Contents
Privacy Policy – HeyPets
Last updated: 09/09/26
1. General and Identity of the Data Controller
1.1. This Privacy Policy governs the manner in which information is collected, used, retained, processed and transferred in connection with the HeyPets website and application and the services provided through them.
1.2. The controller of the databases relevant to the Service is:
E.K.A.G Apps Ltd., Company No. 517275624, which operates the HeyPets venture. General e-mail: info@heypetsapp.com.
E-mail for inquiries regarding privacy, access to, rectification and deletion of information: support@heypetsapp.com (hereinafter: the "Company", "HeyPets" or "we").
1.3. This Policy applies to any person who uses the HeyPets website, application or services, including a registered user, a guest user, a business owner, a service provider and any other user.
1.4. This Policy constitutes an integral part of the HeyPets Terms and Conditions of Use.
2. Applicable Law and Privacy Protection Principles
2.1. The Company shall act with respect to personal information in accordance with the provisions of the law applicable to it, including the Privacy Protection Law, 5741-1981, as amended by Amendment No. 13, the Privacy Protection Regulations (Data Security), 5777-2017, the Privacy Protection Regulations applicable to the transfer of information outside of Israel, and other relevant provisions of law.
2.2. The Company shall act in accordance with the principles of transparency, purpose limitation, proportionality, data minimization, data security and restriction of access to information on a need-to-know basis.
2.3. In accordance with Amendment No. 13, the Company is a "database controller" insofar as it determines the purposes of the processing of the information and the manner of its use.
3. Provision of Personal Information and the Consequences of Non-Provision
3.1. As a rule, the user is under no legal obligation to provide the Company with personal information, and the provision of information is made of the user's own free will and with the user's consent, unless expressly stated otherwise.
3.2. However, the provision of certain details may be necessary for the purpose of creating an account, using certain services or performing an action in the application.
3.3. A user who chooses not to provide information required for the operation of a particular service may not be able to use that service, in whole or in part.
3.4. For example, failure to grant location permission may prevent or limit services based on geographic proximity; failure to provide an e-mail address may prevent the opening of an account in a certain manner; and failure to provide information required for the creation of a profile may limit the ability to contact other users.
4. Types of Information We May Collect
The Company may collect and process, depending on actual use, the following types of information:
4.1. Information provided by the user
- a. Name;
- b. E-mail address;
- c. Encrypted password and/or authentication data;
- d. Telephone number, to the extent provided;
- e. Date of birth for the purpose of age verification;
- f. Profile picture;
- g. Location details;
- h. Search and matching preferences;
- i. Information provided by the user when contacting support;
- j. Information provided as part of a report of a malfunction or bug.
4.2. Information about pets
The Company may process information entered by the user regarding a pet, including:
Name, type of animal, breed, age, gender, photographs, description, location, adoption information, information about vaccinations, treatments, reminders, documents, medical images and veterinarian details.
It is clarified that insofar as such information also includes information that enables the identification of a person – for example, owner details, veterinarian details, or a document containing a name or contact details – that part may be deemed personal information.
4.3. User content
The Company may collect and process:
Photographs, videos, Stories, posts, comments, reviews, ratings, publications, reports, documents and other content uploaded by the user.
4.4. Messages and communications
When using the chat or communication services, the Company may process:
- a. The content of text messages;
- b. Images sent;
- c. Voice messages;
- d. Sender and recipient data;
- e. The time of the message;
- f. Information required for the purposes of security, operation, prevention of abuse and handling of reports.
4.5. Location data
Subject to the permissions granted on the device, the Company may receive and store the user's location for the purpose of location-based services.
In certain cases, such as a report of a lost pet, the location entered by the user may be displayed to other users.
4.6. Technical information
We may collect information such as:
IP address, device type, operating system, application version, technical identifiers, login times, malfunctions, Crash Reports, usage data, Notification Token, security data and technical logs.
4.7. Subscription information
We may receive information regarding the type of subscription, subscription status, start/renewal date and technical transaction details.
The Company does not receive or hold the user's full credit card details where payment is made through Apple or Google.
5. Information Received from Third Parties
5.1. Where a user registers through Google, Apple or Facebook, the Company may receive from the relevant service basic information in accordance with the permissions granted, such as name, e-mail address and account identifier.
5.2. The Company does not control the privacy policies of those entities, and the use of their services is also subject to their terms.
5.3. The Company may receive information from service providers for the purposes of operation, security, troubleshooting, user authentication and cloud services.
