Privacy Policy

1. Who we are

Rightdog is a UK-based digital consultancy service that helps people choose the right dog breed and find breeders and rescue organisations to investigate. The service is operated by Rightdog Ltd, a company registered in England and Wales (company number 17449902), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Data controller: Rightdog Ltd
Contact: legal@rightdog.co.uk
Website: rightdog.co.uk

We are registered as a data controller with the Information Commissioner's Office. We do not have a formal Data Protection Officer at present, as one is not required at our current scale. The directors hold data protection responsibilities directly.

2. What data we collect and why

2.1 Account data

When you create an account or sign in, we collect:

• Your email address
• Your name (if provided)
• Authentication metadata (sign-in method, account creation date, session information)
• A profile avatar URL (if provided by your OAuth provider)

Why: To identify you, enable you to sign in, and associate your consultation and any purchases with your account.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR). Account data is necessary to provide the service.

2.2 Consultation content

During a consultation, you will share information about yourself and your household in response to questions from our AI consultant. This may include:

• Your household composition, including the ages and number of children in your home
• Your daily routine, working pattern, and activity levels
• Your living situation (property type, garden, location)
• Financial context (budget for purchasing a dog, ongoing cost expectations)
• Health-related information, including any relevant health conditions, disabilities, neurodivergence, or special educational needs affecting members of your household
• Emotional context (reasons for wanting a dog, previous pet ownership experience)
• Your location or approximate postcode (for breeder search purposes)

Why: To provide a personalised breed recommendation, breeder shortlist, and associated materials. The consultation cannot function without this information.

Legal basis: Performance of a contract (Article 6(1)(b)) for the consultation service itself. For any special category data incidentally disclosed, we rely on your explicit consent given by voluntarily providing the information in the context of a consultancy service you have engaged (Article 9(2)(a)). By using the consultation, you are choosing to share this information with us to receive personalised advice.

2.3 Payment data

If you purchase a Full Consultation or Full Journey, your payment is processed by Stripe. We do not receive or store your card details. We receive from Stripe:

• A payment reference and session identifier
• Confirmation of payment success or failure
• The amount and currency paid
• A Stripe customer identifier

When you buy, we also record that you agreed to your consultation starting straight away, with the date and time and the wording you agreed to. This is our record of your choice about the 14-day cancellation period.

Why: To record that payment has been made, to grant access to the paid features of the service, and to keep evidence of your cancellation choice.

Legal basis: Performance of a contract (Article 6(1)(b)). For the cancellation record, legitimate interests (Article 6(1)(f)): our interest in being able to show what you agreed to if there is a dispute.

2.4 Usage and technical data

We collect limited technical data about how the service is used:

• Which features you have accessed and when
• Whether a shortlist or PDF has been generated
• Error events (technical metadata only, with no consultation content)

We do not collect IP addresses or device fingerprints beyond what is technically necessary for the service to function. We do not use third-party advertising trackers.

Why: To diagnose technical problems and improve the service.

Legal basis: Legitimate interests (Article 6(1)(f)): our interest in maintaining a reliable service.

2.5 Email correspondence

If you contact us by email, we retain that correspondence to handle your query and maintain a record of our service interactions. We do not retain correspondence beyond what is necessary to resolve your query or comply with legal obligations.

Legal basis: Legitimate interests (Article 6(1)(f)): our interest in handling support queries effectively and maintaining records of service interactions.

3. How we use your data

We do not send marketing emails. If we start to, we will update this policy first and every marketing email will include an unsubscribe link.

We do not use your consultation content for training AI models. We do not sell your data to third parties. We do not share your data with breeders or rescue organisations. They receive only the enquiry emails you choose to send yourself.

4. AI processing

Rightdog uses AI to deliver the consultation service. There is no human consultant involved. The questions you are asked, the breed recommendation you receive, and the breeder shortlist are all generated by AI.

To provide the consultation, your messages are sent to Anthropic (the AI provider) for processing. Under Anthropic's commercial terms, your consultation content is not used to train Anthropic's models and is retained by Anthropic only as long as technically necessary to provide and secure the service. Anthropic is a US-based company. The transfer of your data to Anthropic for processing is covered by the UK Addendum to the EU Standard Contractual Clauses.

The breeder shortlist is generated using Anthropic's web search capability, which searches publicly available web pages, mainly breeders' own websites and breed club pages. Your breed, location, and travel radius are used as search terms. They are processed by Anthropic on the same terms as the rest of your consultation.

Drafted enquiry emails are generated using your consultation summary and key priorities. This information is processed by Anthropic in the same way as the rest of your consultation.

5. Where your data is stored

We have deliberately chosen EU-hosted infrastructure for all long-term data storage (account data, consultation content, payments and shortlists). The only US processing is for AI inference and email delivery, which is covered by appropriate transfer mechanisms.

