1. Who we are and scope
vetman is operated by Telvo LLC (identification number 205218334). For personal-data questions, use the contact page.
This policy covers visitors to the public vetman.app website and vetman web application, account holders, people registering, demo visitors and people who contact us.
2. Our role
We are the controller for website visitors, account holders, registrants, demo visitors and people who contact us. The relevant Organization controls its clients' and their animals' records. For those records vetman is a processor acting only on that Organization's instructions. If you are its client, contact the Organization first.
3. Data, purposes and legal bases
Depending on use, we process:
- public-website IP, browser, page, referral and approximate location through Google Analytics to understand and improve the website, based on the consent the visitor gives on the website banner;
- server logs including IP, time, requested address and response code for security and fault diagnosis, based on legitimate interests;
- name, contact details, photograph, role, Organization and password hash to create and operate an account, to perform the contract;
- the personal number of the administrator who registers an Organization, to identify that person, including telling apart people with the same name, to perform the contract and for legitimate interests;
- when Google sign-in is chosen, Google's unique account identifier, email and verification status, and name if supplied, to register, sign in and link the account, to perform the contract and act on the user's request;
- sign-in time, failed attempts, IP, session and audit records to protect accounts and Organization data, for legitimate interests and legal obligations;
- interface preferences to perform the service;
- the subscription payer's details, whether a legal entity, an individual entrepreneur or a natural person: payer type, legal form, legal name or first and last name, trade name, identification code or personal number, legal or registration address, actual address, website, phone, email and bank details, for subscription, invoicing and legal records;
- correspondence and an essential demo session to respond and operate the demo;
- from someone who fills in the public reference's request form: full name, role, clinic or company, email, phone (if given), the content of the message, the page the request is about, IP address and browser description, to answer the request, check and correct the reference and protect the form from abuse, based on legitimate interests and the person's request; and
- from someone who ticks "I want vetman news" on that form: email, name and the time of consent, to send vetman news, based on consent, which can be withdrawn at any time.
To protect the public reference (vetman.app/refs) from automated bulk copying, we log the IP address, time, browser description and requested address of automated-access attempts, and a count of pages opened per IP address. We do this on the basis of our legitimate interest in service security, keep it for no more than 6 months and do not share it with third parties other than Cloudflare, which is on our sub-processor list.
Contact details sent through the reference's form are used only to answer the request. We send news only to people who ticked the separate box for it.
As controller, we do not intentionally request human special-category data or make decisions about people based solely on automated processing.
Google's access token is used only to obtain the authentication response. vetman does not store it or a refresh token. Facebook sign-in is currently disabled and no data is sent to Meta through it.
4. Cookies and analytics
The web application uses an essential session cookie and has no third-party analytics tracker. On both the public website and the application, Cloudflare may set strictly necessary security cookies. The public vetman.app website loads Google Analytics 4 only after the visitor chooses „Accept" on the consent banner. Cookies, durations and browser controls are described in the Cookie Notice.
5. Recipients
Data may be disclosed as necessary to DigitalOcean infrastructure in Frankfurt for hosting; Cloudflare, to route website and app traffic securely, provide HTTPS and protect against attacks (every request your browser sends passes through Cloudflare's network first); Cloudflare R2 in the EU, to keep an off-server backup of the database and files, encrypted on our server before upload so that Cloudflare cannot read it; our mail infrastructure for service and support messages; Google for public-site analytics and optional Google sign-in; and authorities or other parties where required by law or legal claims.
Data is sent to our SMS provider, uBill, only after an Organization actually turns the SMS function on. We do not sell personal data or disclose it for a third party's own advertising.
6. Processing outside Georgia
Because of hosting, Cloudflare and Google services, data may be processed outside Georgia, including in Germany and the USA. The encrypted backup copy is stored in the EU. We use safeguards available under applicable law and the relevant service terms.
7. Retention
We retain data only as needed for the stated purpose, an account or contract, security and legal requirements. Account data and a linked Google identity are kept while active and deleted or disassociated after a verified request, except for legally required data. Google access and refresh tokens are not retained. Failed-sign-in IP records are deleted automatically after one day. A session ends after 8 hours of inactivity and always within 24 hours. Security, audit and correspondence records are retained proportionately; accounting records for the legal period; and protected backups, including the encrypted off-server copy, until their cycle ends, for restoration only.
A request sent through the reference's form is kept until it is closed and deleted 3 years after it was completed or rejected (so that, if someone claims an error in the reference caused harm, we can show when it was reported and when it was corrected). The record of consent to news (email, name, time of consent) is kept until you unsubscribe and for 3 years after that, to prove the consent. The reference's protection records (IP address, time, browser description, requested address) are deleted automatically within 6 months.
8. Your rights
Subject to law, you may request information, a copy, correction, updating, restriction, blocking, deletion or destruction, withdraw consent and lodge a complaint.
Submit the request through the contact page and enter the email address linked to the account. We may request additional verification but never a password. See the deletion instructions. We respond within the period required by law.
The relevant Organization decides requests concerning its client or animal records. You may also contact the State Audit Office of Georgia or another competent authority.
9. Security
Measures include role-based access, tenant separation, HTTPS, protected session cookies, password hashing, sign-in limits, audit logs and encryption of configuration secrets. Files are served only after sign-in and Organization access are checked. No system is completely secure; incidents are handled under applicable law and our response procedure.
10. Changes
New editions have a version number and effective date; prior versions remain archived. We notify account holders through an appropriate channel of material changes.