Privacy Policy

KOETA INC.
Incorporated under the Business Corporations Act (Ontario)
Ontario Corporation Number 1001640778
195 Cannon Street East, Hamilton, Ontario L8L 2A7, Canada

Document Control

Contents

1. Introduction
2. Controller and Contact Information
3. Scope
4. Personal Information We Collect
5. How We Collect Personal Information
6. Purposes of Collection, Use, and Disclosure, and Legal Bases
7. Sharing and Disclosure of Personal Information
8. International Data Transfers
9. Data Retention
10. Your Rights
11. Children’s Privacy
12. Security Safeguards
13. Cookies and Similar Technologies
14. Marketing Communications and CASL
15. Artificial Intelligence, Model Training, and Automated Decision-Making
16. Changes to This Privacy Policy
17. Complaints and Contact
18. Additional CCPA Notice at Collection
19. Additional Information for Residents of Quebec

PETKIRA PRIVACY POLICY

Operated by Koeta Inc.

Effective Date: 29 September 2026 | Last Updated: 29 October 2026

1. Introduction

Koeta Inc. (“Koeta,” “we,” “us,” or “our”) is a corporation incorporated under the laws of the Province of Ontario, Canada, that owns and operates the PetKira mobile application and related services (the “Service” or “PetKira”). PetKira is an AI-powered pet wellness and nutrition platform for iPhone, iPad and Android. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with the Service.

We are committed to protecting personal information in accordance with all data protection and privacy laws applicable to us, including the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada; the Act respecting the protection of personal information in the private sector (Quebec); Regulation (EU) 2016/679 (the EU General Data Protection Regulation, or GDPR); the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018; the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other applicable United States state privacy laws; Canada’s Anti-Spam Legislation (CASL); and the requirements of the Apple App Store and Google Play.

PetKira is available in many countries. Where the law of your country, state, or province grants you rights, protections, or remedies greater than those described in this Policy, those greater rights apply to you and this Policy is to be read accordingly. Nothing in this Policy operates to reduce or waive a right you hold under a law that cannot be waived by agreement.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Controller and Contact Information

The data controller is:

For privacy requests, access requests, deletion requests, or questions about this Policy, contact the Privacy Officer at the email or address above. We will respond in accordance with applicable law.

3. Scope

This Privacy Policy applies to personal information collected through the PetKira mobile application, the petkira.com website, and related communications and services. It does not apply to third-party websites, services, or applications that may be linked from the Service; those are governed by their own privacy policies.

4. Personal Information We Collect

We collect the following categories of personal information:

4.1 Account and Identification Information

Email address; name (if provided); password (stored in hashed form); authentication credentials and tokens; account preferences and settings.

4.2 Pet Profile and Care Information

Pet name; species (currently dogs and cats); breed; age or date of birth; weight; photographs; allergies and dietary restrictions; health notes and medical history summaries you enter; mood, appetite, and symptom observations; feeding and meal logs (including items offered, eaten, skipped, and reasons); activity logs (including walks and exercise); care reminders; and other wellness or health-adjacent records you choose to create or upload. All pet profile data relates to your animal companion. It is not health information about you as an individual, and we do not treat it as such. If you enter information about yourself in a free-text field, that information is treated as your personal information under this Policy.

4.3 AI Interaction Information

The text you type and the voice recordings you make when you use Kira, meal plans, or support chat; the pet details and notes described in Section 15.3; conversation history (stored in your account); and the AI-generated replies, meal plans, and insights.

4.4 Location Information

Approximate or precise location data when you enable and use the “Find Help” feature to locate nearby veterinarians, groomers, pet stores, or related services. Location data is collected only with your device permission and can be disabled at any time in your device settings.

4.5 Device and Technical Information

Device type and model; operating system and version; unique device identifiers; IP address; app usage data and feature interaction logs; crash reports and diagnostic data; performance metrics; and push notification tokens, which are device identifiers used to deliver care reminders and other notifications you have enabled. You may disable push notifications at any time in your device settings.