6. Purposes of Processing the Information
The Company may use the information, inter alia, for the purpose of:
- a. Creating and managing a user account;
- b. User authentication;
- c. Displaying profiles of users and pets;
- d. Matching users according to preferences and location;
- e. Operating chat and communications;
- f. Displaying lost pets;
- g. Operating adoption services;
- h. Managing a digital file for a pet;
- i. Operating reminders;
- j. Connecting users with veterinarians and businesses;
- k. Operating artificial intelligence-based services;
- l. Identifying and filtering inappropriate content;
- m. Displaying relevant advertisements by location;
- n. Managing subscriptions and paid services;
- o. Providing service and support;
- p. Detecting, preventing and handling malfunctions, fraud, abuse and security incidents;
- q. Enforcing the Terms of Use;
- r. Handling complaints and reports;
- s. Analyzing and improving the Service;
- t. Protecting the rights of the Company and of users;
- u. Complying with a legal obligation, a court order or an authorized demand under law.
7. Information Visible to Other Users
7.1. Some of the information on the platform is, by its nature, intended to be displayed to others.
7.2. Such information may include, depending on the user's settings and the service:
Name, profile picture, information about the pet, photographs, description, area or distance, posts, videos, Stories, reviews, ratings and other content published as public.
7.3. Information from the pet's digital medical file is not intended for public display.
7.4. The Company recommends not publishing unnecessary personal information in public spaces.
8. Location Services
8.1. HeyPets uses location for the purposes of matching, searching for users, businesses, veterinarians and services, and reporting lost pets.
8.2. The application may request access to precise location in accordance with the operating system permissions.
8.3. The user may change or revoke location permissions through the device settings.
8.4. Revoking the permission may cause certain services not to operate or to operate in a limited manner.
8.5. As a rule, other users will receive information about distance or area and not necessarily the user's precise location, except in cases where the nature of the service requires otherwise or where the user has himself or herself published a location.
9. Artificial Intelligence
9.1. HeyPets makes use of tools based on artificial intelligence, inter alia for the purposes of chat, search, content creation, Avatar creation and the filtering of inappropriate images or content.
9.2. For the purpose of certain services, content entered or uploaded by the user may be transferred for processing through Google Gemini services and/or additional AI providers that may be integrated into the Service from time to time.
9.3. The user is requested not to enter into AI systems sensitive personal information that is not required for the purpose of the Service.
9.4. The Company may use automated processes for the purpose of identifying content that violates the Terms of Use, but does not undertake that an automated system will identify all prohibited content or that no error will occur.
9.5. Insofar as an automated system having a significant effect on a user's rights is used in the future, the Company shall act to provide appropriate disclosure in accordance with the law.
The express reference to AI is of particular importance because the Privacy Protection Authority has noted that the duty of notification also applies in the contexts of algorithmic systems and artificial intelligence.
10. Disclosure of Information to Third Parties
The Company does not sell users' personal information as a database.
The Company may disclose or allow access to information to third parties only insofar as required for the purposes set out in this Policy, including, inter alia:
- a. Cloud and storage service providers;
- b. Technology infrastructure providers;
- c. Identification and login providers;
- d. Artificial intelligence providers;
- e. Push Notifications providers;
- f. Error monitoring services;
- g. Apple and Google for the purposes of subscriptions and purchases;
- h. A veterinarian to whom the user has chosen to connect, in accordance with the relevant features and permissions;
- i. A business or service provider when the user contacts it;
- j. Competent authorities, where a legal obligation exists;
- k. In the course of legal proceedings, for the purpose of protecting the Company's rights;
- l. In the event of a merger, acquisition, sale of business activity or structural change, subject to the law.
11. Principal Service Providers
As of the date of this Policy, the Company may make use, inter alia, of the following services:
Google Firebase / Google Cloud – storage, databases, Authentication, Cloud Functions and infrastructure;
Google Sign-In – account login;
Google Places – locations, addresses and businesses;
Google Gemini – AI services and content processing;
Firebase Cloud Messaging (FCM) – Push notifications;
Apple Sign-In – login;
Apple App Store – payments and subscriptions;
Google Play – payments and subscriptions;
Meta/Facebook – login via Facebook;
Sentry – error reports and Crash Reports;
Expo – Push services on some devices;
and additional technological services as may be required for the operation of the system.
12. Transfer of Information Outside of Israel
12.1. Some of the Company's providers operate servers and systems outside of Israel.
12.2. Inter alia, the information may be stored and processed through Google Cloud/Firebase in the United States, including in the storage regions used by the Company.
12.3. The transfer of information outside of Israel shall be carried out in accordance with the provisions of law applicable to the transfer of information outside the borders of the State.
