Back

GDPR Information Clause — Whispet

Version: 2.9  |  Effective date: 1 March 2026  |  Last updated: July 13, 2026

Information clause pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR)

Data Controller

The controller of your personal data is:

CRE8EVE Sp. z o.o.
Address: Tulipanowa 4, 72-003 Dobra, Poland
KRS (National Court Register): 0000912669 | NIP (Tax ID): 8513262229 | REGON: 389506637
E-mail: hello@whispet.app

What data does the App process?

  • Pet data: name, species, breed / variety, date of birth, microchip number, veterinarian address
  • Photos: file paths, descriptions, dates, automatic labels (tags), EXIF DateTimeOriginal date, technical identifiers used for duplicate detection and synchronisation between the User's devices
  • Pet medical data: vaccinations, medications, weight, allergies/allergens, nutrition/food, veterinary visits, medical documents
  • Event journals: journal definitions (name, fields), entries with field values, notes, photos attached to entries
  • Demo Pet feature (onboarding): synthetic sample data, not constituting personal data within the meaning of Art. 4(1) GDPR. Details: Privacy Policy §3.9.

The App operates locally. CRE8EVE does NOT collect data on its own servers, does NOT store it centrally, and has NO technical access to its content. All data remains exclusively on your device and — optionally — in the private iCloud database of your Apple ID (E2E encrypted with iCloud Advanced Data Protection enabled). The App does not require a Whispet account (no registration, login, e-mail, or password). The list below describes the categories of data that the App enables to be collected in the sense of Art. 13 GDPR.

For what purposes and on what basis?

Purpose Legal basis
Provision of App services (timeline, photos, medical data, event journals, reminders, photo history import, pet photo detection, EXIF date reading, Shared Care) Art. 6(1)(b) GDPR — performance of a contract
Address suggestions and geocoding for veterinary clinics (Apple Maps / MapKit — only the name or address fragment you type is transmitted) Art. 6(1)(b) GDPR — performance of a contract
Fulfilment of paid subscription plans Art. 6(1)(b) GDPR — performance of a contract
Fulfilment of User rights (Art. 15–22 GDPR) Art. 6(1)(c) GDPR — legal obligation
App security Art. 6(1)(f) GDPR — legitimate interest

Who may have access to your data?

  • Apple Inc. (CloudKit — private database) — synchronisation of your data between your devices via your iCloud account (pets, photos, medical data, journal entries). Apple declares no access to data content (privacy by design; with iCloud Advanced Data Protection enabled — end-to-end encryption).
  • Apple Inc. (CloudKit — sharing, Shared Care) — optional sharing of selected pets with people you designate. Sharing your own pets and adding people to the "People with access" list require a Premium subscription on the Owner's side; participation (receiving pets shared by other Owners), viewing that list, and editing your own signature are also available on the Free plan. Maximum 10 unique people per Owner total. Invitations are sent with the default mode "photos only" (privacy by design); the "full access" mode (with medical data, read-only) requires the Owner's conscious decision after the Participant accepts the invitation. Access revocation is immediate on the Apple iCloud server side (the push notification on the Participant's device may be delayed by up to 15 minutes). Details: Privacy Policy §6a.
  • Apple Inc. (APNS — Apple Push Notification Service) — delivery of push notifications (reminders for vaccinations/medications/visits; silent notifications for Shared Care synchronisation). Apple receives the device token and encrypted notification content.
  • Apple Inc. (Apple Maps / MapKit) — suggestions of veterinary clinic names and addresses and determination of their coordinates. Only the text you type into the clinic name or address field is transmitted — no pet data, no medical data, and no location of your device (the App does not request access to location). Details: Data Subprocessors §4a.
  • Apple Inc. (Vision framework — on-device) — automatic photo labelling and smart pet photo detection in the gallery. Processing is performed entirely on the device — no image data is transmitted to Apple servers.
  • Apple Inc. (StoreKit / In-App Purchase) — Premium subscription payment processing. The Controller has no access to card data.

CRE8EVE does not use Google Fonts, Firebase, or any external analytics/advertising services. The Nunito font is bundled directly within the application package.

CRE8EVE does not mediate the transfer of Shared Care data — all data flows directly between Participants' devices via the Apple infrastructure. The Controller has no access to the shared content.

Data transfers outside the EEA

To a limited extent, data may be transferred outside the European Economic Area (mainly to the USA, where part of the Apple infrastructure is located):

  • Apple iCloud / CloudKit — private database synchronisation and Shared Care
  • Apple Push Notification Service (APNS) — delivery of push notifications (device token)
  • Apple StoreKit / App Store — transaction data for Premium subscription purchases

Legal basis for transfer: Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework (to the extent currently in force).

Apple Inc. ensures data protection under its own DPA (Data Processing Agreement) and the Apple Developer Program License Agreement.

How long do we retain data?

  • Pet data, photos, medical data, and event journals — until deleted by you (from the device and from iCloud via the "Delete all my data" feature in Settings → Your account)
  • Shared Care — until sharing is revoked by the Owner; after Premium subscription loss, sharing is immediately disabled (the Apple Billing Grace Period protects against accidental loss due to a failed payment)

Uninstalling the App removes local data. iCloud-synced data remains in your private iCloud database until you delete it via the "Delete all my data" feature in the App (Settings → Your account). The feature removes all Whispet data zones from your private iCloud database.

Note: "iOS Settings → Apple ID → iCloud → Manage Account Storage → Whispet" only manages iCloud Drive files — it does not remove data from Whispet's CloudKit container (iCloud.com.cre8eve.dailypawsapp). Effective deletion therefore happens from inside the Whispet app.

Your rights

Under the GDPR, you have the right to:

  1. Access your data (Art. 15)
  2. Rectify inaccurate data (Art. 16)
  3. Erase data — "right to be forgotten" (Art. 17)
  4. Restrict processing (Art. 18)
  5. Port your data (Art. 20) — the App enables export of medical records to PDF/XLSX from the pet's profile and export of event journals from within each journal. You can obtain a full copy of your iCloud-stored data via Apple at privacy.apple.com ("Request a copy of your data")
  6. Object to processing (Art. 21)
  7. Withdraw consent at any time (Art. 7(3))
  8. Lodge a complaint with the President of PUODO (ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl) — or, pursuant to GDPR Art. 77, with the supervisory authority of another EEA Member State (full list: https://www.edpb.europa.eu; details in PRIVACY_POLICY.md §8.3)

You can exercise most of these rights directly in the App (PDF/XLSX export from a pet's profile, deletion of individual records, or full account deletion via Settings → Your account → "Delete all my data") or via Apple (full iCloud data copy at privacy.apple.com). If needed — contact: hello@whispet.app (response within one month per Art. 12(3) GDPR).

Do we use profiling?

No. We do not engage in profiling or automated decision-making within the meaning of Art. 22 GDPR. Smart pet photo detection (Apple Vision framework — Smart Detection) is used solely for gallery categorisation and filtering. The analysis is performed entirely on the device.

Age requirement

The App is intended for persons aged 16 years or older (Art. 8 GDPR). Younger persons may use the App with the consent of a parent or legal guardian.

Contact

For personal data matters: hello@whispet.app

The full Privacy Policy is available in the App settings (Menu > Privacy Policy) and in the Privacy Policy document.
Subprocessors list: Data Subprocessors.