4.6 Subscription and Transaction Information

Subscription plan type and status (Pro or Family); renewal dates; limited confirmation data received from Apple, Google, or RevenueCat regarding purchases. We do not collect, process, or store full payment card numbers, CVV codes, or complete billing addresses; those are handled exclusively by Apple or Google.

4.7 Communications Information

Emails, in-app messages, support requests, feedback, and records of your marketing preferences and consents.

4.8 Family / Household Information

When you use a Family plan, we process account information of invited household members and enable them to access and edit shared pet data that you designate.

We collect personal information only as necessary for identified purposes. Health-adjacent pet data is treated with heightened care under applicable principles.

5. How We Collect Personal Information

• Directly from you when you create an account, complete pet profiles, log data, interact with Kira, enable location services, or contact us.
• Automatically through the Service via device permissions, app functionality, and standard technical means.
• From third-party platforms (Apple App Store and Google Play) limited to subscription and purchase confirmation data.
• From service providers as necessary to operate the Service.

6. Purposes of Collection, Use, and Disclosure, and Legal Bases

We collect, use, and disclose personal information for the following identified purposes:

6.1 To Provide and Operate the Service

Including account creation and management, generation of personalized AI meal plans, nutrition recommendations, health scores, and insights, wellness tracking, care reminders, Family sharing, and “Find Help” location features.

Legal bases: Performance of a contract with you; consent where required; legitimate interests in providing the Service.

6.2 To Personalize and Improve the Service

Including continuous personalization of Kira recommendations based on logged history, analysis of usage (aggregated or de-identified where feasible), product development, and quality improvement. Improvement of the Service is carried out using aggregated or de-identified information; we do not use your personal information to train artificial intelligence models, as set out in Section 15.2.

Legal bases: Legitimate interests in improving the Service; consent where required for specific features.

6.3 To Process Subscriptions and Transactions

Managing paid subscriptions, renewals, and related account status.

Legal bases: Performance of contract; legal obligation.

6.4 To Communicate with You

Transactional communications (account notices, subscription confirmations, security alerts, service updates); marketing and promotional communications only with your prior consent and in compliance with CASL.

Legal bases: Contract / legitimate interests (transactional); consent (marketing).

6.5 For Security, Fraud Prevention, and Legal Compliance

Detecting and preventing unauthorized access, fraud, abuse, or security incidents; enforcing our Terms of Service; complying with legal obligations and responding to lawful requests from authorities.

Legal bases: Legitimate interests; legal obligation.

6.6 With Your Consent

Any other purpose for which you provide specific consent.

We do not use personal information for purposes that are incompatible with the identified purposes without further consent or as otherwise permitted by law.

7. Sharing and Disclosure of Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We disclose personal information only as follows:

7.1 Service Providers and Processors

We engage third-party service providers under written agreements (including data processing agreements where required by law) who process personal information solely on our instructions and for the purposes described in this Policy:

We put in place a written data processing agreement with every service provider that processes personal information on our behalf. These providers are required to implement appropriate security measures, to process personal information only on our documented instructions, and are prohibited from using it for their own purposes.

7.2 Family / Household Members

Shared pet data is made available to accounts you invite under a Family plan. You are responsible for the invitations you issue and for the actions of invited members with respect to shared data.

7.3 Legal and Safety Disclosures

We may disclose personal information if required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Koeta, our users, or the public, or to detect, prevent, or address fraud, security, or technical issues.

7.4 Business Transfers

In connection with a merger, acquisition, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of the assets, subject to appropriate confidentiality and notice requirements.

7.5 With Your Consent

We may share information with third parties when you direct us to do so or provide consent.