12.4. The Company shall act, to the extent required by law, to obtain appropriate undertakings and safeguards from providers that receive information outside of Israel.
The Authority emphasizes that, when transferring information outside of Israel, the Transfer of Information Regulations must be examined and, in the relevant cases, an appropriate undertaking to protect privacy must also be obtained from the recipient.
13. Users from the European Economic Area
13.1. HeyPets may also be available to users outside of Israel.
13.2. Insofar as information is transferred to Israel from the European Economic Area in a manner that brings into application the Privacy Protection Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 5783-2023, the Company shall act in accordance with the applicable provisions.
13.3. Without derogating from the foregoing, in such cases there may be additional obligations in connection with deletion, data minimization, data accuracy and the provision of information to the data subject.
13.4. Nothing in the foregoing constitutes a representation that every international user is necessarily subject to the GDPR or that the Company is in every case subject to every foreign law; the question of the applicability of the law shall be examined according to the circumstances.
14. Data Security
14.1. The Company employs organizational and technological measures designed to protect the information against unauthorized access, use, alteration, disclosure or deletion.
14.2. These measures may include, depending on the Company's systems:
- a. Access permission mechanisms;
- b. User authentication;
- c. Encryption of communications;
- d. Separation of permissions;
- e. Activity records and logs;
- f. Monitoring of malfunctions and incidents;
- g. Backups;
- h. Restriction of access to information solely for the purpose of one's role;
- i. Use of infrastructure providers having accepted security measures.
14.3. The Company shall act in accordance with the security level applicable to its databases under the Privacy Protection Regulations (Data Security). The Data Security Regulations require, inter alia, the management of permissions on a need-to-know basis, user authentication and the securing of communications.
14.4. Notwithstanding the measures taken, no system is completely immune to intrusion, malfunction, cyber-attack or security incident, and therefore the Company cannot guarantee absolute security.
15. Internal Access Permissions
15.1. Access to information shall be restricted, to the extent possible, to those who require such access for the purpose of their role.
15.2. Authorized system administrators on behalf of the Company may be granted access to information for the purposes of support, maintenance, security, handling of reports, enforcement of the Terms and Conditions and handling of malfunctions.
15.3. This does not confer upon any employee or administrator a permission to use the information for private purposes or for purposes unrelated to his or her work.
16. Retention of Information
16.1. The Company shall retain information for the period required for the purposes for which it was collected and in accordance with operational, legal, accounting or security needs, or for the purpose of defending against claims.
16.2. Where the information is no longer required, the Company may delete, anonymize or minimize it, subject to the provisions of law.
16.3. Upon the deletion of a user account, the Company shall act to delete the information associated with the account in accordance with its systems and the law, except for information that the Company is obligated or entitled to retain.
16.4. Information may remain for a limited period of time in backups, logs, security records or Recovery systems even after deletion from the active system.
16.5. Certain security data are required under the Data Security Regulations to be retained for the periods prescribed in the Regulations. Thus, for example, certain technical data relating to systems security are retained for a period of 24 months in accordance with Regulation 17.
17. Account Deletion
17.1. A registered user may delete his or her account through the option designated for that purpose in the application.
17.2. Deletion of the account may result in loss of access to the profile, to the information entered and to the services associated with the account.
17.3. Deletion of the account does not guarantee the immediate deletion of every technical copy, backup or information for which there is a legal obligation or justification to retain it.
18. Right of Access to Information
18.1. In accordance with Section 13 of the Privacy Protection Law, a person is entitled, subject to the law, to access personal information about him or her that is held in a database.
18.2. A request for access may be sent to: support@heypetsapp.com
18.3. The Company may request the details required to verify the identity of the applicant before providing information.
19. Rectification of Information
19.1. In accordance with Section 14 of the Law, a person who believes that personal information about him or her is not correct, complete, clear or up to date may request that it be rectified or updated.
19.2. Such a request shall be submitted to: support@heypetsapp.com
19.3. The Company shall examine the request in accordance with the law. The rights of access and rectification are an express part of the duty of notification under Amendment No. 13.
20. Deletion Requests
20.1. A user may apply to the Company with a request for the deletion of personal information.
20.2. The Company shall examine the request in accordance with the law, the nature of the information and the need for its continued retention.
20.3. There may be cases in which it will not be possible to delete information, in whole or in part, inter alia due to a legal obligation, fraud prevention, protection of legal rights, data security or the retention of records required by law.
