Privacy notice

BitaCat Care is run by Pakmansor Agromodern Sdn Bhd (“we”, “us”). We are responsible for the personal data described here. Under Malaysia’s Personal Data Protection Act 2010 (PDPA) we are the “data user”, and under European law the “controller”.

This notice covers people who use the app, people who open a cat’s public ID page or message its owner, and anyone who contacts us.

Your account

• Your email address and, if you give one, your name.
• Your password, stored only in scrambled form (a “hash”), so nobody, including us, can read it.
• When you joined, and which plan you are on.

Your cats

Name, photo, birth date, breed, sex, whether neutered, indoor or outdoor, weight history, allergies and conditions, health records and notes, uploaded vet documents and photos, reminders, feeding plans and feeding logs. This is about your cat, but it sits in your account, so we treat all of it as your personal data.

The AI Health Assistant

Your questions and the assistant’s answers, the next step it suggested, when you accepted its terms, and counts we use to manage allowances and costs (how many consultations you have used and how long they were).

Digital ID and Lost Mode

A phone number, if you choose to add one, and whether it is shown. When Lost Mode is on, the last-seen time, place and note you enter. How many times your cat’s page has been opened, and when it was last opened.

Mood Check

If you use Mood Check, the app uses your device’s microphone, and only after you tap Listen and your browser has asked for your permission. It listens for up to five seconds. The sound is measured on your device and then discarded: it is never uploaded, stored or sent to anyone, including us. What we keep is a few rounded measurements of the sound (such as how long it lasted, how high it was, whether it rose or fell, how often it repeated and how loud it was compared with the room), the result the app showed and how clearly the sound matched, when you did the check, and your answer if you tell us whether your cat has been chattier than usual. The sound cannot be recreated from these measurements.

Payments

Stripe collects your card details on its own secure page. We never receive your full card number. From Stripe we keep a customer reference, your plan (monthly or yearly), the currency and price, your renewal date, and whether a payment has failed or the plan is set to end. Stripe also holds your email address. If we give you a refund, we keep a record of the amount and the reason.

How the app is used

A record of key moments, with the time: creating an account, each step of setting up your first cat, adding a cat, starting an AI consultation, the next step it suggested, doing a mood check (that one happened, not its result), and changes to your plan. Before you create an account, set-up steps are linked to a random number rather than to you.

On your device

Your browser stores a sign-in token, so you stay signed in. While you set up your first cat before creating an account, your answers are kept in your browser until you save them, along with a random number that is cleared when you close the tab. We do not use advertising or tracking cookies, and we do not use third-party analytics.

Technical logs

When your device connects, our hosting providers may automatically record technical details such as its IP address and browser type, to deliver the service and protect it from misuse.

If you found a cat

The message you send through “Notify owner”, and any contact details you choose to include in it. These go to the cat’s owner, in the app and by email. We do not ask for your name or email address.

If you contact us

Your email address and what you write to us.

What we do not collect

The app never reads your device’s location, contacts or photos library (only a photo you pick yourself). It never records or uploads sound: Mood Check only measures a few seconds of it on your device, as described above. We do not collect information about your own health.

To create an account you must give an email address and a password. Without them we cannot give you an account. To add a cat, only its name is required. Everything else is optional. If you leave something out, the features that depend on it will be less useful. For example, the feeding calculator needs your cat’s weight.

• To run the app for you: storing and showing your records, reminders and feeding plans, showing the public cat page you set up, passing on messages from people who find your cat, and showing your mood checks, including a note when your cat’s sounds seem to have changed over the past two weeks.
• To answer your questions to the assistant: we send your question, the conversation so far and a short summary of your cat’s profile (such as age, weight, allergies and recent vaccinations) to our AI provider. We do not send your name or email address, and we never send anything from Mood Check.
• To take payments and manage your plan, including refunds and preventing fraud.
• To keep the service safe and fair, for example enforcing plan limits and stopping abuse.
• To understand and improve the app, mainly from counts, such as how many people finish setting up a cat, and to check the assistant is safe, such as how often it advises a vet visit.
• To contact you about your account, for example about a change to your plan’s price. We will only send you marketing if you have agreed to it, and you can stop it at any time.
• To meet legal duties, such as keeping accounting records.

