Privacy Policy

PLU — Pet Lives Universe — is a civic-grade digital identity platform for pets in India. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, how long we keep it, who we share it with, and what rights you have over your data.

We take your privacy seriously. PLU is built on a consent-first model. Personal data about you and your pet is surfaced only on your express, role-based grant of access. The owner of the pet is also the owner of the data.

This Privacy Policy should be read together with the PLU Terms of Service. Capitalised terms not defined here have the meaning given in the Terms of Service.

For the purposes of the DPDP Act, the Data Fiduciary for personal data collected through the civic registry services is:

Universal Pet Lives Council(operating under the brand “PLU — Pet Lives Universe” and through the Universal Pet Lives Council as the issuing body of the registry). Registered office: Wework, Zenia, Hiranandani Estate Circle, Patlipada, Thane West 400607, Maharashtra, India. Privacy contact: privacy@petlives.in.

In addition, Trugo Technologies Pvt. Ltd. (“PLU Commerce”) is the Data Fiduciary for personal data collected through the commercial Marketplace Services and through billing and payment processing for PLU's registry services. Registered office: 1st Floor, 71-1, Brindavan Road, Near SKS Hospital, Salem, Tamil Nadu 636004, India. Privacy contact: privacy-petlives@trugotech.com.

Where this Policy refers to “we”, “us”, or “our” without further distinction, both entities are addressed. Where data processing is specific to one entity, that entity is identified.

This Policy applies to all personal data we collect, receive, store, use, share, or otherwise process in connection with:

• The PLU mobile and web application.
• The PLU public website at petlives.in, including pages of the form petlives.in/p/{PLU-ID}.
• Communications we send you (email, WhatsApp, SMS, push notifications).
• Any feature, integration, or service offered by PLU or PLU Commerce from time to time.

This Policy does not apply to third-party websites or services that may be linked from the Service. Where a Guardian, Empanelled Partner, or Finder relies on a third party (e.g. a clinic's own record-keeping system), that party's privacy practices govern their own processing.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.

“Data Principal” means the individual to whom the personal data relates — typically the Guardian in our context.

“Data Fiduciary” means the person or entity which alone or in conjunction with others determines the purpose and means of processing personal data.

“Data Processor” means a person who processes personal data on behalf of a Data Fiduciary, such as our hosting and infrastructure providers.

“Processing” has the meaning given in the DPDP Act and includes collection, storage, use, disclosure, retention, and deletion.

We process the personal data described in Section 5 only for the following purposes:

Under the DPDP Act, we process personal data on the basis of:

• Your consent, given at registration and renewable in granular form within the Service. You may withdraw consent at any time as described in Section 8.
• Performance of the contract between you and PLU set out in our Terms of Service, where processing is necessary to deliver the Service you have signed up for, including processing payment data for Registration Fees and Registry Subscriptions.
• Legitimate uses as recognised under the DPDP Act, including compliance with judgments, orders, or directions; response to medical emergencies; and similar legitimate purposes specifically permitted under the Act.
• Legal obligation, where we are required to process or disclose personal data to comply with Indian law or a lawful regulatory or judicial order.

At registration, we present you with a clear, plain-language notice describing the personal data we will process, why we will process it, and the rights you have. You provide consent by an affirmative act — ticking the consent box and proceeding.

Where we add a new purpose of processing that is not within the scope of your existing consent, we will ask for a fresh consent before processing for that purpose.

Separate, granular consent is sought for:

• Bio Tracker data collection, at the time of device pairing.
• Empanelled Partner access, each time you authorise a specific partner.
• Precise GPS location for marketplace services, at the time of booking.

You may withdraw consent at any time via the Service or by writing to privacy@petlives.in. Withdrawal of consent: (a) takes effect prospectively, not retrospectively; (b) may limit your ability to use parts of the Service that depend on the consent you have withdrawn; and (c) does not affect processing already carried out lawfully on the basis of consent in force at that time.

We retain personal data only for as long as necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law.