6. How long we keep your data

When you delete your account, we delete your profile, consultation content, messages, recommendation data, and shortlists. We retain payment transaction records as required by law, but these contain only payment references, not consultation content.

7. Cookies

Rightdog uses a small number of strictly necessary cookies to provide the service:

• Authentication session cookie: Keeps you signed in during your session. This cookie is essential to the service and cannot be disabled.
• Anonymous session identifier: Stored in your browser's local storage (not a cookie). Used to preserve your fit-check progress before you create an account. Cleared when you sign in.

We do not use advertising cookies, tracking cookies, or analytics cookies that send data to third parties. If we add analytics in future, this policy will be updated and appropriate consent mechanisms implemented.

8. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate data.
• Right to erasure: You can ask us to delete your data. You can also delete your account directly from your profile page, which will trigger deletion of your consultation data immediately.
• Right to restriction: You can ask us to restrict how we use your data in certain circumstances.
• Right to data portability: You can ask for your data in a machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Rights relating to automated decision-making: Your breed recommendation and related materials are generated by AI. They are advisory. They do not produce a legal or similarly significant effect, and the final decision is always yours. There is no human consultant, and we do not provide a human re-assessment or a human-authored alternative to an AI recommendation. If you believe an output is inaccurate, incomplete, or unsafe, you can report it to us at legal@rightdog.co.uk. We may investigate and correct technical faults or general defects in the service, but you remain responsible for checking breed, health, and breeder information before acting on it.

To exercise any of these rights, email legal@rightdog.co.uk. We will respond within one month. We may ask you to verify your identity before acting on a request.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

9. Children's data

Rightdog is a service for adults. You must be 18 or over to create an account and make a purchase.

During a consultation, you may share information about children in your household (for example, the ages of your children when discussing whether a breed is suitable for families). This information is used solely to provide appropriate consultation advice. It is not used for any other purpose and is subject to the same protections as all consultation content.

If you believe a child under 13 has created an account, please contact us at legal@rightdog.co.uk and we will delete the account promptly.

10. Information about breeders and rescue organisations

This section is for breeders and rescue organisations who may appear on a shortlist.

What we collect: When a customer asks for a shortlist, we search publicly available web pages, mainly breeders' own websites and breed club pages. For each breeder or rescue organisation we include, we record:

• The name or business name
• The town or county
• The website address
• What the website states about health standards and health tests
• The page where we found the information, and the date we found it

We do not collect email addresses, phone numbers or street addresses.

Why: So the customer who asked for the shortlist can decide which breeders or rescues to contact. Each shortlist is shown only to the customer it was made for. We do not reuse it for other customers, publish it, or sell it.

Legal basis: Legitimate interests (Article 6(1)(f)): helping people who want a dog find breeders and rescues to investigate, which supports responsible dog buying. We use only information breeders and rescues have published to reach buyers. We have assessed this against your interests and keep a record of that assessment.

Accuracy: We show what your website states, with the page and date we found it. We do not verify these claims, and we tell customers so and direct them to the Royal Kennel Club Health Test Results Finder to check.

How long we keep it: With the customer's shortlist, until they delete their account or 3 years after their last activity.

Your rights: You can object to being included, or ask us to correct or remove information about you, by emailing legal@rightdog.co.uk. If you object, we will remove you from existing shortlists and exclude you from future ones. You also have the other rights listed in section 8, and the right to complain to the ICO.

11. Security

We take the security of your data seriously. The key protections in place are:

• Encryption at rest: All data in our database is encrypted at rest by our database provider.
• Application-level encryption: Your consultation messages are additionally encrypted at the application layer using AES-256-GCM encryption. The encryption key is separate from the database access credentials. This means that even if the database were compromised, your consultation content would not be readable without the separate encryption key.
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Per-record authorisation: Our database enforces Row Level Security policies that ensure you can only access your own data, not other users' data.
• Access controls: All administrative accounts use multi-factor authentication.

No security system is perfect. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the ICO as required by UK GDPR (within 72 hours of becoming aware).

12. Processors

We use the following third-party services to provide Rightdog. Each processes personal data on our behalf under a data processing agreement:

We review our processors regularly and will update this list if we add or change providers.

13. Changes to this policy

We may update this privacy policy from time to time. If we make material changes, for example adding a new processor, changing how we use your data, or changing our legal basis for processing, we will notify you by email before the change takes effect.

Minor changes (for example, updating contact details or correcting a typo) will be made without notice. The "last updated" date at the top of this page will always reflect the most recent revision.

14. Contact us

For any privacy-related questions, data subject requests, or concerns:

Email: legal@rightdog.co.uk
Website: rightdog.co.uk
Response time: We aim to acknowledge all requests within 72 hours and respond fully within one month.

For complaints about our handling of your data, you may also contact the ICO directly: ico.org.uk/make-a-complaint

Rightdog Privacy Policy v1.3 · October 2026 · rightdog.co.uk

See also our Terms of Service.