Privacy Policy

Version 1.2 · Last updated 17 August 2026

This policy explains how Whelpy handles personal data under UK data protection law (UK GDPR and the Data Protection Act 2018). Whelpy is subscription software for UK dog breeders that helps you keep breeding and litter records, a statutory council record book, bookkeeping, and share puppy updates with buyers.

Who we are

Whelpy is run by Whelpy Ltd, a UK company being incorporated by its founder, Dean Gammon, who runs the service and is the person responsible for your data until incorporation completes. We are the data controller for the Whelpy service and are subject to the UK GDPR and the Data Protection Act 2018. We are required to register with the Information Commissioner’s Office (ICO) and pay the annual data-protection fee; our registration number will be shown here once it has been issued. You can contact us about privacy at hello@whelpy.co.uk.

Controller and processor — who is responsible for what

We are the controller for your breeder account (your name, email, login and billing status) and for keeping the service secure.

For the kennel records youenter about other people — your buyers’ names and contact details, reservation and payment notes, and messages — you are the controller and Whelpy is your processor, storing and processing that data on your instructions to run the service for you. You are responsible for having a lawful basis to hold your buyers’ details and for telling them how you use their information. The terms that govern us as your processor — what we may do with that data, our security duties, and the providers we use — are set out in our Data Processing Terms.

What we collect and why

Our lawful basis (for the data we control) is shown in brackets.

• Account details — your name, email and password (stored hashed) so we can create and secure your account (contract).
• Subscription & billing status — your plan, renewal dates and whether a payment succeeded. Stripe handles the card payment; we receive the result, not your card number (contract; legal obligation for the tax records HMRC requires us to keep).
• Kennel records you enter — dogs, matings, litters, puppies, weights, milestones, health events, accounts, documents, and buyer/reservation details (you are controller; we process on your instructions).
• Uploaded files — puppy photos, contracts and receipts you add (processed for you).
• Messages exchanged between a breeder and a buyer (processed for you).
• Security logs — the IP address, browser/device and time of each sign-in attempt (successful or failed) (our legitimate interest in preventing unauthorised access and fraud).
• Receipt scanning (only if you use it) — when you choose to scan a receipt, the receipt image or PDF you upload is sent to Anthropic to read it and extract the amounts, then the extracted figures are returned to pre-fill your ledger. The whole file is sent (not just the text), so anything visible on it goes too. We do not use it for anything else (contract — a feature you actively trigger).

We do not sell your data, show adverts, or use third-party advertising or analytics tracking. There is no ad or profiling cookie.

Who processes data for us (subprocessors)

We use a small number of trusted providers to run Whelpy. Each only processes data to deliver its part of the service, under a contract with data-protection terms.

That is the full list. The current version is always the one on this page, and we keep our Data Processing Terms in step with it — including how we tell you before a provider changes.

One thing that is not on the list.If you use the Kennel Club import, Whelpy looks a dog up on The Royal Kennel Club’s public website using the name or registration number you type in, and reads back the published health-test and pedigree pages. That is a lookup you trigger, on pages anyone can view — the Kennel Club does not process your records for us, and we send them nothing about you or your buyers.

Access controls

Each kennel’s data is private to that kennel. A buyer can only see the puppy they reserved, and only the photos and documents the breeder chooses to share. Contracts are visible only to the kennel and the reserving buyer.

International transfers

Your records are hosted in the UK (Fly.io, London region). Some of our providers are US companies (Neon, Resend, Stripe, Anthropic). Where personal data is transferred outside the UK, that transfer is covered by the UK’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, backed by appropriate safeguards, so your data keeps essentially the same protection as it has in the UK.

How long we keep it

• While your account is active — we keep your records so you can use the service.
• Records you delete inside Whelpy — deleting a dog, litter, document or ledger entry archives it: it comes off your day-to-day screens but is retained behind the scenes, because licensing and tax records are expected to stay available for several years after the event. If you want something erased outright rather than archived, ask us.
• If you cancel a paid subscription — your account stays open on the free Lite tier, so your records remain available for you to return to or export whenever you like. We don’t delete anything just because a subscription ended.
• When you ask us to close your account or erase your data — we remove your personal data from our live systems promptly, normally within 30 days of your request. Residual copies can persist a little longer in our encrypted backups, which are rotated so those copies are overwritten within about 30 days.
• Security sign-in logs — automatically deleted after 12 months.
• Billing and tax records — we may keep the minimum invoice and tax information the law requires us to retain.
• Your own statutory records — licensing and tax law may require you to keep certain breeding records for a set period (for example three years after a dog leaves). Exporting and retaining those records is your responsibility as the kennel; deleting your Whelpy account does not discharge that duty, so export first.

Your rights

Under UK GDPR you can ask us to give you access to, correct, or delete your personal data; to restrict or object to certain processing; and to provide a copy of it in a portable format (you can already get a copy of much of it yourself, at any time, through Whelpy’s built-in Excel, CSV and file exports). To ask us to delete your account and personal data, or to make any other request, email hello@whelpy.co.uk and we will action it. We aim to respond within one month. If a request is about data your breeder holds about you as a buyer, we will pass it to the relevant kennel, who is the controller for that information.

If you are unhappy with how we handle your data you can complain to the ICO at ico.org.uk, though we would appreciate the chance to put things right first.

Security and breaches

We protect your data with encryption in transit, hashed passwords, per-kennel access controls, sign-in auditing and rate limiting, and access limited to what is needed to run the service. No system is perfectly secure, but if a personal-data breach occurs that is likely to risk people’s rights, we will report it to the ICO within 72 hours where required and tell affected users without undue delay.

Cookies

Whelpy uses only strictly-necessary cookies (to keep you signed in) and no advertising or tracking cookies, so no cookie-consent banner is required. Full details are on our Cookies page.

Changes to this policy

We may update this policy; the current version and date are shown at the top. If we make a significant change we will let you know by email or in the app.

Contact

For anything about this policy, your data, or a request under your rights, email hello@whelpy.co.uk. We are Whelpy — run by its founder, Dean Gammon, while Whelpy Ltd completes incorporation.

← Back to Whelpy · Terms of Service · Data Processing Terms · Cookies