• Active Guardian accounts and Pet Records:For the lifetime of the Pet and for three (3) years after the Pet's record is retired, to enable the integrity of the registry. TBD: Team to confirm if three years is acceptable or whether a different period within the 2–5-year range is preferred.
• Deleted accounts: 30 days of soft delete during which the Guardian may restore the account. After 30 days, personal data is permanently deleted, except for: (i) anonymised registry-integrity records (the PLU-ID itself, with all personal identifiers stripped); and (ii) information we are legally required to retain.
• Payment and billing records: Retained for 7 years in accordance with Indian statutory requirements, including GST and income tax record-keeping obligations.
• Nose-print biometric template: The nose-print is the identity anchor of the Pet and is retained for the lifetime of the active Pet Record. Where a nose-print is deleted accidentally or due to a technical error, it may be renewed within 30 days. Where a Guardian genuinely deletes their account or expressly requests erasure of the nose-print, the biometric template is retained for 90 days to allow for registry integrity checks, dispute resolution, and any outstanding law enforcement requests, after which it is permanently and irreversibly erased.
• Bio Tracker data — active account: Retained on a rolling 90-day basis as a data minimisation measure consistent with Sections 4(1)(b) and 8(7) of the DPDP Act, 2023. Data older than 90 days is automatically deleted. TBD: Counsel to confirm against final DPDP implementing rules when published.
• Bio Tracker data — account closed: All Bio Tracker data is permanently deleted on account closure.
• Bio Tracker data — device unpaired: Data collection ceases immediately on unpairing. Historical tracker data is retained for 30 days then permanently deleted, unless the device is re-paired within that period.
• Lost-and-found event logs: Retained while relevant to the open case, and for one (1) year thereafter for audit and trust purposes. TBD: Team to confirm if one year is acceptable.
• Technical and security logs: Retained for 90 days, after which they are deleted or aggregated. TBD: Team to confirm if 90 days is acceptable or whether a different period within the 30–180-day range is preferred.
• Service Provider KYC documents: Retained for the duration of empanelment and for three (3) years following termination of empanelment, after which they are permanently deleted. TBD: Team to confirm.
• Support and grievance records: Retained for three (3) years from the date of resolution. TBD: Counsel to confirm.
• Records relevant to legal claims: Where Personal Data is relevant to an actual or reasonably anticipated dispute, claim, or legal proceeding, we may retain that data for up to three (3) years beyond the retention period that would otherwise apply, being the general limitation period under the Limitation Act, 1963, or such longer period as is necessary to see a specific claim or proceeding through to conclusion.
• Records required by law: Retained for the applicable statutory retention period.

The DPDP Act gives you the following rights in respect of personal data we process about you. You can exercise any of these by writing to privacy@petlives.in (for registry data) or privacy-petlives@trugotech.com (for marketplace data), or via the in-app account settings, where available.

• Right to access information. You may ask us for a summary of the personal data we hold about you, the purposes for which we are processing it, and the identities of Data Fiduciaries and Data Processors with whom we have shared it.
• Right to correction and erasure. You may ask us to correct inaccurate or incomplete personal data or to erase personal data that is no longer needed for the purposes for which it was collected, subject to limited exceptions where we are required to retain it.
• Right of grievance redressal. You may raise a grievance with us as described in Section 16. We will respond within the timeframe required by the DPDP Act.
• Right to nominate. You may nominate another individual who may exercise your rights under the DPDP Act in the event of your death or incapacity. To set this up, contact privacy@petlives.in.
• Right to withdraw consent. You may withdraw your consent to processing at any time, as described in Section 8. Note that processing of payment data for fees due is based on contract performance, not consent, and withdrawal of consent does not affect fee obligations.

We will respond to a verifiable request from a Data Principal within the time specified by the DPDP Act and implementing rules, currently TBD: confirm timeframe under final rules — typically up to 30 days, with one extension permitted in defined cases.

We implement reasonable security safeguards proportionate to the nature of the personal data we process. These include:

• Encryption in transit (TLS) for all communications between your device and our servers.
• Encryption at rest for our database and file storage.
• Role-based access controls so that only authorised PLU personnel or Empanelled Partners can access specific categories of data.
• Audit logging of access to sensitive data, including biometric records and lost-pet event handling.
• Multi-factor protection on PLU staff and administrative accounts.
• Periodic review of our security posture and, where appropriate, third-party security testing.

