Data Handling and Deletion

1. Purpose of this policy

This policy explains Pawshare's operational handling of account data, including information received through Facebook Login, and the process for access, correction, and deletion requests. It should be read with the Privacy Policy.

3. How data is stored and separated

• Account, profile, dog, booking, message, care, transaction, report, and safety records are stored in scoped database tables or runtime records appropriate to the feature.
• Database access rules are intended to limit booking, conversation, care-card, report, and verification information to the relevant users and authorised Pawshare administrators.
• Care media and verification documents are intended to use private storage. Public profile, dog, sitter-gallery, route, and demonstration media may use public storage and should contain only information suitable for public viewing.
• Public local Community discovery is held behind separate, default-off profile and post permissions. Pawshare stores a postal-district centre for local matching rather than a home coordinate, projects only a first name and surname initial, and delivers opted-in social photos through a short-lived authorised route. Public source tables are not granted to browser roles.
• Card purchases, cash-out and paid professional care are not active during the community-first launch. If money movement is later approved, the payment provider will handle card or payout-account details while Pawshare stores the minimum transaction and reconciliation records described in the updated privacy notice.
• Administrative access should be used only for support, moderation, verification, safety, fraud prevention, disputes, legal compliance, and service integrity, and should be recorded where the product provides audit logging.

5. Retention and disposal

Active account and marketplace data is retained while it is needed to operate the account and related services. When data is no longer required, it should be deleted or anonymised according to Pawshare's approved retention schedule.

Some booking, payment, payout, safety, moderation, dispute, and audit records may need to be retained after account closure for legal claims, fraud prevention, safeguarding, accounting, tax, or regulatory obligations. Backup copies may remain until the normal backup cycle removes them. Pawshare must document the applicable periods and responsible owner before launch.

7. Requesting account and data deletion

Pawshare initially manages deletion requests manually. Use the privacy request form or email privacy@pawshare.co.uk from the address associated with the account. Identify the Pawshare account and any Facebook or Google sign-in connection, and state that account deletion is requested.

Pawshare will acknowledge the request, verify identity where necessary, explain any lawful retention exception, and normally respond within one month. Self-service deletion may be added later, but the manual process remains available to signed-in and signed-out users.

• Revoke active Pawshare sessions and remove the authentication identity, including the linked Facebook or Google identity where applicable.
• Delete or irreversibly anonymise profile, dog, care, message, media, preference, and other account data unless a lawful and necessary retention reason applies.
• Remove public profile and media links promptly. Where another user must retain a legitimate booking or safety record, replace the deleted user's identity with an appropriate anonymised reference where feasible.
• Remove public-local settings, selected public-dog references and coarse location rows when the member identity is no longer active. Turning off an individual public option must stop future public projection immediately even before retention cleanup runs.
• Record the request, decision, actions, exceptions, and completion date without retaining more request data than necessary.
• Tell the requester when the work is complete and identify any limited data retained, the reason, and the expected review or deletion point.

9. Incident handling

Suspected unauthorised access, loss, disclosure, or alteration of personal data should be contained, investigated, documented, and assessed promptly. Pawshare must notify affected people and the Information Commissioner's Office where UK data-protection law requires notification.