8. International Data Transfers

Koeta is established in Canada. Personal information may be transferred to, stored in, or processed in countries other than your own, including the following:

• The European Union. Our database infrastructure is operated by Supabase and is hosted in Stockholm, Sweden. Account, pet profile, and related records are therefore stored in the European Union, including records of users resident in Canada and elsewhere.
• The United States. Our AI inference provider, subscription management provider, and email delivery provider operate from the United States, and information is transmitted to them for the purposes described in Section 7.
• Other countries in which our service providers operate from time to time.

Where the law of your country restricts transfers of personal information across borders, we rely on a lawful transfer mechanism recognised under that law. Depending on the transfer, these include:

• An adequacy decision. The European Commission and the United Kingdom have each recognised Canada as providing an adequate level of protection for personal information handled by commercial organisations subject to PIPEDA. Transfers to Koeta in Canada from the European Economic Area and the United Kingdom are made on that basis.
• Standard Contractual Clauses approved by the European Commission, or the United Kingdom International Data Transfer Agreement or Addendum, for onward transfers to our service providers in countries without an adequacy decision.
• Any other transfer mechanism permitted by the law applicable to you, including certification schemes and, where relevant, your explicit consent.
• For transfers of information about residents of Quebec outside that province, the assessment described in Section 19.4.

By using the Service you acknowledge that your information may be transferred to and processed in countries whose data protection standards differ from those of your country of residence, and that while outside your country it may be accessible to foreign courts, law enforcement, and national security authorities. You may obtain further information about the safeguards applied to a particular transfer, including a copy of the relevant clauses, by contacting the Privacy Officer.

9. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to provide continuous personalization of the Service, to comply with legal, accounting, or reporting obligations, to resolve disputes, and to enforce our agreements.

• Account and pet profile data, including AI interaction history used for personalization, is retained for the duration of your account and for a reasonable period thereafter.
• Kira conversation history and facts Kira learns about your pet are kept in your account until you delete the conversation, the pet, or your account.
• You may delete individual pet profiles or your entire account at any time through the in-app settings (Edit Profile → Delete Account) or by contacting the Privacy Officer.
• Account deletion in the App. When you delete your account in the App, your access ends immediately: you are signed out on every device and can no longer use PetKira, your pet photos are removed from our storage, and any household sharing links are removed. Your remaining account information is then kept in a restricted archive for 30 days so that an accidental deletion can be reversed if you contact us within that period. After 30 days, your profile information, pet profiles, meals and meal plans, care and activity logs, photos, notification tokens and household links are permanently deleted. Deleting your account does not cancel a paid subscription; you must cancel it through the Apple App Store or Google Play.
• For deletion requests made outside the App, and subject to verification of your identity, we will delete or de-identify the relevant personal information from our active systems within the timeframes required by applicable law, subject to residual backup copies that are securely isolated and deleted according to our backup cycles, and subject to any legal holds or retention required by law.
• Billing, subscription and security records (for example, your subscription status and the related audit trail, which are also held by our payment providers) may be retained for longer after your account is deleted, as required by tax, accounting and other legal obligations and to protect against fraud and abuse.
• Aggregated or anonymized data that cannot reasonably be used to identify an individual may be retained indefinitely for analytical and improvement purposes.
• Email addresses collected through the early-access sign-up form at petkira.com are used only to administer the early-access programme and to contact you about early access. They are retained until the programme concludes or until you ask us to delete them, whichever is earlier. To have your sign-up entry deleted, contact hello@petkira.com.

10. Your Rights

We will respond to verified requests within the timeframes required by applicable law (typically 30 days under PIPEDA, one month under the GDPR and UK GDPR, and 45 days under CCPA/CPRA, with extensions where permitted).

10.1 Rights Available to All Users

Regardless of where you live, and whether or not the law of your country requires it, we make the following rights available to every user of the Service:

• Access — to be told whether we hold personal information about you and to obtain a copy of it.
• Correction — to have inaccurate or incomplete personal information corrected.
• Deletion — to have your personal information deleted, subject to information we must retain by law.
• Portability — to receive personal information you provided to us in a structured, commonly used, machine-readable format.
• Withdrawal of consent — to withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal. AI sharing: Profile → AI & Privacy in the app.
• Objection — to object to processing carried out on the basis of our legitimate interests, and at any time to processing for direct marketing.
• Complaint — to complain to us, and to the data protection authority in your country or region.