20.4. Where special provisions requiring deletion apply to information, the Company shall act in accordance with them.
21. Accuracy and Updating of Information
21.1. The user is requested to update his or her details as they change.
21.2. The Company may, in appropriate cases, request that the user update or verify information.
21.3. The Company shall not be liable for damage caused as a result of incorrect information that the user himself or herself entered.
22. Marketing and Mailings.
22.1. As of the date of publication of this Policy, the Company does not necessarily send marketing mailings by e-mail or by text message.
22.2. Insofar as the Company chooses in the future to send advertising material, it shall act in accordance with the law and shall request consent where required.
22.3. The user shall be entitled to unsubscribe from marketing mailings in accordance with the mechanism presented in the message.
22.4. Service messages, security messages, messages regarding the account, matches, chat messages or operational information are not necessarily marketing messages.
23. Push Notifications
23.1. The application may send Push notifications in connection with interactions, matches, messages, events, reminders or account activity.
23.2. The user may change the notification permissions in the device settings.
24. Advertising
24.1. HeyPets may display advertisements and business content.
24.2. Insofar as the advertising is tailored, such tailoring may be based, inter alia, on the user's location.
24.3. The Company shall not use personal information for advertising purposes that are inconsistent with the purposes of which the user was notified, except subject to consent or another lawful source of authority.
25. Cookies and Similar Technologies
25.1. According to the information provided to the Company at the time this Policy was drafted, the HeyPets website does not make deliberate use of cookies for advertising or Tracking purposes beyond the technical components required for its operation.
25.2. Insofar as additional Cookies, Pixels or Analytics tools are integrated in the future, this Policy shall be updated accordingly and, where necessary, an appropriate consent mechanism shall be presented.
26. Privacy of Minors
26.1. HeyPets is intended for users aged 18 and over.
26.2. An account may not be opened for a person who has not yet reached the age of 18.
26.3. The Company may block or delete an account if it transpires that it was opened in contravention of the age requirements.
26.4. If a parent or guardian believes that a minor has provided information in contravention of this Policy, they may contact support@heypetsapp.com.
27. Reports Regarding Users and Content
27.1. A user may report a user, a business or content.
27.2. For the purpose of handling a report, the Company may review information relating to the incident, including content, messages, technical details and account data, to the extent required for the inquiry.
27.3. Such information shall be used for the purposes of inquiry, protection of users, prevention of violations and enforcement of the Terms of Use.
28. Security Incidents
28.1. The Company shall act to handle a security incident in accordance with the obligations applicable to it.
28.2. In the event of a security incident that is subject to a reporting obligation to the Privacy Protection Authority or to the data subjects, the Company shall act in accordance with the provisions of law.
29. Databases and Regulatory Obligations
29.1. The Company shall examine from time to time the types of information, the number of data subjects, the purposes of the database and the scope of activity for the purpose of determining the obligations applicable to it under the Law.
29.2. Amendment No. 13 narrowed the obligation to register databases, but created a notification obligation with respect to certain databases that include information of special sensitivity in significant volumes. Inter alia, where such information exists regarding more than 100,000 data subjects, an obligation to notify the Authority may apply.
29.3. Insofar as such an obligation arises, the Company shall act to submit the notification and to comply with the other requirements under the law.
30. Privacy Protection Officer
30.1. The Company shall examine from time to time whether its activity requires the appointment of a Privacy Protection Officer (DPO) under Section 17B1 of the Law.
30.2. Such obligation may arise, inter alia, in circumstances where the core activity includes regular and systematic monitoring of individuals on a substantial scale or the processing on a substantial scale of information of special sensitivity.
30.3. Insofar as an obligation to appoint such an officer arises, the Company shall act in accordance with the provisions of law and shall publish the officer's contact details as required.
Amendment No. 13 created express obligations to appoint a DPO in certain types of entities, and in July 2026 the Authority published a detailed final opinion on the matter.
31. Changes to the Policy
31.1. The Company may update this Policy from time to time following a change in the Service, in technology, in providers or in the law.
31.2. The date of the last update shall appear at the top of the Policy.
31.3. Insofar as the update is material, the Company shall act to notify users in an appropriate manner and in accordance with the law.
31.4. Where a change requires obtaining new consent, the Company shall act to obtain it.
32. Privacy Inquiries
For any question, request for access, rectification or deletion, or inquiry in connection with the use of personal information, please contact:
E.K.A.G Apps Ltd., Company No. 517275624, operator of HeyPets
E-mail for privacy matters: support@heypetsapp.com.
The Company may request reasonable information for the purpose of verifying the identity of the applicant before responding to a request relating to personal information.
