not delete records we must keep for legal, tax or audit reasons. Instead, we restrict them, so they are used only for those reasons. Anonymised data that can’t identify you may be kept for statistics.
Your rights
You have the right to:
- Access: get a copy of your personal data.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted, unless we must keep it, for example for tax.
- Restriction: ask us to limit how we use your data.
- Object: object to anything we do on the basis of legitimate interests, including Introduction records and personalised messages. You can object to direct marketing at any time, and we will always stop.
- Portability: receive data you gave us in a machine-readable format.
- Withdraw consent: at any time, for anything based on consent. This does not affect what we did before.
To use any of these rights, email dpo@tuftapp.com. We reply within one month. Using your rights is free.
US residents. Depending on your state, you may also have the right to know, delete and correct your data, and to opt out of targeted advertising. We do not sell personal data.
Children
Tuft is for people aged 18 and over. We do not knowingly collect data from children.
Security
We encrypt data in transit, store passwords encrypted, limit staff and contractor access to what their role needs, and keep access logs. No system is completely secure. If a breach puts you at risk, we will tell you and the ICO as the law requires.
Complaints
If you’re unhappy with how we handle your data, contact dpo@tuftapp.com first. You can also complain to the Information Commissioner’s Office. If you’re in the EU, you can complain to your local data protection authority, for example the Data Protection Commission in Ireland.
Changes to this notice
We will update this notice when what we do changes. If a change is significant, we’ll tell you by email or in the app before it takes effect.
Last updated: 02nd November 2026 · Version 2.0