Data Processing Terms
Version 0.2 · 17 August 2026
These terms apply when Whelpy handles personal data on your behalf — the buyers, enquirers and other people whose details you enter into your kennel. They form part of our Terms of Service and are the written processor contract UK data protection law requires between a controller and its processor. Where we handle personal data for our own purposes instead — your account, your billing, our security logs — the Privacy Policy is the document that governs it, not this one.
These terms are new and are with our solicitor as part of our launch checks. If the review changes anything we will publish the updated version here and tell you.
1. Who is who
- You — the kennel that holds the Whelpy account — are the controller. You decide whose details go in, why, and how long you need them.
- We — Whelpy Ltd (until its incorporation completes, its founder, Dean Gammon) — are the processor. We hold and handle that data to run Whelpy for you, and for nothing else.
This split matters in a practical way: if one of your buyers asks who holds their data and why, the answer is you, and we are the software you use to do it.
2. What the processing actually is
| Subject matter | The provision of the Whelpy service to your kennel. |
| Duration | For as long as your account exists, plus the short tail described in clause 8. |
| Nature and purpose | Storing, organising, displaying, searching, exporting and backing up the records you enter; sending the emails you trigger; showing a buyer their own puppy through the buyer portal; passing messages between you and a buyer; and deleting data when you or we are required to. |
| Types of personal data | Names, email addresses, phone numbers and postal addresses; waiting-list preferences; reservation and payment records (amounts, dates, method — not card numbers); messages between you and a buyer; puppy contracts and other documents and photos you upload; receipts and their contents; and any free-text notes you write about a person. |
| Categories of people | Your puppy buyers and waiting-list enquirers; people you enquire with, or who enquire with you, about a stud dog; staff you invite into your kennel; and anyone else you happen to name in a note, contract or document. |
Special category data. Whelpy is not built to hold health or other special category data about people— the health records in it are about dogs. Free-text notes are the one place it could end up by accident. Please don’t put it there.
3. We act only on your instructions
We process the personal data you enter only on your documented instructions. Your instructions are: these terms, the Terms of Service, and your ordinary use of the features in Whelpy. We will not use that data for our own purposes, will not sell it, will not use it for advertising, and will not use it to train AI models.
If the law requires us to process it some other way, we will tell you before we do, unless the law forbids us from telling you. If we think an instruction from you would breach data protection law, we will tell you.
4. Confidentiality
Access is limited to the people who need it to run and support the service, and they are bound to keep it confidential. Whelpy is a very small operation: in practice that is the owner and anyone he formally engages to work on it, under the same duty.
5. Security
We take appropriate technical and organisational measures to protect the data, judged against the risk. The measures in place today are:
- encryption in transit (HTTPS everywhere, enforced) and encryption at rest at our hosting and storage providers;
- passwords stored hashed, never in readable form, and optional two-factor sign-in for kennel owners;
- strict per-kennel separation — every query is scoped to your kennel, so another kennel cannot reach your records, and a buyer sees only their own puppy;
- sign-in auditing and rate limiting to slow down password-guessing, with the audit trail visible to you in your settings;
- nightly encrypted database backups, kept to a rolling window, plus point-in-time recovery at our database provider;
- error reports are stripped of email addresses and secrets before anyone sees them.
Security is never finished. We may change these measures, but not in a way that materially weakens the protection of your data.
6. Other providers we use (subprocessors)
You give us general authorisation to use the providers below. Each one only handles what its job needs, under a contract with data-protection terms, and we remain responsible to you for what they do.
| Provider | What it does | Personal data it can see |
|---|---|---|
| Fly.io | Runs the application. London (LHR) region. | Anything passing through the app in memory |
| Neon | Hosts the PostgreSQL database. | All record data, at rest |
| Tigris | Object storage, provisioned through Fly.io. Holds uploaded files and the nightly database backups. | Photos, contracts, documents, receipts; backup copies of the database |
| Resend | Delivers the emails Whelpy sends. | Recipient name and email address, and the content of that email |
| Stripe | Takes your subscription payment. | Your billing details only — not your buyers’ data |
| Anthropic | Reads a receipt you choose to scan and returns the figures on it. Only runs when you press the button. | Whatever is visible on the receipt file you upload |
Changing the list. If we want to add or replace a provider, we will tell you at least 30 daysbeforehand, by email or in the app. If you object on reasonable data-protection grounds we will try to resolve it with you; if we can’t, you may cancel your subscription and export your records, and we will refund the unused part of anything you have paid in advance.
7. Sending data outside the UK
The application runs in the UK. Some of our providers are US companies (Neon, Resend, Stripe, Anthropic), so some personal data is transferred outside the UK. Those transfers are made under the UK’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the safeguards those require, so the data keeps essentially the protection it has here. You instruct us to make those transfers by using the service.
8. What happens at the end
Cancelling a subscription is not the end of the service. Your account carries on for free on Lite, your records stay readable, and export stays switched on — so we keep the data, because you still have a service and, in most cases, your own legal duty to keep those records.
The end of the service is when your account is closed. At that point, at your choice, we will return the data to you — the built-in Excel, CSV and file exports let you do that yourself, at any time — or delete it. Unless you tell us otherwise, closing your account means delete. Deletion from our live systems happens promptly — it is a single operation that removes the kennel and its records, including uploaded files. Copies inside our encrypted backups are not picked out individually; they age out as the backup window rolls forward, currently about 30 days, and remain protected until they do.
We may keep the minimum we are legally required to keep — principally invoice and tax records about you, which are ours to retain, not your buyers’ data.
9. Helping you with people’s rights
If one of your buyers contacts us directly to ask for their data, or to have it corrected or deleted, we will not answer it ourselves — we will pass it to you, because you are the controller. Where a request needs something from us, we will help you within a reasonable time and at no charge for a normal request. Much of it you can already do yourself: the exports get the data out, and you can edit or delete a buyer record directly.
10. Breaches, and helping you meet your own duties
If a personal-data breach affecting your data happens, we will tell you without undue delayonce we become aware of it, with what we know about what happened, who is affected, the likely consequences and what we are doing about it — so you can make your own decision about telling the ICO and the people involved, which is the controller’s call, not ours. We will also give you reasonable help with security, breach handling and any data-protection impact assessment you need to do, taking into account how little of the picture we hold.
11. Showing you we comply
We will give you the information you reasonably need to satisfy yourself that we are meeting these terms — normally by answering your questions in writing, which for an operation this size is the honest and useful route. If that is not enough, you may audit us, or have an independent auditor do it, on 30 days’ written notice, not more than once in any 12 months, during business hours, and without disrupting other kennels’ service or exposing their data. That limit does not apply where a regulator requires an audit or where there has been a breach affecting your data. You cover your own costs.
12. What we need from you
- Have a lawful basis for the personal data you enter, and tell the people concerned how you use it — your own privacy notice, not ours.
- Keep it accurate and don’t enter more than you need. Don’t use free-text notes for sensitive information about people.
- Keep your login safe, and remove staff access when someone leaves.
- Export your records before you close your account. Deleting Whelpy does not discharge your own legal duty to keep breeding and tax records.
13. Liability, and changes to these terms
Liability under these terms works the way clause 12 of the Terms of Service sets out, except where data protection law does not allow it to be limited. If we need to change these terms we will give you reasonable notice by email or in the app; the version and date at the top always show what is current.
14. Contact
Data protection questions, requests and notices go to hello@whelpy.co.uk. We are Whelpy — run by its founder, Dean Gammon, while Whelpy Ltd completes incorporation.
← Back to Whelpy · Terms of Service · Privacy Policy · Cookies