For people in the European Union and the United Kingdom, our legal bases are: performing our contract with you (running the app and taking payment), our legitimate interests (keeping the service safe and improving it), your consent (optional things such as showing a phone number on your cat’s page, or marketing), and legal obligations (such as accounting records).

We do not sell personal data, and we do not share it with advertisers. We share it only as follows.

Companies that run parts of the service for us

They handle your data only on our instructions and under contract:

• Convex: our database, file storage and server code. Everything in your account is stored with Convex, in the United States.
• Vercel: hosts the website you load the app from.
• Stripe: takes card payments and manages subscriptions. The card details you enter on Stripe’s page are covered by Stripe’s privacy policy.
• Anthropic: provides the AI model that writes the assistant’s answers. It receives only what is described in section 4. Under its commercial terms, it does not use this to train its models.
• Resend: sends the emails we send you, such as a message from someone who found your cat or a code to reset your password. It receives your email address and what that email says.

Others

• Anyone who opens your cat’s public page sees the details you chose to show there.
• If you found a cat, your message goes to its owner.
• Authorities, when the law requires it, or when it is needed to protect someone’s safety.
• A new owner of BitaCat Care, if the business is ever sold. We would tell you first, and this notice would continue to protect your data.

Our own team

Only the small team that runs BitaCat Care can reach the systems that hold your data, and only when needed to run the service, help you when you ask, or keep the service safe. Our admin screen is built to show counts, such as how many records an account has, rather than what those records say.

Your data is stored in the United States, and our providers may process it in other countries too. So it leaves Malaysia, and Europe if that is where you live. We only use providers bound by contract to protect it, including, where European law requires, the standard contractual clauses approved for that purpose.

• While you have an account, we keep what is in it. You can delete cats, health records, weights, reminders, feeding logs and mood checks yourself at any time. AI conversations are kept with your account.
• When you delete your account under Account › Delete my account, we straight away delete your account, cats, records, documents, photos, reminders, feeding data, AI conversations, mood checks, public cat pages, messages from finders, and your plan and refund records. We also ask Stripe to delete your customer record, which cancels any subscription.

After deletion, only this remains:

• The record of key moments described in section 2, with the link to your account removed. It then says only that “someone” did something at a certain time, and cannot be traced back to you.
• Stripe’s record of past payments, which must be kept for tax and accounting reasons for as long as the law requires.
• Copies in our database provider’s routine backups, until those backups are replaced, which happens automatically.
• Messages already sent to our AI provider, which it keeps for a limited time under its own terms before deleting them.
• Emails we have already sent you. Our own copies are deleted a week after sending; our email provider keeps its copies for a limited time under its own terms before deleting them.

• Everything travels over encrypted connections (HTTPS).
• Passwords are stored only as hashes.
• Card details go straight to Stripe and never reach us.
• Access to our systems is limited to the people who need it.
• Cat ID pages are kept out of search engines, and they never show your email or home address.

No system is perfectly secure. If a data breach happens that is likely to cause you significant harm, we will tell you and the authorities as the law requires.

• See and take a copy of your data: Account › Download my data gives you everything in one file, which you can also take to another service.
• Correct it: edit it in the app, or ask us.
• Delete it: delete single items in the app, or your whole account under Account › Delete my account.
• Limit or stop some uses: for example, hide the phone number on your cat’s page, turn off Lost Mode, or stop using the assistant or Mood Check. You can take back the microphone permission at any time in your browser or phone settings. You can withdraw any consent you gave, and in Europe you can object to uses based on our legitimate interests.

To do any of this through us instead, email support@bitacat.care from the address on your account. We reply within 21 days, free of charge. We may ask you to confirm who you are first.

If you are unhappy with how we handle your data, please tell us first. You can also complain to Malaysia’s Personal Data Protection Commissioner, or, in Europe or the UK, to your local data protection authority.

The app is not meant for anyone under 18 to use on their own. If you think a child has given us personal data, contact us and we will delete it.

When our providers or what we collect change, we update this notice and the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

Questions and requests about your data: support@bitacat.care.