Privacy Policy

I. Collection of Your Personal Information

In order to better provide you with products and services offered, the Company may collect personally identifiable information, such as your:

• First name (optional)
• Email address
• as well as: Pet identity, Microchip, Insurance, Vet contacts, Medications, Vaccinations, Vet Visits, Symptoms, Documents, AI inputs/outputs, and Reminder CC emails

If you purchase the Company's products and services, payment and credit card information is collected directly by our payment processor, Stripe, on Willow's behalf. Willow does not receive or store your card number, CVC, or other sensitive payment details. We retain only the Stripe-issued customer and subscription identifiers necessary to manage your subscription.

We do not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain personal information when you elect to use certain features or services. These may include: (a) registering for an account; (b) sending us an email message; (c) submitting payment information when purchasing a subscription. We will use your information to communicate with you in relation to services you have requested from us.

I-B. Automatically Collected Information

When you use Willow while signed in, we automatically record certain in-app actions server-side to operate and improve the service. This includes events such as adding a pet, logging a vet visit, uploading a document, or using the AI assistant. These events are recorded on our servers and associated with your account session. We retain product analytics event data for up to 90 days, after which it is automatically and permanently deleted.

Willow uses essential session and security cookies to keep you signed in and protect account flows (for example, authentication, CSRF protection, and invite/passcode gates). We do not use advertising cookies or cross-site tracking cookies.

We do not use third-party advertising networks, sell this data, or use it for cross-context behavioral advertising. This data is used only to operate, maintain, and improve Willow.

I-C. AI Document Scanning

Willow's Premium plan includes AI-assisted document scanning: when you upload a document, its text is processed by our AI subprocessor (Anthropic) to auto-extract and classify record data so you don't have to enter it by hand. This is part of the Premium service you sign up for.

It is on by default for Premium subscribers, and you can turn it off at any time under Settings → AI document scanning. With it off, uploaded documents are stored but are never sent for AI processing. AI prompts and responses are retained for up to 90 days; Anthropic does not use them to train its models. For details on how scanning works, see our AI & scanning notice.

II. Use of Your Personal Information

The Company collects and uses your personal information in the following ways:

• To operate and deliver the services you have requested.
• To provide you with information, products, or services that you request from us.
• To provide you with notices about your account.
• To carry out the Company's obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• To notify you about changes to our Willow application or any products or services we offer or provide through it.
• To maintain the security of the Company's services and prevent fraud or misuse.
• To comply with applicable laws, regulations, legal processes, or governmental requests.
• The primary purpose of collecting and processing user information is to provide, maintain, and improve our Software as a Service (SaaS) platform. We use this data to facilitate secure account creation and authentication, process subscription payments via our third-party processor, and communicate essential service updates or administrative notices. Additionally, we collect information to maintain internal records, perform administrative functions, and ensure the security and integrity of our digital environment.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

The Company may also use your personally identifiable information to inform you of other products or services available from the Company and its affiliates.

III. Sharing Information with Third Parties

The Company does not sell, rent, or lease its customer lists to third parties.

The Company may share data with trusted partners to help perform statistical analysis, send you email, or provide customer support. All such third parties are prohibited from using your personal information except to provide these services to the Company, and they are required to maintain the confidentiality of your information.

The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

IV. Sale and Sharing of Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

We may disclose personal information to service providers who process data on our behalf to operate Willow (for example, hosting, email delivery, payment processing, and AI document processing). Those providers are contractually required to use personal information only to provide services to us and to protect it. That type of disclosure is not a “sale” or “sharing” for advertising purposes under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

If our practices change, we will update this Policy and provide a clear opt-out mechanism before any sale or sharing for advertising begins. California residents may submit privacy requests as described in Section XII — California Privacy Rights below.

