Privacy Policy

We collect information directly from you, automatically from your use of the Service, and from a small set of trusted sub-processors described in Section 4.

Information you provide

• Manufacturer listing data. Company name, address, contacts, capabilities, dosage forms, MOQ ranges, certifications, brand assets (logo, imagery), and any descriptive copy you submit during claim or update flows.
• RFQ submissions. Buyer name, company, email, phone (optional), project brief, dosage form, species, target MOQ, certifications required, and any file attachments.
• Account and billing. Email, password hash, login timestamps, and the subscription, invoice, and payment-status records delivered by our payment processor.
• Support correspondence. Anything you send us by email or through the dashboard help forms.

Information collected automatically

• Server logs. IP address, user agent, referrer, request URL, and response status, retained for security and abuse prevention.
• Cookies. A session cookie required to keep you signed in, plus an optional analytics cookie if you have consented (see Section 6).

We use the information we collect to:

• Operate, secure, and improve the directory, RFQ workflow, and dashboards.
• Route buyer RFQs to the Manufacturer(s) the buyer selected, and notify the appropriate party.
• Process subscriptions, invoices, and refunds through our merchant of record.
• Send transactional emails such as claim verification, RFQ delivery, renewal reminders, and payment-failure notices.
• Detect and prevent abuse, fraud, and violations of our Terms of Service.
• Comply with legal obligations and respond to lawful requests from public authorities.

We do not sell personal information, and we do not run advertising on the Service.

If you are in the European Economic Area, the United Kingdom, or a jurisdiction with similar data-protection law, we process your information under the following lawful bases:

• Contract. To deliver the Service you have signed up for, including processing your membership subscription and routing your RFQs.
• Legitimate interests. To secure the Service, prevent fraud, and improve product quality, balanced against your rights and freedoms.
• Consent. For optional analytics cookies and for marketing communications, where applicable. You may withdraw consent at any time.
• Legal obligation. Where we must retain records to comply with tax, accounting, or regulatory requirements.

We share personal information with a small, vetted set of sub-processors, each acting only on our documented instructions and bound by appropriate confidentiality and security commitments:

• Cloudflare, Inc. — hosting, edge network, and server logs for petcmo.com and the dashboard.
• Supabase, Inc. — managed PostgreSQL database and authentication for account records, listing data, RFQs, and subscription state.
• Amazon Web Services (AWS Simple Email Service). — transactional email delivery for RFQ notifications, claim links, and subscription lifecycle notices. Sender identity: [email protected].
• Lemon Squeezy, Inc. — merchant of record for subscription billing. Lemon Squeezy processes payment data on our behalf. We never store full card numbers on our infrastructure.

Optional analytics sub-processors are configured only when the corresponding public environment variable is populated:

• Google Analytics 4 (GA4). — Loaded only when NEXT_PUBLIC_GA_MEASUREMENT_ID is set. Used to understand aggregate directory usage.
• PostHog. — Loaded only when NEXT_PUBLIC_POSTHOG_KEY is set. Self-hostable; we use the EU or US region as configured.

Premium Membership is sold through Lemon Squeezy, our merchant of record. When you complete checkout, your card details are collected and processed by Lemon Squeezy and never reach PetCMO servers. We receive only the subscription identifier, plan tier, billing status, and the last four digits of the payment method (for display in invoices). Please refer to Lemon Squeezy’s privacy policy for the payment-data practices they apply.

We use a minimal set of cookies. The Service does not require advertising or third-party tracking cookies to function.

• Strictly necessary. A session cookie that keeps you signed in to the dashboard, plus the security cookie used by our edge platform. These cannot be disabled while you remain signed in.
• Analytics (optional). If Google Analytics 4 or PostHog is enabled, those providers may set their own cookies. You can block them through your browser settings without losing access to the directory.

We retain personal information only as long as necessary for the purposes described:

• Manufacturer listings. Retained while the listing is published; removed within thirty (30) days of a verified removal request.
• RFQ records. Retained for twenty-four (24) months to support dispute resolution, then deleted or anonymised.
• Subscription and invoice records. Retained for seven (7) years to satisfy tax and accounting obligations.
• Server logs. Retained for thirty (30) days, then deleted.

Depending on your jurisdiction, you may have the right to access, correct, port, or delete the personal information we hold about you, and to object to or restrict its processing. To exercise these rights, email [email protected] from the address associated with your account. We will respond within thirty (30) days; if your request is complex we may extend this period once and will notify you of the reason for the extension.

California residents have the right to know what categories of personal information we collect and to request deletion under the CCPA/CPRA. We do not sell or share personal information for cross-context behavioural advertising.

We are based in the United States and use sub-processors in the United States, the European Union, and other jurisdictions. Where personal information is transferred across borders, we rely on Standard Contractual Clauses or equivalent safeguards approved by the relevant supervisory authority.

We use industry-standard technical and organisational measures to protect personal information, including TLS in transit, encryption at rest within our managed database, least-privilege access for staff, and continuous monitoring of the edge platform. No system is perfectly secure; if a breach affecting your information occurs, we will notify you and the relevant authorities in accordance with applicable law.

The Service is a B2B platform intended for professionals. It is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has submitted information to us, contact [email protected] and we will delete the record.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above. For material changes that affect your rights, we will provide reasonable notice through the Service or by email before the change takes effect.

For privacy questions, data-subject requests, or to lodge a complaint, email [email protected]. EEA and UK residents may also contact our lead supervisory authority; we will cooperate with any investigation.

See also our Terms of Service and Refund Policy.