The sections that follow describe rights that specific laws add to, or express differently from, the list above. They do not limit it.

10.2 Rights under PIPEDA (Canada)

• Right to access your personal information held by us.
• Right to request correction of inaccurate or incomplete personal information.
• Right to challenge our compliance with PIPEDA.
• Right to withdraw consent where consent is the basis for processing (subject to legal or contractual restrictions).

10.3 Rights under the GDPR and UK GDPR

• Right of access.
• Right to rectification.
• Right to erasure (“right to be forgotten”).
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing (including for direct marketing and, where applicable, processing based on legitimate interests).
• Right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before withdrawal).
• Right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you (to the extent applicable; our AI recommendations are advisory tools and do not produce such effects, as described in Section 15).
• Right to lodge a complaint with your local supervisory authority. In the United Kingdom this is the Information Commissioner’s Office (ico.org.uk); in the European Economic Area it is the authority for your country of residence, place of work, or the place of the alleged breach.

10.4 Rights under CCPA/CPRA (California Residents)

• Right to know the categories and specific pieces of personal information collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom the information is disclosed.
• Right to delete personal information (subject to exceptions).
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information as defined under the CCPA/CPRA).
• Right to limit the use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising your rights.

Sensitive personal information. Where you enable the “Find Help” feature, the precise geolocation data described in Section 4.4 constitutes sensitive personal information under the CCPA/CPRA. We use it solely to identify nearby veterinarians, groomers, pet stores, and related services at your request, and for no other purpose. We do not use or disclose it to infer characteristics about you. You may withdraw the permission at any time in your device settings, which stops the collection entirely.

California residents may exercise these rights by contacting hello@petkira.com or using in-app tools. We will not discriminate against you for exercising your rights.

10.5 Users in Other Jurisdictions

PetKira is offered in many countries and this Policy is written to apply wherever you are. If the law of your country, state, or province grants you privacy rights beyond those described above, those rights apply to you in full and we will honour them, whether or not that law is named in this Policy. This includes, without limitation, jurisdictions in the European Economic Area, Australia, Brazil, Japan, Singapore, South Africa, Switzerland, and the states of the United States that have enacted comprehensive privacy legislation. Contact our Privacy Officer to exercise any such right, and we will confirm what is available to you.

10.6 How to Exercise Your Rights

Submit requests by email to hello@petkira.com (include “Privacy Request” in the subject line) or through available in-app account management tools (including Delete Account, which removes your access immediately and permanently deletes your personal information after a 30-day hold, as described in Section 9). We may need to verify your identity before responding. Authorized agents may submit requests on behalf of California residents subject to verification requirements.

You may also manage certain preferences directly in the App (account settings, location permissions, notification settings) and unsubscribe from marketing emails via the link in any such email.

11. Children’s Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will take steps to delete such information as soon as practicable. If you believe we may have collected information from a child under 13, please contact the Privacy Officer immediately.

Some jurisdictions set a higher age at which an individual may consent to the processing of their own personal information. Where the age applicable in your jurisdiction of residence is higher than 13, that higher age applies to you. In Quebec the age is 14, and in parts of the European Economic Area it may be as high as 16. Below the applicable age, consent must be given by the holder of parental responsibility.

Parents or guardians of users under the age of majority in their jurisdiction should supervise the use of the Service.

If you are resident in Quebec and under 14 years of age, consent to the collection, use, or disclosure of your personal information must be given by the person having parental authority over you or by your tutor.

12. Security Safeguards

We implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information to protect it against loss, theft, unauthorized access, disclosure, copying, use, or modification. These measures include encryption of data in transit (TLS) and at rest where appropriate, access controls and authentication, secure development practices, vendor security assessments, and monitoring.

