Privacy Policy

I. Collection of Your Personal Information

In order to better provide you with products and services offered, the Company may collect personally identifiable information, such as your:

• First and last name
• Email address
• as well as: Pet identity, Microchip, Insurance, Vet contacts, Medications, Vaccinations, Vet Visits, Symptoms, Documents, AI inputs/outputs, and Reminder CC emails

If you purchase the Company's products and services, payment and credit card information is collected directly by our payment processor, Stripe, on Willow's behalf. Willow does not receive or store your card number, CVC, or other sensitive payment details. We retain only the Stripe-issued customer and subscription identifiers necessary to manage your subscription.

We do not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain personal information when you elect to use certain features or services. These may include: (a) registering for an account; (b) sending us an email message; (c) submitting payment information when purchasing a subscription. We will use your information to communicate with you in relation to services you have requested from us.

I-B. Automatically Collected Information

When you visit or use Willow, we automatically collect certain technical information to operate and improve the service. This includes:

• Visit and session tokens — a randomly generated visit identifier and a persistent visitor identifier, stored in browser cookies (ahoy_visit and ahoy_visitor), used to count sessions and understand how the app is used. No cross-site tracking occurs; these identifiers are used solely for internal analytics.
• Browser and device information — browser type, operating system, and screen characteristics, collected server-side to help us support the range of devices our users are on.
• Referrer and page information — the page you visited and, where provided by your browser, the referring URL. We do not use third-party advertising trackers.
• Timestamps — the date and time of each visit, used for aggregate usage analysis.

We do not use third-party advertising networks, sell this data, or use it for cross-context behavioral advertising. This data is used only to operate, maintain, and improve Willow. Willow is currently intended for use by residents of the United States. If you are located in the United Kingdom or European Union, please be aware that our cookie consent framework for those jurisdictions is in development.

II. Use of Your Personal Information

The Company collects and uses your personal information in the following ways:

• To operate and deliver the services you have requested.
• To provide you with information, products, or services that you request from us.
• To provide you with notices about your account.
• To carry out the Company's obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• To notify you about changes to our Willow application or any products or services we offer or provide through it.
• To maintain the security of the Company's services and prevent fraud or misuse.
• To comply with applicable laws, regulations, legal processes, or governmental requests.
• The primary purpose of collecting and processing user information is to provide, maintain, and improve our Software as a Service (SaaS) platform. We use this data to facilitate secure account creation and authentication, process subscription payments via our third-party processor, and communicate essential service updates or administrative notices. Additionally, we collect information to maintain internal records, perform administrative functions, and ensure the security and integrity of our digital environment.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

The Company may also use your personally identifiable information to inform you of other products or services available from the Company and its affiliates.

III. Sharing Information with Third Parties

The Company does not sell, rent, or lease its customer lists to third parties.

The Company may share data with trusted partners to help perform statistical analysis, send you email, or provide customer support. All such third parties are prohibited from using your personal information except to provide these services to the Company, and they are required to maintain the confidentiality of your information.

The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

IV. Sale and Sharing of Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

We may disclose personal information to service providers who process data on our behalf to operate Willow (for example, hosting, email delivery, payment processing, and AI document processing). Those providers are contractually required to use personal information only to provide services to us and to protect it. That type of disclosure is not a “sale” or “sharing” for advertising purposes under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

If our practices change, we will update this Policy and provide a clear opt-out mechanism before any sale or sharing for advertising begins. California residents may submit privacy requests as described in Section XIII — California Privacy Rights below.

V. Security of Your Personal Information

The Company secures your personal information from unauthorized access, use, or disclosure. The Company uses the following methods for this purpose:

• SSL/TLS Encryption (for data in transit)
• Stripe (for PCI-compliant payment handling)
• Render (for secure hosting and infrastructure)
• Anthropic (AI document scanning and AI assistant — when text extraction fails, the full file is transmitted to Anthropic's API over TLS. Anthropic does not use API inputs to train its models; inputs may be retained by Anthropic for a limited period for trust & safety review only. See Anthropic's privacy policy. Willow retains the text of AI assistant prompts and responses on our servers for up to 90 days, after which they are automatically and permanently deleted.)
• AWS S3 (for encrypted cloud storage of files and images)
• Postmark (secure email delivery with TLS and data retention controls)

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100 percent secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through this site cannot be guaranteed.

VI. Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will delete your personal information from our records and direct applicable service providers to delete it from their records, where required and technically feasible. We will acknowledge deletion requests within ten (10) business days and complete them within forty-five (45) days. If more time is needed we may extend once by an additional forty-five (45) days and will notify you.

