Privacy Policy
Plain-language explanation of how we handle your data. No legal jargon where we can avoid it.
Last updated: 21 May 2026 · Version 1.4
1. Who We Are
Wiggly Tails is a free, non-profit platform helping rescue dogs find homes across Europe. We are operated by Fabio Gonçalves from Munich, Germany, under the laws of the European Union.
Data Controller: Fabio Gonçalves (Wiggly Tails)
Email: privacy@wiggly-tails.eu
Location: Munich, Germany
Website: wiggly-tails.eu
2. What Data We Collect
We only collect data that is necessary to run the platform. Here is exactly what:
Account Data
- Email address (for login and notifications)
- Display name (optional, shown on your profile)
- Password (hashed — we never see or store it in plain text)
- Language preference
Rescue Organisation Data
- Organisation name, address, city, country
- Contact details (email, phone, website)
- Logo and gallery images
- Permit numbers (Tierschutzgesetz, SIAC) — for verification only
Messages & Applications
- Messages sent to rescues via the contact form
- Adoption application answers (name, living situation, experience)
What We Do NOT Collect
- We do not use Google Analytics, advertising trackers, or marketing cookies
- We do not use Facebook Pixel or build advertising profiles
- We do not sell, share, or monetise your personal data
- We do not transfer data outside the European Union
3. Legal Basis (Art. 6 GDPR)
| Processing Activity | Legal Basis |
|---|---|
| Account creation and login | Contract performance — Art. 6(1)(b) |
| Rescue profile management | Contract performance — Art. 6(1)(b) |
| Sending messages to rescues | Contract performance — Art. 6(1)(b) |
| Essential cookies (session, language) | Legitimate interest — Art. 6(1)(f) |
| Functional cookies (journey progress) | Consent — Art. 6(1)(a) |
| Privacy-friendly analytics (Umami, cookieless) | Legitimate interest — Art. 6(1)(f) |
| Search Console verification & search reporting | Legitimate interest — Art. 6(1)(f) |
| Automatic translation of public content (Mistral AI, EU) | Legitimate interest — Art. 6(1)(f) |
| Newsletter (if subscribed) | Consent with double opt-in — Art. 6(1)(a) |
| Platform security and abuse prevention | Legitimate interest — Art. 6(1)(f) |
Analytics & Search Performance
To understand which dogs, guides, and pages help people the most — and whether people are finding rescue listings — we measure traffic with Umami, a privacy-friendly analytics tool we run on our own EU-hosted infrastructure. We use this only to improve discoverability and help more people find rescues.
- No cookies. Umami sets no cookies and writes nothing to your device. Your cookie choices are unaffected.
- No personal data. We do not collect names, emails, or identifiable IP addresses. IP addresses are used only momentarily to derive a country and are never stored.
- No cross-site tracking, no profiles, no ads. Your behaviour is not followed across other websites, never used to build a profile, and never sold or shared with advertisers or data brokers.
- Aggregate only. We see counts — page views, referrers, country, browser, device type — never an individual journey tied to a person.
- Stays in the EU. Analytics data is stored on EU infrastructure and processed under the GDPR.
We also use Google Search Console to see which search terms bring people to Wiggly Tails, and which pages Google has indexed. Search Console reports only aggregate, anonymised search statistics to us (queries, clicks, impressions, click-through rate, and average position). It is verified using a DNS record only — it places no tracking on this site and does not mean Google Analytics is installed. Google processes Search Console data under its own terms.
Legal basis: legitimate interest — Art. 6(1)(f) GDPR (operating and improving a free, non-profit service using privacy-preserving, aggregate measurement). You can object at any time at privacy@wiggly-tails.eu. We aim to collect as little data as possible.
5. Where Your Data Is Stored
Database: Supabase (Frankfurt, Germany)
All user data, rescue profiles, dog listings, messages, and applications.
Website hosting: Netlify (CDN with EU nodes)
Static website files. No personal data is processed by Netlify.
Authentication email: Supabase Auth (Frankfurt, Germany)
Sign-up confirmation and password reset emails only.