While we strive to protect personal information, no method of transmission over the Internet or method of electronic storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

12.1 Breach of Security Safeguards

We maintain a record of every breach of security safeguards involving personal information under our control. Where a breach creates a real risk of significant harm to an individual, we will report the breach to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible, in accordance with the Personal Information Protection and Electronic Documents Act. Where the breach involves personal information of residents of Quebec, we will also notify the Commission d’accès à l’information and the affected individuals in accordance with applicable Quebec law. We will notify supervisory authorities and individuals in other jurisdictions where and as required by applicable law.

13. Cookies and Similar Technologies

Our website may use essential cookies necessary for functionality and limited analytics or preference cookies. Where required by law, we obtain consent for non-essential cookies. You may manage cookie preferences through your browser settings. The mobile application uses device permissions and similar technologies necessary for core functionality (including location when enabled).

We do not sell or share personal information for cross-context behavioral advertising, so there is no such activity for an opt-out preference signal to stop. Where our website receives an opt-out preference signal such as Global Privacy Control, we treat it as a request not to set non-essential cookies and honour it accordingly.

14. Marketing Communications and CASL

Transactional emails relating to your account, subscriptions, and the Service do not require marketing consent.

Marketing or promotional commercial electronic messages are sent only with your express or implied consent as permitted under CASL.

14.1 How We Obtain Your Consent

We collect express consent to marketing communications through an opt-in checkbox presented during account registration and on the petkira.com early-access sign-up form. The checkbox is unchecked by default, is separate from your acceptance of these Terms and this Policy, and its label describes the types of message you will receive. We record the date and time of your consent, the wording you were shown, and the method by which it was given, and we retain that record for at least three years after consent is withdrawn, as CASL requires.

14.2 What Every Marketing Message Contains

Every marketing message identifies Koeta Inc. as the sender, states our mailing address at 195 Cannon Street East, Hamilton, Ontario L8L 2A7, Canada, and includes a working unsubscribe link that we honour without charge and within ten business days. You may also withdraw consent at any time by contacting hello@petkira.com.

14.3 Transactional Messages

Messages that are not commercial electronic messages under CASL, such as one-time passcodes, subscription confirmations, receipts, security alerts, and service notices, are sent whether or not you have consented to marketing, because they are necessary to provide the Service. They identify Koeta as the sender. You cannot unsubscribe from these while you hold an account, but you may close your account at any time.

15. Artificial Intelligence, Model Training, and Automated Decision-Making

15.1 How the AI Features Work

The Service uses artificial intelligence (including third-party models from OpenAI) to generate personalized recommendations, meal plans, health scores, and insights. These outputs are advisory tools intended to assist you; they do not constitute solely automated decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the UK GDPR. You remain responsible for all decisions regarding your pet’s care. For further information on the nature and limitations of AI Features, please review the PetKira AI and Pet Health Disclaimer.

15.2 We Do Not Train AI Models on Your Information

Koeta does not use your personal information, or information about your pet, to train artificial intelligence models. Koeta does not develop, train, or fine-tune its own models, and does not permit its AI service providers to use your information to train theirs. Information is transmitted to our AI service provider solely to generate responses for you.

Personalization works by supplying relevant information from your own account to the model at the time of your request; it does not alter the model itself. We use aggregated or de-identified information, which cannot reasonably be used to identify you, to analyse usage and improve the Service.

OpenAI may keep requests and replies for up to 30 days to detect abuse, then delete them, except where the law requires longer. Under OpenAI’s API terms, this data is not used to train OpenAI’s models. Such retention is not use for training.

If we ever propose to use identifiable personal information to train an artificial intelligence model, we will not do so without first obtaining your separate express consent.

15.3 What We Send to OpenAI, and Your Choice

The first time you use an AI feature, the app shows a screen naming OpenAI, listing the data described in Section 7.1, and asking you to allow or decline. We send nothing to OpenAI until you allow it. You can turn sharing off at any time in Profile → AI & Privacy, or by emailing hello@petkira.com. If you decline or turn it off, the AI features stop and the rest of PetKira keeps working. Turning it off does not delete past conversations in your account; delete your account to remove them (Section 9).

