Data Processing Agreement

Last Updated: July 2026

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Potty Pal, operated by Kinetic Flux, LLC ("Processor," "we," "us") and you ("Controller," "you") and governs the processing of personal data in connection with the Potty Pal application and services.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person, as defined under GDPR Article 4(1).
• Processing: Any operation performed on personal data, including collection, storage, use, and deletion.
• Data Subject: The individual whose personal data is processed.
• Sub-Processor: A third party engaged by the Processor to process personal data on behalf of the Controller.

3. Scope and Purpose of Processing

We process personal data solely to provide the Potty Pal service, including:

• User account management and authentication
• Pet activity tracking and prediction services
• Family sharing and collaboration features
• Subscription and payment management
• Transactional notifications and emails

4. Categories of Data Processed

• Identity Data: Email address, name, date of birth, Apple user ID
• Pet Data: Dog name, breed, sex, age, weight, photos, activity logs
• Usage Data: App usage statistics, device information, crash reports
• Payment Data: Subscription status (payment details handled by Apple)
• Advertising Data: Device identifiers and general usage/diagnostic data, processed by Google AdMob to serve non-personalized ads in the free version (removed for subscribers)

5. Data Subject Rights

We will assist you in fulfilling data subject requests under GDPR Articles 15-22, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

Requests can be submitted to privacy@potty-pal.com and will be addressed within 30 days.

6. Sub-Processors

We use the following sub-processors to deliver our services. You consent to the engagement of these sub-processors by agreeing to this DPA. We will notify users of any changes to this list via our Privacy Policy page.

Sub-Processor	Purpose	Location
Amazon Web Services (AWS)	Cloud hosting, data storage (DynamoDB, S3, Lambda, CloudFront), serverless compute	US (us-east-1)
Amazon Cognito (AWS)	User authentication and identity management	US (us-east-1)
Amazon SES (AWS)	Transactional email delivery (invitations, notifications)	US (us-east-1)
Apple Inc.	Sign In with Apple, in-app purchase processing, push notifications	US
Google LLC (AdMob)	Advertising in the free version of the app (non-personalized)	US

7. Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls with least-privilege principles
• Regular security assessments and monitoring
• Point-in-time recovery enabled on all database tables
• Secure cloud infrastructure on AWS with VPC isolation

8. Data Breach Notification

In the event of a personal data breach, we will notify affected users without undue delay and no later than 72 hours after becoming aware of the breach, in accordance with GDPR Article 33.

9. Data Retention and Deletion

Personal data is retained for as long as the user's account is active. Upon account deletion, all personal data is deleted or anonymized within 30 days, except where retention is required by law.

10. International Transfers

All data is processed and stored within the United States. For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

11. Contact