Miloop privacy policy

Last updated: 12 October 2026

Data controller

Juan Zurita Ruiz-Ruano, an individual trading as ZuritaTech (tax ID 26828689V), at Calle Alta Cartuja, 20, Granada (España). Contact: admin@zuritatech.com. Miloop never sells your data.

This policy covers the Miloop app and this website as far as Miloop is concerned. The GDPR and Spain's LOPDGDD apply and, depending on where you live, the UK GDPR, Brazil's LGPD and US state privacy laws; we extend the rights described below to everyone.

What data we process and why

• Your pets' data (profile, photos, routines, health, appointments, expenses, contacts, documents): always on your phone; copied to our server only if you create an account. Purpose: providing the service, backup and syncing between phones and with your family.
• Account (email, identifier, sessions and devices): only if you create an account (email code, password or Google). Purpose: identifying you and keeping your session safe.
• Miloop+ subscription (product, status, dates, purchase token): only if you subscribe. Google processes payment details; Miloop never sees them.
• Approximate location (rounded to about 110 m) and any area text you type: only when you use “Nearby”, to find vets and places. We don't store it.
• Walks (precise location, route, distance, time and photos): only while a walk you started is running (Android), with a visible notification; never automatically. They stay on your phone only: they don't reach our server, sync or enter backups. If you share a card, the route is included only if you turn it on.
• GPS tracking (positions, battery and status of the tracker you link, safe zones and lost mode): only if you link a tracker. The device sends its position to our server (SIM GPS trackers go through our Traccar gateway, on our own server). Purpose: showing where your pet is and alerting you if it leaves a safe zone. Only your account and people you share the pet with can see it.
• Bluetooth tag tracking: your phone's location when it detects your tag, while the app is open. Only if you turn it on in the tag's detail, first accept the notice explaining this use and grant “All the time” location, also while the app is closed (at most every 2 minutes and only when your phone detects one of your tags). Stored on your phone only, for 7 days.
• Pet food price searches: sent without linking them to your account, to show you offers.
• Notification token and preferences: if you turn on alerts.
• Support messages: if you write to us from the app.
• Usage statistics and error reports (Firebase): only with your consent; no names, health data or pet content.
• Advertising identifiers (Google AdMob): only on the free plan and according to your consent; never on health, medication or emergency screens, and never with Miloop+.
• Website waitlist (your email, the app, the language and the dates you signed up, confirmed and were notified): only if you sign up on this website. Purpose: sending you a single email when Miloop is out on Google Play, after you confirm your address from the email we send you.

Legal basis

Performance of the service you request (GDPR art. 6(1)(b)), for the account, syncing and purchases. Your consent (art. 6(1)(a)) for statistics, error reports and ads, which you can withdraw at any time in the app's privacy settings; withdrawing it doesn't affect earlier processing. Legitimate interest (art. 6(1)(f)) for security and abuse prevention. For the waitlist, your consent (art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link in any of our emails or by writing to us.

Ads and consent

Miloop shows Google AdMob ads on the free plan, with a PG content rating. In the countries where it applies, Google's consent form (UMP / IAB TCF) is shown before requesting ads and they are only requested according to your choice. In Settings, “Privacy and consent” lets you withdraw or change your consent where applicable.

Recipients and processors

We only share data with providers that supply us with a service, under contract, and don't use it for any other purpose:

• IONOS SE: hosting of our server and files, on a VPS in Frankfurt (Germany), within the European Union.
• Cloudflare, Inc.: delivery network and attack protection. Connections to our website and API pass through its servers, which see your IP address and technical connection data; it doesn't keep your account content.
• Google Play (Play Billing): purchases and subscriptions. Google processes payment details.
• Google AdMob and Google's consent form (UMP / IAB TCF): ads on the free plan, only according to your choice.
• Google Firebase (Analytics and Crashlytics): statistics and errors, only with your consent.
• Google Maps and Places: map and nearby places. When you view a walk's map, Google downloads the map tiles for that area and sees your IP address, but doesn't receive the route. Also Google sign-in.
• OpenStreetMap (Nominatim and Overpass): searching areas and nearby places with your approximate location.
• IONOS SE (SMTP email, the same provider as the hosting): sending sign-in codes by email.
• Backblaze, Inc. (B2 storage, US East region, USA): encrypted server backups. We have signed its data processing agreement (DPA) with standard contractual clauses.
• Amazon Web Services EMEA SARL (Amazon SES, Stockholm region, within the European Union): sending the waitlist emails.

International transfers

Some providers (Google, and Cloudflare where involved) may process data outside the European Economic Area, for example in the US. In that case GDPR safeguards apply: the EU-US Data Privacy Framework or standard contractual clauses. Outside the EU, protection may differ from that of your country. Encrypted backups are stored with Backblaze (US East region, USA), which is a transfer to the US. We have signed its data processing agreement (DPA) with standard contractual clauses.

How long we keep data

• Account and synced data: as long as you keep the account. When you delete it, it is erased within 30 days at most (see “Delete account”), except what the law requires us to keep, such as purchase records. Encrypted backups (daily, weekly and monthly) are kept for up to 12 months, so a deleted item can persist in them for up to that period; they are only restored in case of disaster.
• GPS tracker positions: 30 days; zone alerts: 90 days; lost mode ends by itself after 72 h.
• Walks and Bluetooth tag detections: on your phone only (walks until you delete them; tag detections, 7 days).
• Waitlist: if you don't confirm your email, it is deleted after 7 days; if you do, up to 30 days after we tell you about the launch, or as soon as you unsubscribe.

Your rights and how to use them

You can access, rectify and erase your data, object to or restrict its processing, ask for portability and withdraw your consent at any time. From the app: Pet › Account & sync › Delete my account. More detail on the Delete account page.

For any other request email admin@zuritatech.com; we reply within one month at most. We won't discriminate against you for exercising your rights. If you're not satisfied, you can complain to the Spanish Data Protection Agency, AEPD (aepd.es) or to the authority in your country.

Grievance contact / Contacto para reclamaciones

If you live in India (Digital Personal Data Protection Act, 2023, DPDP) or want to file a complaint about how we handle your data, email admin@zuritatech.com. We will handle it and reply within 30 days at most.

Brazil (LGPD)

If you live in Brazil, the channel to exercise your rights as a data subject (LGPD) is admin@zuritatech.com. We have not appointed a data protection officer (encarregado/DPO); admin@zuritatech.com is the contact channel both for data subjects and for the National Data Protection Authority (ANPD), to which you can also complain (gov.br/anpd).

Minimum age and children

Miloop's minimum age is 14, as declared in these terms and in the Google Play listing. If the law of your country requires a higher age (for example, 15 in France or 16 in Germany), that is the minimum age that applies to you. The app has no general age screen.

Only in Brazil, India, Indonesia, South Africa and Nigeria, where the law requires age assurance or an age of majority of 18, the app asks you to confirm “I am 18 or older”. No age or date of birth is stored, only a yes; if you don't confirm it, you can't use the app. To know whether it must ask for that confirmation, the app uses your SIM, network, language and Google Play country on your own phone, without sending or storing them for that purpose.

Miloop isn't directed at anyone below the minimum age. If you think a minor has given us data, write to us and we'll delete it.

Automated decisions

We make no decisions based solely on automated processing that produce legal effects on you or similarly affect you.

Security

Encrypted connections (HTTPS), short, revocable sessions, credentials in the phone's secure storage and logs without personal or health data. No system is infallible: if a breach affects you, we'll tell you as the law requires.

Changes to this policy

If we make a material change, we'll tell you in the app before it applies. The date above shows the latest revision.