Privacy Policy

01Who we are

BioPaw is a pet-waste circular economy service operated by Pawpaws Group ("Pawpaws", "we", "us"), based in Dubai, United Arab Emirates. This policy explains what personal data we collect when you use the BioPaw mobile app and website, why we collect it, and the choices you have.

We act as the data controller for the information described here. This policy is written to align with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its executive regulations.

02What we collect

We aim to collect only what we need to run the service well. Depending on how you use BioPaw, that may include:

You give us directly

• Account details — your name, mobile number (used for OTP sign-in), and password.
• Pet profiles — names, types, and any details you choose to add about your pets.
• Subscription & payment — your chosen plan and billing status. Card payments are processed by our payment partner (MamoPay); we do not store full card numbers on our servers.
• Support messages — anything you send us when you contact support.

Collected as you use the app

• Location — with your permission, your device location to show the nearest BioPaw bins and sort them by distance. You can turn this off in your device settings at any time.
• Activity — drop-off scans, points earned, and impact figures (waste diverted, water saved) generated as you use the loop.
• Device & technical data — app version, device type, and basic diagnostics that keep the service stable.
• Push tokens — if you opt in to notifications, a token that lets us send them.

03Why we use it

We process your data for these purposes and legal bases under the PDPL:

• To provide the service — sign you in, run the bin map, log drop-offs, track rewards (performance of our agreement with you).
• To process subscriptions — manage your plan and payments.
• To improve BioPaw — understand which features help and fix problems (our legitimate interest in a reliable product).
• To send notifications — service and rewards updates, where you have opted in (your consent).
• To report impact — aggregated, de-identified figures shared with community partners. These reports do not identify you individually.
• To meet legal obligations — including UAE waste-management and tax requirements.

04Who we share it with

We do not sell your personal data. We share it only with:

• Service providers who run parts of the platform under contract — hosting and database, SMS/OTP delivery, payment processing, and push-notification delivery. They may only use your data to provide their service to us.
• Community partners (such as your building or community operator) — but only as aggregated, anonymised impact and participation figures, never your individual identity or contact details, unless you have separately agreed.
• Authorities where we are legally required to disclose, or to protect the rights and safety of users.

05Where your data is stored

Our core database and authentication are hosted in the European Union (Frankfurt region). Where personal data is transferred outside the UAE, we rely on the safeguards permitted under the PDPL — including transfers to jurisdictions recognised as providing adequate protection, or appropriate contractual protections with our processors.

06How long we keep it

We keep your personal data only as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution needs. When you close your account, we delete or anonymise your personal data, except where we must retain certain records by law. Aggregated impact data, which no longer identifies you, may be kept indefinitely.

07Your rights

Under the PDPL, you have the right to:

• Access the personal data we hold about you and ask how it is processed.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to legal retention limits.
• Object to or restrict certain processing, and withdraw consent where we rely on it.
• Request a copy of your data in a portable, machine-readable format.
• Lodge a complaint with the UAE Data Office.

08How we protect it

We use industry-standard measures to keep your data safe — encryption in transit, access controls so only authorised people can reach the database, and row-level security rules that keep one user's data separate from another's. No system is perfectly secure, but we work hard to reduce risk and will notify you and the authorities of a qualifying breach as required by law.

09Children

BioPaw is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will remove it.

10Cookies & local storage

Our website and app use a small amount of local storage on your device to keep you signed in and remember your preferences — for example, a cached session so you don't have to log in every time. We use minimal, privacy-respecting analytics to understand how the site is used. We do not use advertising trackers. You can clear local storage through your browser or device settings at any time.

11Changes to this policy

We may update this policy as the service evolves or the law changes. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app. Continuing to use BioPaw after an update means you accept the revised policy.