Privacy policy

Who we are

Giddy Pets Ltd (“we”, “us”, “our”) operates this website and is the data controller for the personal data described here. We're a company registered in England and Wales, company number 17501962, registered office 11 Bridge Street, Bury, Lancashire BL0 9AB, trading from 3 South Street, Ramsbottom, Bury BL0 0AJ, United Kingdom. You can reach us about anything in this policy at hello@giddypets.co.uk.

What we collect

• • Order details — your name, email, delivery address and what you bought, so we can fulfil and support your order.
• • Payment information — handled directly by our payment processor. We never see or store your full card details.
• • Account information — if you choose to create an account, your email and saved details.
• • Email sign-ups — the email address you give us for pet-care tips and offers, until you unsubscribe.
• • Usage and device data — pages viewed, what you clicked, where you arrived from, plus your IP address, browser and device type. Collected by our analytics and advertising tools, named below.
• • Advertising identifiers — if you accept cookies, Google and Meta set identifiers that let us measure which ads and guides lead to orders, and let Meta show you our ads elsewhere. If you accepted and then complete an order, we also send Meta and Google a server-side record of that purchase, in which your email, name and phone number are hashed (irreversibly scrambled) before they leave us, so the sale can be matched to the click that caused it without handing over your contact details in readable form.

The Giddy Pets mobile app

The app uses your account, purchases and saved pet details to provide your profile, order history, repeat deliveries and recommendations. Pet details can include names, breeds, birthdays, weights, photos, care records and documents you choose to upload. These are stored through our hosted services, including Supabase. Authentication details are kept in your device's secure storage.

Location is optional and used when you request nearby services; you can search by postcode instead. Photos are selected by you. Notifications use Apple, Google and Expo delivery services and a device notification token, with your permission. You can change notification and location permissions in your device settings.

App usage and diagnostic events, including screen visits, shopping actions and error details, are sent to Giddy Pets with an app installation identifier. The native app does not include third-party advertising SDKs. Web pages opened from the app have the website cookie choices described below.

Ask Giddy uses OpenAI. Before a chat begins, the app asks permission to send your messages and recent conversation to OpenAI through Giddy Pets. Sharing saved pet details is a separate choice. Stop sharing and clear the current chat from the chat screen. This does not undo processing of earlier messages. Avoid including sensitive personal information. Reports of AI answers or reviews send only the selected content and reason to our team; signed-in reports are linked to your account. Guest reporting uses a temporary identifier derived from network information to limit abuse.

You can request account deletion from Profile in the app or at Delete your account. Recurring pet-supply subscriptions are cancelled first. We retain transaction records where required and handle already-paid orders and outstanding refunds separately.

Why we use it (our lawful bases)

• • To process and deliver your orders and provide support — this is necessary to perform our contract with you.
• • To send marketing emails — only with your consent, which you can withdraw at any time.
• • To run and improve the website, prevent fraud and keep our records — our legitimate interests, balanced against your rights.
• • To measure our analytics and advertising — only with your consent, given through the cookie banner and withdrawable at any time. Nothing in this category runs until you say yes.
• • To meet legal obligations, such as keeping tax and transaction records.

Who we share it with

We don't sell your data. These are the companies that process it on our behalf, what each one gets, and why:

• • Stripe (payments) — your name, email, billing details and order value, to take payment and handle refunds and fraud checks. Your full card number goes straight to Stripe and never reaches us. Lawful basis: performance of our contract with you.
• • Our suppliers, who ship your order directly — CJ Dropshipping, Simply2Pets and Sherwood Paws. They receive your name, delivery address and the items ordered, and nothing else. Lawful basis: performance of our contract with you.
• • Resend and Google Workspace (email) — your email address and the contents of order updates, replies and, if you've opted in, our newsletter. Lawful basis: contract for order emails; consent for marketing.
• • Supabase (database) — your account, order and enquiry records are stored here. Lawful basis: contract, and our legitimate interest in keeping proper records.
• • Vercel (hosting, plus Vercel Analytics) — every page request passes through Vercel, and Vercel Analytics records anonymous page-level traffic without cookies. Lawful basis: our legitimate interest in running and improving a working website.
• • Cloudflare (security and content delivery) — sits in front of the site and sees the IP address and request details of every visitor, in order to block bots and attacks. Lawful basis: our legitimate interest in keeping the site up and secure.
• • images.weserv.nl (image delivery) — product images are resized and served through this CDN, so it receives your IP address when an image loads. Lawful basis: our legitimate interest in serving a fast, low-bandwidth site.
• • Google (Google Analytics 4) — pages viewed, referrer, approximate location, device, and a cookie-based visitor identifier. Analytics stays switched off until you accept cookies. Lawful basis: your consent.
• • Meta (Facebook/Instagram — the Meta Pixel and our Conversions API gateway at tracking.giddypets.co.uk) — pages and products viewed, baskets, purchases and the identifiers Meta sets, used to measure our advertising and to show you our ads on Meta's platforms. Nothing is loaded and no request is made to Meta until you accept cookies. Lawful basis: your consent.
• • Trustpilot — our delivery-confirmation email is blind-copied to Trustpilot so they can invite you to review your order. They receive your email address and order reference. Lawful basis: our legitimate interest in collecting honest feedback from customers who have actually bought from us; you can opt out with Trustpilot at any time.
• • Google (Google Customer Reviews) — when you place an order we offer you the chance to opt in to a review survey. They receive your email address, order reference, delivery country and estimated delivery date, and email you around the time your order arrives to ask how it went. Lawful basis: your consent — the survey is opt-in and nothing is sent unless you accept it on the confirmation page.

We may also disclose data where the law requires it, or to professional advisers such as our accountant.

Several of these providers are based in, or process data in, the United States. Where that happens we rely on the UK's approved transfer mechanisms — the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum to the EU standard contractual clauses.

How long we keep it

We keep order and transaction records for as long as the law requires (generally six years for tax purposes). Marketing data is kept until you unsubscribe. Account data is kept until you ask us to close your account.

Your rights

Under UK GDPR you can ask to access, correct, delete or port your data, object to or restrict certain processing, and withdraw consent at any time. Email hello@giddypets.co.uk and we'll respond within one month. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

Cookies & similar technologies

“Cookies” here also covers the things stored in your browser that aren't strictly cookies, such as local storage. Four kinds are used on this site:

• • Strictly necessary — your basket, your signed-in session, and the record of your cookie choice itself. These are set by us, can't be switched off, and don't need your consent.
• • Attribution — a small first-party gp_attr cookie recording how you arrived (for example “Google, organic”) so we can attach it to an order and know which of our own pages are worth writing. It stays on our servers and isn't shared.
• • Analytics — Google Analytics 4 (_ga, _ga_*). Set only if you accept. We also count page views in a way that stores nothing at all on your device and can't identify you, which is why our own traffic figures don't depend on your answer.
• • Advertising — Meta Pixel and our Conversions API gateway (_fbp, _fbc), and Google advertising cookies. Set only if you accept. Until then, your browser makes no request to Meta or to our tracking gateway at all.

Changing your mind

Your choice is stored in your browser's local storage under the key nsc_consent_v1 — not in a cookie, and never sent to us. Withdrawing is meant to be exactly as easy as agreeing was:

Open the shop to change cookie preferences

Using the Cookie preferences control on the shop clears your saved choice, tells Google and Meta to stop, deletes their cookies from this browser, and shows you the banner again so you can answer afresh. The same Cookie preferences link sits in the footer of the shop pages. You can also block or delete cookies in your browser settings, though some of the strictly necessary ones are what make the basket work.