Transactional & newsletter email: Resend (Dublin, Ireland — AWS eu-west-1)
Delivers service notifications (such as adoption request and message confirmations, sponsorship and foster updates) and, only if you opted in via double opt-in, our occasional newsletter. We send Resend only the recipient's email address, display name, and the contents of the message being sent — never your password, adoption-application answers, or private messages between adopters and rescues. Resend processes this on servers in Ireland (AWS eu-west-1); your data stays within the EU.
Analytics: Umami (self-hosted, EU infrastructure)
Cookieless, aggregate traffic measurement. No personal data — see Analytics & Search Performance above.
Search reporting: Google Search Console
Aggregate, anonymised search statistics only. Verified by DNS record — no tracking is added to this site.
Automatic translation: Mistral AI (Paris, France)
Public content — dog stories, news posts, sponsor updates and their comments, rescue/community/vet descriptions, blog guides, and safety articles — is automatically translated into the platform's eight supported languages by Mistral AI, a French AI provider operating under EU jurisdiction. Only the text being translated is sent — never account data, email addresses, adoption-application answers, or private messages between adopters and rescues. Mistral does not use this data to train its models and does not retain it beyond what is needed to process the request.
Authentication fonts & icons: Self-hosted
Material Symbols icon fonts are served from our own domain — no requests to Google Fonts CDN.
Third-Party Services Involving Data Transfers Outside the EU
Google (Sign in with Google)
If you choose to sign up or log in using Google, Google transfers your name and email address to us. This involves a data transfer to Google LLC (USA). Google processes this under its own privacy policy and Standard Contractual Clauses (SCCs) with the EU. We receive only the name and email you grant access to.
PayPal (Dog sponsorship donations)
Rescue organisations may provide a PayPal.me link for dog sponsorships. Clicking a donation link takes you to PayPal's website directly. Wiggly Tails does not process or receive any payment data. PayPal's own privacy policy applies to all transactions.
Except for the Google OAuth and PayPal redirects described above, we do not transfer personal data to countries outside the European Economic Area (EEA).
6. Data Retention
We keep your data only as long as needed. Here are the specific retention periods:
| Data Type | Retention Period | What Happens Then |
|---|---|---|
| Account data | Until you delete your account | Deleted within 30 days |
| Rescue organisation profile | Until the rescue deletes it | Removed from platform, archived 90 days, then deleted |
| Messages to rescues | 1 year after last activity | Permanently deleted |
| Adoption applications | 2 years after completion | Permanently deleted |
| Newsletter consent | Until you unsubscribe | Email removed, consent log kept for 3 years (legal proof) |
| Cookie consent records | 3 years | Deleted (kept for GDPR accountability) |
| Server logs | 7 days | Automatically deleted |
7. Your Rights Under GDPR
You have full control over your personal data. These rights are free to exercise:
Right of Access (Art. 15)
Request a copy of all personal data we hold about you.
Right to Rectification (Art. 16)
Correct any inaccurate or incomplete data.
Right to Erasure (Art. 17)
Ask us to delete your data ("right to be forgotten").
Right to Restrict Processing (Art. 18)
Limit how we use your data while a dispute is resolved.
Right to Data Portability (Art. 20)
Receive your data in a machine-readable format (JSON/CSV).
Right to Object (Art. 21)
Object to processing based on legitimate interest.
Right to Withdraw Consent (Art. 7(3))
Withdraw any consent at any time — no questions asked.
8. How to Exercise Your Rights
To make a data subject request, email us at:
emailprivacy@wiggly-tails.euWe will respond within 30 days as required by the GDPR.
We may ask you to verify your identity before processing your request.
All requests are free of charge.
9. Supervisory Authority
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with a data protection supervisory authority. Since we are based in Bavaria, Germany, the relevant authority is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Website: lda.bayern.de
Email: poststelle@lda.bayern.de
You may also contact the supervisory authority in your own EU member state.
10. Changes to This Policy
We may update this policy from time to time. If we make significant changes, we will notify you via the website or email. The "Last updated" date at the top of this page always reflects the current version.