No system is perfectly secure. In the event of a personal data breach that is likely to cause significant harm to Data Principals, PLU will notify the Data Protection Board of India and affected Data Principals in the manner and within the timeframes required by the DPDP Act.

PLU is an Indian company and processes personal data primarily within India. All core user data, including Pet Records, Guardian identity data, and Bio Tracker data, is hosted on cloud infrastructure located within India.

Some of the third-party Data Processors and service providers we engage operate infrastructure outside India. Where personal data is transferred outside India, we ensure that the transfer is in compliance with the DPDP Act, 2023, including the requirements of Section 16 and Rule 15 of the Digital Personal Data Protection Rules, 2025.

The countries in which our processors currently operate or may operate include the United States, South Korea, China, and Russia, depending on the service. All processors are bound by written data processing agreements that require them to protect personal data to a standard consistent with the DPDP Act.

Where any processor routes personal data through infrastructure in China or Russia, PLU will notify affected Guardians in advance, update this Privacy Policy to reflect the specific transfer, and obtain separate explicit consent before any such transfer takes place.

For the Bio Tracker feature, the OEM partner's firmware or connectivity layer may involve data processing outside India. PLU will confirm the relevant jurisdictions and obtain explicit consent from each Guardian before the Bio Tracker feature is enabled on their account.

PLU will update this clause if the Central Government of India issues notifications restricting transfers to specific countries or territories under the DPDP Act and will adjust its data transfer practices accordingly.

The PLU Guardian account is intended for individuals aged 18 years and above. We do not knowingly collect personal data of a child as a Guardian directly. Where a Pet is loved and cared for by a household that includes children, the registered Guardian must be an adult acting on behalf of the household.

Where it comes to our attention that personal data of a child has been collected without verifiable parental consent, we will delete that data without undue delay.

Personal data of persons with disabilities who have lawful guardians is processed only with the verifiable consent of the lawful guardian.

The PLU website and web application use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: For authentication, session management, and security. These cannot be disabled if you wish to use the Service.
• Preference cookies: To remember your settings (e.g. language).
• Analytics cookies: To understand usage in aggregate. Where required by law, we will obtain your consent before setting non-essential analytics cookies.
• Affiliate and referral tracking: Tracks click-throughs on affiliate links for the purpose of crediting referral activity to PLU Commerce. Used only when you interact with an affiliate link.

We do not use third-party advertising cookies, retargeting pixels, or social-media tracking pixels.

We may amend this Privacy Policy from time to time. Where a change is material, we will notify Guardians in advance through the Service, by email, or by WhatsApp using the contact details on file. Continued use of the Service after the effective date of an amendment constitutes acceptance of the amended Policy.

The date of last revision is set out at the top of this Policy. Previous versions are available on request at privacy@petlives.in.

This Privacy Policy is governed by the laws of India, including the DPDP Act, 2023, the IT Act, 2000, and the Indian Contract Act, 1872. Any disputes are subject to the jurisdiction of the courts of Mumbai, Maharashtra, and the dispute resolution process described in the Terms of Service.

If you have questions, requests, or concerns about this Privacy Policy or our processing of personal data, contact us:

• PLU — Universal Pet Lives Council
• Registered office: Wework, Zenia, Hiranandani Estate Circle, Patlipada, Thane West 400607, Maharashtra, India
• Privacy queries: privacy@petlives.in
• Grievance Officer: grievance@petlives.in
• General: hello@petlives.in
• Privacy queries — PLU Commerce: privacy-petlives@trugotech.com
• Grievance Officer — PLU Commerce: TBD: Confirm email address for PLU Commerce Grievance Officer
• PLU Commerce registered office: 1st Floor, 71-1, Brindavan Road, Near SKS Hospital, Salem, Tamil Nadu 636004, India

If you are not satisfied with our handling of your personal data or your grievance, you have the right to file a complaint with the Data Protection Board of India established under the DPDP Act. Information about the Board's complaint procedures will be available on the Board's website.