How to delete your data:

• Delete your login: In the app, go to Settings → Your account → Delete account. Your account is queued for permanent deletion and will be purged within 30 days. During that window you may sign back in to cancel the deletion. Any active subscription is set to cancel at the end of the current billing period at the time of deletion. If your household has other members, pet and household records remain for those members.
• Delete an entire household: Email privacy@willow.community with the subject line “California Privacy Request — Delete household.” We will verify your identity and process full household deletion, including pets, documents, and related records, subject to the exceptions below.

California residents may also exercise deletion and other rights as described in Section XIII — California Privacy Rights.

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, and provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent.
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
• Comply with an existing legal obligation.
• Otherwise, use your personal information internally in a lawful manner that is compatible with the context in which you provided the information.

VII. Data Security and Breach Notification

The Company maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, acquisition, disclosure, or use. In the event of a security incident involving personal information, the Company will promptly investigate the incident and provide notice to affected individuals and, where required, to applicable regulatory authorities in accordance with applicable law.

The Company will provide any required notice in the manner and within the timeframes prescribed by applicable law.

VIII. Children Under 13

The Company does not knowingly collect personally identifiable information from children under the age of thirteen. If you are under the age of 13, you must ask your parent or guardian for permission to use this platform.

IX. Email Communications

From time to time, the Company may contact you via email for the purpose of providing announcements, alerts, confirmations, and other service-related communication.

If you would like to stop receiving marketing or promotional communications via email from the Company, you may opt out of such communications by clicking the 'unsubscribe' link found at the bottom of our communications or by contacting us directly at our support email address.

X. External Data Storage Sites

We may store your data on servers provided by third-party hosting vendors with whom we have contracted.

XI. Changes to This Statement

The Company reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you. You may receive a notice by sending an email to the primary email address specified in your account, by placing a prominent notice on our application, and/or by updating any privacy information. Your continued use of the application and/or services available after such modifications will constitute your: (a) acknowledgment of the modification of this Policy; and (b) agreement to abide and be bound by this modified Policy.

XII. California Privacy Rights

This section applies to California residents and supplements the rest of this Policy under the CCPA and CPRA.

Your rights

Subject to applicable law and verification, you may have the right to:

• Know what personal information we collect, use, disclose, and sell or share (we do not sell or share for cross-context behavioral advertising).
• Access the personal information we hold about you.
• Delete personal information we hold about you, subject to exceptions described in Section VI.
• Correct inaccurate personal information.
• Portability — receive a copy of certain personal information in a portable, readily usable format.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising (we do not engage in those practices today).
• Limit use and disclosure of sensitive personal information to what is necessary to provide the Willow service.

We will not discriminate against you for exercising these rights.

Sensitive personal information

Willow may collect sensitive personal information, including pet health and care data (for example, medications, symptoms, vaccinations, and veterinary records). We use that information only to provide, maintain, and improve Willow and for purposes compatible with your relationship with us. We do not use sensitive personal information for unrelated profiling or advertising.

How to submit a request

Email privacy@willow.community with the subject line “California Privacy Request” and tell us which right you wish to exercise. Include the email address associated with your Willow account and enough detail for us to locate your account.

Authorized agents may submit requests on your behalf with proof of authorization and verification of your identity.

Verification and response times

We may need to verify your identity before fulfilling a request (for example, by asking you to respond from your registered email address or provide additional information for sensitive requests). We will acknowledge your request within ten (10) business days and respond within forty-five (45) days. If we need more time, we may extend once by an additional forty-five (45) days and will notify you.

What to expect by request type

• Access / know / portability: We will provide the categories and specific pieces of personal information we hold. Data portability requests are fulfilled manually — we will compile your account and household data (profile, pets, health records, reminders, and document metadata) and deliver it by secure email within the response window above. There is no self-serve download at this time.
• Correction: We will correct inaccurate information in our systems or guide you to update it in the app.
• Deletion: See Section VI for account deletion versus full household deletion.
• Opt-out of sale or sharing: No action is required today because we do not sell personal information or share it for cross-context behavioral advertising. We will confirm that in our reply.

XIII. Contact Information

The Company welcomes your questions or comments regarding this Statement of Privacy. If you believe that the Company has not adhered to this Statement, please contact the Company at:

Willow Kept, LLC
650 Ponce De Leon Ave Ste. 300 #2063
Atlanta, Georgia 30308

General inquiries: hello@willow.community
California privacy requests: privacy@willow.community (see Section XIII)
Phone: (404) 939-5518