V. Security of Your Personal Information

The Company secures your personal information from unauthorized access, use, or disclosure. The Company uses the following methods for this purpose:

• SSL/TLS Encryption (for data in transit)
• Stripe (for PCI-compliant payment handling)
• Render (for secure hosting and infrastructure)
• Anthropic (AI document scanning and AI assistant — when text extraction fails, the full file is transmitted to Anthropic's API over TLS. Anthropic does not use API inputs to train its models; inputs may be retained by Anthropic for up to 30 days for trust & safety review only. See Anthropic's privacy policy. Willow retains the text of AI assistant prompts and responses on our servers for up to 90 days, after which they are automatically and permanently deleted.)
• AWS S3 (for encrypted cloud storage of files and images)
• Postmark (secure email delivery with TLS and data retention controls)
• Sentry (error monitoring and performance diagnostics configured to avoid default PII capture; user context is internal account ID only)

These providers act as Willow's subprocessors: they process personal data only to provide services to Willow, under contract, and are required to protect it and use it for no other purpose. The list above reflects our current subprocessors and is updated whenever a provider is added or removed.

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100 percent secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through this site cannot be guaranteed.

VI. Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will delete your personal information from our records and direct applicable service providers to delete it from their records, where required and technically feasible. We will acknowledge deletion requests within ten (10) business days and complete them within forty-five (45) days. If more time is needed we may extend once by an additional forty-five (45) days and will notify you.

How to delete your data:

• Delete your login: In the app, go to Settings → Your account → Delete account. Your account is queued for permanent deletion and will be purged within 30 days. During that window you may sign back in to cancel the deletion. Any active subscription is set to cancel at the end of the current billing period at the time of deletion. If your household has other members, pet and household records remain for those members.
• Delete an entire household: Email privacy@willow.community with the subject line “California Privacy Request — Delete household.” We will verify your identity and process full household deletion, including pets, documents, and related records, subject to the exceptions below.
• Leave the launch waitlist: If you joined our waitlist, we store only your email address, and only to notify you when Willow opens to new users. We retain it for up to 12 months from signup, or until you ask us to remove it or your signup converts to a user account, whichever comes first. To be removed at any time, email privacy@willow.community.

California residents may also exercise deletion and other rights as described in Section XII — California Privacy Rights.

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, and provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent.
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
• Comply with an existing legal obligation.
• Otherwise, use your personal information internally in a lawful manner that is compatible with the context in which you provided the information.

VII. Data Security and Breach Notification

The Company maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, acquisition, disclosure, or use. In the event of a security incident involving personal information, the Company will promptly investigate the incident and provide notice to affected individuals and, where required, to applicable regulatory authorities in accordance with applicable law.

The Company will provide any required notice in the manner and within the timeframes prescribed by applicable law.

VIII. Children Under 13

The Company does not knowingly collect personally identifiable information from children under the age of thirteen. If you are under the age of 13, you must ask your parent or guardian for permission to use this platform.

IX. Email Communications

From time to time, the Company may contact you via email for announcements, alerts, confirmations, and other service-related communications.

Marketing or promotional communications, when sent, include opt-out instructions. You may also opt out of marketing messages by contacting us at hello@willow.community. Transactional and account-service emails (such as security, billing, or product-access notices) are non-promotional and may still be sent as needed to operate your account.

X. External Data Storage Sites

We may store your data on servers provided by third-party hosting vendors with whom we have contracted.

XI. Changes to This Statement

The Company reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you. You may receive a notice by sending an email to the primary email address specified in your account, by placing a prominent notice on our application, and/or by updating any privacy information. Your continued use of the application and/or services available after such modifications will constitute your: (a) acknowledgment of the modification of this Policy; and (b) agreement to abide and be bound by this modified Policy.

XII. California Privacy Rights

This section applies to California residents and supplements the rest of this Policy under the CCPA and CPRA.

Your rights

Subject to applicable law and verification, you may have the right to:

• Know what personal information we collect, use, disclose, and sell or share (we do not sell or share for cross-context behavioral advertising).
• Access the personal information we hold about you.
• Delete personal information we hold about you, subject to exceptions described in Section VI.
• Correct inaccurate personal information.
• Portability — receive a copy of certain personal information in a portable, readily usable format.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising (we do not engage in those practices today).
• Limit use and disclosure of sensitive personal information to what is necessary to provide the Willow service.

We will not discriminate against you for exercising these rights.

Sensitive personal information

Willow may collect sensitive personal information, including pet health and care data (for example, medications, symptoms, vaccinations, and veterinary records). We use that information only to provide, maintain, and improve Willow and for purposes compatible with your relationship with us. We do not use sensitive personal information for unrelated profiling or advertising.

