Skip to content

Privacy Policy

Last updated: June 15, 2026. This policy applies to pawlisted.com and all subdomains.

1. Who we are

PawListed, LLC is a Utah Limited Liability Company that operates the website located at https://pawlisted.com. For the purposes of GDPR and the UK GDPR, PawListed, LLC is the data controller. Our mailing address is:

PawListed, LLC
c/o Registered Agent
Salt Lake City, UT 84101
United States

2. Information we collect

We collect information that you provide directly to us, and a small amount of information automatically:

Information you provide

  • Account: name, email, hashed password (bcrypt).
  • Business claims: legal name, business address, contact email, verification documents (e.g., utility bill, business license).
  • Reviews: rating, free-text review, optional pet details, IP address, user agent, and timestamp.
  • Communications: emails you send us, support tickets.

Information we collect automatically

  • Server logs: IP address, user agent, URL, HTTP status, response size. Retained for 90 days.
  • Analytics: anonymized page views, referrer, device class, country, via Google Analytics 4. IP addresses are anonymized before storage. Retained for 14 months.
  • Cookies: one session cookie for authentication, and Google Analytics cookies described in our Cookies section below.

3. How we use your information

We use the information we collect to:

  • Provide, maintain, secure, and improve the website.
  • Authenticate users and prevent abuse (legal basis: legitimate interest and contract performance).
  • Process and display reviews and ratings (legal basis: consent — you choose to submit).
  • Respond to your comments, questions, and support requests (legal basis: contract performance).
  • Send you essential service notifications (login, review replies, claim status — legal basis: contract performance). You cannot opt out of these.
  • Send you optional product updates and newsletters, only if you opted in (legal basis: consent). You can unsubscribe at any time.
  • Measure aggregate site traffic and improve content (legal basis: legitimate interest).
  • Comply with legal obligations and respond to lawful requests.

4. Data retention

  • Account data: Until you delete your account, plus 30 days for backup cycles.
  • Reviews: Indefinite, unless you delete them or we are legally required to remove them. Anonymized aggregates (avg rating, count) may be retained after deletion.
  • Business claims: While the business is claimed, plus 7 years for tax / accounting purposes.
  • Support emails: 3 years from last contact, then deleted.
  • Analytics: 14 months (Google Analytics default), then auto-deleted.
  • Server logs: 90 days, then auto-deleted.

5. Third-party processors

We share your information only with the vendors listed below. Each is bound by a data-processing agreement and only receives the minimum data needed for its purpose.

  • PostgreSQL database (self-hosted on Hetzner / OVH) — Stores accounts, businesses, reviews, and articles. (United States / European Union)
  • Vercel (hosting & serverless functions) — Hosts the website and runs API routes. (Global edge network, primary in US)
  • Google Analytics 4 — Anonymized traffic measurement. (United States)
  • Squarespace (business image hosting) — Some business hero images are served from operator Squarespace sites. (United States)
  • Wix (business image hosting) — Some business hero images are served from operator Wix sites. (United States)
  • Vetco / VCA / MedVet / Brush Bath and Beyond CDNs — Some business hero images are served from operator CDNs. (United States)
  • Postmark (transactional email) — Sends account, claim, and review notifications. (United States)
  • Cloudflare (DNS and edge caching) — DNS resolution and edge cache for the public site. (Global edge network)

6. Information sharing

We do not sell your personal information, and we do not share it with data brokers or third-party advertisers. We share your information only with:

  • The third-party processors listed in section 5, for the purposes described there.
  • Business owners, when you submit a review about their business (your display name, the rating, and the review text).
  • Legal authorities, when required by valid law (subpoena, court order, applicable regulation).
  • A successor entity, in the event of a merger, acquisition, or sale of substantially all of PawListed's assets — with notice to you.

7. Cookies

We use the following cookies and similar technologies:

  • session — a single HTTP-only cookie used to keep you signed in. Expires when you sign out or after 30 days of inactivity. Cannot be opted out of without breaking the site.
  • _ga, _ga_* (Google Analytics) — first-party analytics cookies set by Google Analytics 4. Used to distinguish users and sessions. Retained 14 months. You can opt out by installing the Google Analytics opt-out browser add-on.

8. Your rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

  • Access the personal data we hold about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure ("right to be forgotten").
  • Restriction of processing in specific circumstances.
  • Data portability in a machine-readable format.
  • Object to processing based on legitimate interest, including profiling.
  • Withdraw consent at any time, where processing is based on consent.
  • Lodge a complaintwith your local data-protection authority. (In the EU: your country's lead DPA. In the UK: the ICO at ico.org.uk.)

To exercise any of these rights, email privacy@pawlisted.com with the subject line "Data request." We respond within 30 days.

Legal basis for processing: contract performance (account service), consent (reviews, marketing), legitimate interest (analytics, security), and legal obligation (record-keeping).

International transfers: PawListed, LLC is based in the United States. Where we transfer your data outside the EEA / UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to our processors listed in section 5.

9. Your rights (CCPA / CPRA — California)

If you are a California resident, you have the right to:

  • Know what personal information we collect, use, disclose, or sell.
  • Delete personal information we have collected from you.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of your personal information. (PawListed does not sell or share personal information.)
  • Limit the use of sensitive personal information. (PawListed does not collect sensitive PI as defined under CPRA.)
  • Non-discrimination for exercising your CCPA rights.

To submit a CCPA request, email privacy@pawlisted.com. We will verify your identity before acting on the request. You may also use an authorized agent.

Shine the Light:California Civil Code §1798.83 permits California residents to request information about the categories of personal information disclosed to third parties for those third parties' direct marketing purposes. PawListed does not disclose personal information to third parties for their direct marketing.

10. Your rights (Utah Consumer Privacy Act)

The Utah Consumer Privacy Act (UCPA), effective December 31, 2023, grants Utah residents the right to:

  • Confirm whether a controller is processing the consumer's personal data.
  • Access the consumer's personal data.
  • Delete the consumer's personal data.
  • Obtain a copy of the consumer's personal data in a portable format.
  • Opt out of targeted advertising or the sale of personal data.

To exercise UCPA rights, email privacy@pawlisted.com. We respond within 45 days as required by the UCPA. You may appeal a denial by replying to our response within 30 days.

11. Data security

We implement appropriate technical and organizational measures to protect your personal information, including TLS in transit, bcrypt-hashed passwords, least-privilege access controls on production systems, and audit logging of administrative actions. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

If you discover a security vulnerability, please email security@pawlisted.com with a description and reproduction steps. We do not currently operate a paid bug-bounty program, but we acknowledge reports within 5 business days.

12. Children's privacy

Our website is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@pawlisted.com and we will delete the information.

13. Do Not Sell or Share My Personal Information

PawListed does not sell or share your personal information for cross-context behavioral advertising. We do honor Global Privacy Control (GPC) signals transmitted by your browser. If you would like to submit a manual request to confirm we have not sold your data, email privacy@pawlisted.com.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will notify account holders by email at least 30 days before the changes take effect.

15. Contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

  • Email: privacy@pawlisted.com
  • Postal mail: PawListed, LLC, c/o Registered Agent, Salt Lake City, UT 84101, United States

We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days (45 days under UCPA).