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Every version carries a version number and a “Last Updated” date, and the version in force is the one published at petkira.com and in the Service.

A material change is one that changes the purposes for which we use your personal information, introduces a new category of information or a new recipient, reduces your rights, or extends a retention period. For a material change we will give notice before it takes effect through the App, by email, or by prominent notice, and where applicable law requires fresh consent we will obtain it rather than rely on notice alone. A non-material change, such as a correction, clarification, or formatting change, takes effect on posting with the revised date.

Your continued use of the Service after a change takes effect constitutes acceptance of it, except where applicable law requires additional consent.

17. Complaints and Contact

If you have questions, concerns, or complaints about our privacy practices, please contact the Privacy Officer first so that we may attempt to resolve the matter:

Privacy Officer, Koeta Inc.
195 Cannon Street East, Hamilton, Ontario L8L 2A7, Canada
hello@petkira.com

If you are not satisfied with our response:

• In Canada, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).
• In the United Kingdom, you may contact the Information Commissioner’s Office (ico.org.uk).
• In California, you may contact the California Privacy Protection Agency or the California Attorney General.

18. Additional CCPA Notice at Collection

At or before the point of collection, we provide notice of the categories of personal information to be collected and the purposes for which the categories will be used, as detailed in Sections 4 and 6 of this Policy. We do not sell or share personal information. Retention periods or criteria are described in Section 9. California residents have the rights described in Section 10.4.

19. Additional Information for Residents of Quebec

The following applies if you are resident in the Province of Quebec. The Act respecting the protection of personal information in the private sector, as amended (commonly known as Law 25), applies to our handling of your personal information regardless of where Koeta is established.

19.1 Person in Charge of the Protection of Personal Information

The person in charge of the protection of personal information at Koeta holds the title of Privacy Officer and may be contacted at hello@petkira.com, or by post at 195 Cannon Street East, Hamilton, Ontario L8L 2A7, Ontario, Canada.

19.2 Your Rights

In addition to the rights set out in Section 10, you have the right to:

• be informed of the personal information we hold about you and to obtain access to it;
• have inaccurate, incomplete, or equivocal personal information corrected;
• withdraw your consent to the collection, use, or disclosure of your personal information;
• require that personal information you have provided to us be communicated to you, or to a person or body authorized to collect it, in a structured and commonly used technological format (data portability);
• require that the dissemination of your personal information cease, or that any hyperlink to it be de-indexed, where the dissemination contravenes the law or a court order; and
• submit a complaint to the Commission d’accès à l’information (cai.gouv.qc.ca) if you are not satisfied with our response.

19.3 Automated Processing

As described in Section 15, our AI Features produce advisory recommendations and are not used to render a decision about you based exclusively on automated processing. If that changes, we will inform you at or before the time the decision is made and, on request, tell you what personal information was used, the principal factors and parameters that led to the decision, and your right to have that information corrected. You may in every case submit observations to a member of our personnel able to review the decision.

19.4 Transfers Outside Quebec

As described in Section 8, your personal information may be communicated outside Quebec to our service providers. Before doing so we assess whether the information would receive adequate protection, having regard in particular to the sensitivity of the information, the purposes for which it is to be used, the protection measures that would apply to it, and the legal framework of the jurisdiction concerned. Such transfers are governed by written agreements.

19.5 Confidentiality by Default

Where the Service offers settings that affect the confidentiality of your personal information, those settings provide the highest level of confidentiality by default, without any intervention by you. This does not apply to settings governing the visibility of pet data you deliberately choose to share with members of a Family plan you create.

19.6 Language

This Privacy Policy is currently provided in English. You may request information about it in French by contacting hello@petkira.com.

— End of PK-LEG-002 —