Privacy Policy

Last updated: 4 November 2026

Who is the data controller?

Kullio is run by Patric Sandelin, a Swedish sole trader (enskild firma), who is the data controller for the personal data processed in the service. Data-protection questions: hej@kullio.se. We normally reply within seven business days.

What data do we collect?

• Account data: email, password (stored hashed), display name, and language preference. When you create an account we also store which version of the terms you accepted, and when, and whether you said you have bought a puppy or breed dogs.
• Profile and content: photos, posts, comments, messages, meetups, and puppy diaries you create.
• Puppy and kennel info: breeders and owners register litters, puppies, photos, and ownership links. You decide what you enter.
• Technical data: push token if you opt in, when you last had Litter open (so the Litter tab can show a dot when something new is written; only you can see it), and, when you request account deletion, your IP address and user-agent for audit and abuse-prevention purposes.
• Reports and blocks: when you report something we store a copy of the reported content (the text, and for posts a link to the photo), the reason you chose, your note if any, and that you made the report. When you block someone we store that you blocked them. The person you block is not told.
• Invites to puppy buyers: when a breeder invites you to your puppy, the breeder can give your email address, even if you do not have an account yet. We use it only to email you the invite and to show you the puppy when you sign in with the same address. If you say no, the breeder sees that the invite was declined.
• Support correspondence: if you email us we keep the thread for as long as we need to help you.
• Error reports: when the app or the web app crashes or something goes wrong, an error report is sent: what went wrong and where in the code, what the app did just before (pages, buttons and requests, without the addresses' parameters), the type of device, operating system or browser, the app version, and your account id. We do not send your name, email, password, or your posts and messages.

Why do we process it?

We rely on the following legal bases under the GDPR:

• Contract (art. 6(1)(b)): to provide the service according to our terms.
• Consent (art. 6(1)(a)): for public litter pages and push notifications. You can withdraw consent any time.
• Legitimate interests (art. 6(1)(f)): to keep the platform safe, prevent abuse and improve the product, and so a breeder can invite the buyer to their puppy. This covers handling reports, blocks, and the word filter that stops slurs and threats before they are saved, and error reports so we can find and fix bugs.
• Legal obligation (art. 6(1)(c)): to document GDPR actions (e.g., completed deletions) for the limitation period.

Where is the data stored?

The database and uploaded files are stored on a Hetzner server in Ashburn, USA, so your data is transferred outside the EU/EEA. The transfer is protected by the European Commission's Standard Contractual Clauses (art. 46 GDPR) in our data processing agreement with Hetzner.

Hetzner also keeps a copy of the whole server every day. Every night we also send a backup of the database and the uploaded files to Cloudflare, which stores it inside the EU. It is encrypted before it leaves the server, so Cloudflare cannot read it. Backups older than 30 days are deleted.

Error reports are stored by Sentry inside the EU, in Frankfurt.

Email from the service is sent through Resend in the USA: sign-up confirmation, links to choose a new password, account deletion, kennel transfers, invites to puppy buyers, and alerts about new reports to our support.

Who do we share data with?

We use the following sub-processors. For those outside the EU/EEA the transfer is protected by the European Commission's Standard Contractual Clauses (art. 46 GDPR).

• Hetzner Online GmbH (company in Germany, server in the USA): hosting and storage of all data in the service, with daily copies of the server.
• Cloudflare, Inc. (USA, storage inside the EU): keeps our encrypted backups. Cloudflare cannot read their contents.
• Sentry (Functional Software, Inc., USA, storage inside the EU): receives error reports from the app and the web app, so we can see what went wrong. Deleted after 30 days.
• Resend (USA): email from the service. Alerts about new reports contain the reported content and the reporter's note.
• Expo (650 Industries, Inc., USA): forwards push notifications to Apple and Google. A notification contains the sender's name, the litter or group name, and the first 140 characters of the message or post, or the meetup's title and place.
• Apple and Google: delivery of push notifications to your phone via APNs and FCM, if you opt in.
• Google Maps Platform (Google LLC, USA): when we add places to the map in our admin tool. None of your data is sent there.

What you report is read only by us, the people who run Kullio, to decide on the report. We, the people who run Kullio, can also see posts in litters and kennels, so we can remove what breaks the rules. We read your private messages only if someone reports them. Breeders and fellow litter members see what you publish inside a litter. We never sell your data and never use it for advertising.

How long do we keep the data?

• Active account: for as long as the account exists.
• Upon deletion request: you have a 14-day grace period before the account is permanently deleted.
• After deletion: your posts, comments and messages are anonymized in other members' threads (author name removed, body replaced with "[deleted user]"). Photos you uploaded are deleted. Puppies you owned or bred keep their profiles if the kennel remains active.
• Audit record: we keep an anonymized record that an account was deleted for ~6 years to defend against possible complaints. The record contains no direct identifier — the user id is stored as an HMAC hash with a server-side key and cannot be linked back to you.
• Reports: deleted automatically 12 months after we have handled them. If the reported account is deleted, reports about it are deleted too. If you delete your own account, your report stays, but without who made it.
• Email in an invite: removed when the invite is used or declined. Otherwise it is removed the night after the invite expires, at most 15 days after it was made.
• When a puppy goes back to its breeder: your diary, photos, weights and health notes about the puppy from the time you had it are deleted once the return is done, and you leave the litter chat. Your posts in the feed stay.
• Backups: backups are deleted within 30 days.
• Error reports: deleted by Sentry after 30 days.

Your rights

Under the GDPR you have the right to:

• Access (art. 15): request a copy of your data.
• Rectification (art. 16): correct inaccurate data via Profile → Edit profile.
• Erasure (art. 17): delete the account self-serve via Profile → Account settings → Delete account.
• Portability (art. 20): download a structured JSON export via Profile → Account settings → Export my data.
• Restriction or objection (art. 18 and 21) for certain processing — email us and we'll handle the request manually.
• Withdraw consent for public litter pages or notifications at any time, without affecting prior lawful processing.

Public litter pages

Breeders can opt a litter public at kullio.se/k/<slug>. Only data the breeder explicitly curates is shown — owner names, emails, and messages are never published. The breeder can make the litter private again at any time.

Security

All traffic is TLS-encrypted, sessions are revoked immediately on suspension, and every row in the database is protected by row-level security so that you only see data you are entitled to.

Minors

Public litter pages and push notifications are based on consent. For children under 13, that consent is given by a guardian (chapter 2, section 4 of the Swedish Data Protection Act).

Cookies and local storage

We use only strictly necessary cookies and local storage (login session, language preference, light or dark theme, and whether the device has signed in before, so the login page opens on the right tab). No tracking or advertising cookies are used.

Complaints

If you believe we've mishandled your data you can file a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or with the supervisory authority in your EU member state.

Changes

We may update this policy as the service evolves. For material changes we'll notify you in the app or by email before the change takes effect.

Contact

Data and privacy questions: hej@kullio.se.