Privacy Policy

Data controller (operator): Khatskelevich Aleksei Yurievich, INN 590586625787, self-employed (individual paying professional income tax)

Person responsible for personal data processing: Khatskelevich Aleksei Yurievich (the controller), e-mail: info@bubka.app

1. General

This Policy explains what personal data Khatskelevich Aleksei Yurievich (hereinafter — “Bubka”, “we”, “the controller”), an individual operating under the special tax regime “professional income tax” (self-employed), collects and processes in the Bubka mobile app, on the website and when providing the service: the purposes of processing, how data is stored and protected, and your rights as a data subject.

The Policy is freely available on the internet and inside the app. By using the app you agree to this Policy. If you do not agree, please do not use the app.

2. What data we collect

2.1. Account data

Data	Purpose	Required?
E-mail	Sign-in via e-mail code, contacting you	Yes, to create an account
Mobile phone number	Sign-in via SMS code (alternative method)	No (optional)
User name	Displayed in the interface and in pet records shared with others	Yes

2.2. Pet data

pet name, species, breed, sex, date of birth, weight;
care events (vaccinations, vet visits, grooming, feeding, etc.);
pet photos and “stories”;
documents (medical records, certificates, test results) — files you upload yourself.

Please note: documents and events may contain health-related information. We process them solely on your behalf — so that you can maintain your pet’s health record — and do not use them for any other purpose than providing the service.

2.3. Technical data

device identifier and push token (APNs / FCM) — to deliver push notifications about your pet’s events;
IP address, app and OS version, access logs — to operate and protect the service;
app error and crash data — to fix malfunctions.

2.4. Data we do NOT collect

we do not sell or share your data with advertising networks;
we do not collect payment card data: the app has no paid features at the time of publication; when they are introduced, payments will be processed by a payment system, and we will never receive card details;
geolocation will be used for the map feature in the feed (finding nearby pet-friendly places, vets and groomers) — coming in the next update. Location access is requested only with your permission; without it, the map works without geolocation.

3. Purposes and legal bases

Purpose	Legal basis
Account creation and code-based sign-in	Contract performance (Art. 6(1)(b))
Maintaining the pet record: events, documents, photos	Contract performance (Art. 6(1)(b))
Push notifications about events	Consent (revocable in settings)
Service security, abuse prevention	Legitimate interest (Art. 6(1)(f))
Service improvement based on aggregated statistics	Legitimate interest (Art. 6(1)(f))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))

We do not sell personal data. Access is granted only to:

infrastructure providers — hosting and file storage (S3-compatible object storage): DigitalOcean (Amsterdam, EU) and Beget — the latter only for accounts subject to local data-localization requirements;
e-mail provider — UniGo — to deliver sign-in codes and notifications;
Apple / Google — to deliver push notifications via APNs / FCM;
competent authorities — where expressly required by law.

All of the above process data under contracts and only on our instructions.

5. Where data is stored; cross-border transfer

The storage region is determined by the country of your account:

accounts in the European Union — data is stored on servers within the EU (DigitalOcean, Amsterdam);
accounts in other countries — data is stored in a region corresponding to the account’s country, where local law requires data to be stored locally.

Data does not move between storage regions: an account is assigned to one region, including backups. For EU users this means their data is processed and stored within the European Union; we comply with all GDPR obligations (purposes, rights, retention, security) regardless of the region.

6. Retention periods

account data — while the account exists;
pet data, documents, photos — while the account exists;
after account deletion — 30 days for technical deletion of all data, including backups;
security logs — 12 months;
data we are legally required to retain — for the period established by law.

7. Your rights

You have the right to:

obtain a copy of your data;
rectify inaccurate data;
erase data (“right to be forgotten”), including deleting your account in the app;
withdraw consent to processing (e.g. disable push) at any time, without affecting processing already carried out on the basis of consent;
object to processing based on legitimate interest;
lodge a complaint with a competent authority: in the EU — the data protection authority of your place of residence; elsewhere — your local personal data or consumer protection authority.

Send requests to info@bubka.app. We respond within 30 days. To verify your identity, we may ask for additional details.

8. Children

The app is not intended for persons under 14 and we do not knowingly collect their data. Persons aged 14 to 18 may use the app with parental (legal guardian) consent. If you are a parent or legal guardian and believe a child has provided us with data, write to info@bubka.app and we will delete it.

9. How we protect data

all traffic over HTTPS/TLS;
access on a least-privilege basis, employee access restricted and logged;
secrets and credentials stored encrypted;
regular backups;
files (documents, photos) served via temporary signed URLs.

10. Changes to this Policy

We may update this Policy. The new version is published in the app and on the website with the date indicated. Material changes will additionally be announced by e-mail to the address in your account. Previous versions are archived and provided on request.

11. Contacts

Controller: Khatskelevich Aleksei Yurievich, INN 590586625787 E-mail: info@bubka.app Phone: +7 995 862-46-63