How to submit a request

Email privacy@willow.community with the subject line “California Privacy Request” and tell us which right you wish to exercise. Include the email address associated with your Willow account and enough detail for us to locate your account.

Authorized agents may submit requests on your behalf with proof of authorization and verification of your identity.

Verification and response times

We may need to verify your identity before fulfilling a request (for example, by asking you to respond from your registered email address or provide additional information for sensitive requests). We will acknowledge your request within ten (10) business days and respond within forty-five (45) days. If we need more time, we may extend once by an additional forty-five (45) days and will notify you.

What to expect by request type

• Access / know / portability: We will provide the categories and specific pieces of personal information we hold. Data portability requests are fulfilled manually — we will compile your account and household data (profile, pets, health records, reminders, and document metadata) and deliver it by secure email within the response window above. There is no self-serve download at this time.
• Correction: We will correct inaccurate information in our systems or guide you to update it in the app.
• Deletion: See Section VI for account deletion versus full household deletion.
• Opt-out of sale or sharing: No action is required today because we do not sell personal information or share it for cross-context behavioral advertising. We will confirm that in our reply.

XIII. European Union & United Kingdom Privacy Rights (GDPR / UK GDPR)

This section applies to individuals in the European Economic Area and the United Kingdom and supplements the rest of this Policy under the EU GDPR and UK GDPR.

Controller

The data controller is Willow Kept, LLC (Atlanta, Georgia, USA), contactable at privacy@willow.community.

Legal bases

We process personal data under the lawful bases described in this Policy — primarily performance of a contract (providing Willow, including AI document scanning for Premium subscribers), with consent for non-essential analytics cookies and waitlist marketing, legitimate interests for security, fraud prevention, and error monitoring, and legal obligation for financial records and lawful requests.

AI document scanning

Willow's Premium plan includes AI-assisted document scanning: when you upload a document, its text is processed by our AI subprocessor (Anthropic) to auto-extract and classify record data so you don't have to enter it by hand. This is part of the Premium service you sign up for. It is on by default for Premium subscribers, and you can turn it off at any time under Settings → AI document scanning — with it off, uploaded documents are stored but not sent for AI processing. AI prompts and responses are retained for up to 90 days; Anthropic does not use them to train its models. See also Section I-C — AI Document Scanning above.

Your rights

Subject to applicable conditions, you may:

• Access the personal data we hold about you.
• Rectify inaccurate personal data.
• Erase personal data, subject to the exceptions in Section VI.
• Restrict or object to certain processing.
• Request portability of personal data you provided to us.
• Withdraw consent at any time where we rely on consent (for example, non-essential analytics cookies), without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EEA, your local Data Protection Authority.

We will not discriminate against you for exercising these rights.

International transfers

Willow and its subprocessors listed in Section V are located in the United States, so EEA/UK personal data is transferred to the US. Where required, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum / IDTA, as incorporated into our data-processing agreements with each subprocessor.

Retention

We keep personal data only as long as needed for the purposes above. Key periods: user account and pet health records for the life of the account plus a 30-day post-deletion grace; AI prompts and product analytics for 90 days; billing and financial records for 7 years; waitlist entries for up to 12 months from signup or until converted or unsubscribed.

Automated decision-making

We do not make solely automated decisions that produce legal or similarly significant effects on you.

How to exercise your rights

Email privacy@willow.community with the subject line "EU/UK Privacy Request" and tell us which right you wish to exercise. Include the email address associated with your Willow account and enough detail for us to locate your account. We respond within one month, extendable by up to two further months for complex or numerous requests — we will tell you within the first month if we need an extension.

For non-essential analytics cookies, you may also accept or reject via the cookie consent banner shown to EEA/UK visitors.

XIV. Contact Information

The Company welcomes your questions or comments regarding this Statement of Privacy. If you believe that the Company has not adhered to this Statement, please contact the Company at:

Willow Kept, LLC
650 Ponce De Leon Ave Ste. 300 #2063
Atlanta, Georgia 30308

General inquiries: hello@willow.community
California privacy requests: privacy@willow.community (see Section XII — California Privacy Rights)
EU/UK privacy requests: privacy@willow.community (see Section XIII — EU & UK Privacy Rights)
Phone: (404) 939-5518