Privacy policy

1. Controller

The controller is Broken Ladder Labs UG (haftungsbeschränkt), Am Büschel 7, 67273 Bobenheim am Berg, Germany, represented by its managing directors Maria Zarrouq and Corinna Meier. The full details are in the legal notice. For privacy requests you can reach us by email at hello@merla.pet or by post at the address above.

We are not required to appoint a data protection officer; we are a company of two people.

2. What Merla is and what it is not

Merla is a health record for pets that you keep yourself. We do not collect data about you from other sources, show no advertising, use no analytics or advertising services, and do not pass your data on to third parties, except to the technical service providers named below who work for us.

3. Which data we process

• Your account: email address, password (as a hash only, we cannot read it), display name, account type, user tag, language, time zone and region for date and number formats (reported by your device or set by you), time of registration and of the last sign-in.
• Your spaces: name and type of the space, members with their roles, invitations (email address or user tag of the invited person, expiry date).
• Your pets: everything you enter into the record, such as name, species, breed, birthday, chip and TASSO number, insurance, weight, vaccinations, medications and doses, symptoms, diagnoses, allergies, vet visits, preventive care, food, costs, notes, photos and home history. Data about a pet is usually not personal data. It can, however, concern people, for example vet practices, previous owners or foster homes that you enter. You decide what you enter, and you enter about other people only what you are allowed to.
• Vet contacts you create: practice name, address, phone, email, notes.
• Pet pass links: a random link key, the released sections, expiry date, note, care instructions and a view counter (only the number, no addresses of the viewers).
• Transfers: a log of when which record was handed over to which user tag or received from whom. Personal notes and names of private previous homes stay behind on transfer; names of organisations travel along.
• Technical data: When you open the app, our hosting provider briefly processes IP address, time, requested address and browser identifier in server logs so that the service runs and attacks can be detected. To protect pet pass links against guessing, we store a hashed value of the IP address for at most one day when a link is not found.
• Operator notes: For spaces, the operator team may keep internal notes, for example about an activation. They are readable only by us.

4. Purposes and legal bases

• Providing the app with account, records, spaces, sharing and transfer: performance of the user contract (Art. 6(1)(b) GDPR).
• Security, troubleshooting, protection against abuse, server logs: our legitimate interest in a secure and stable service (Art. 6(1)(f) GDPR).
• Invoices and accounting for paid plans: statutory retention obligations (Art. 6(1)(c) GDPR).
• We currently need no consent, because we use no optional services.

5. Cookies and local storage

We set only cookies that are necessary for operation: the session cookies of the sign-in, the language (cookie „sprache“, plus „sprache_vorab“ for one hour if you choose a language before signing in), the time zone („zeitzone“) and the region for date and number formats („region“), each valid for one year. These cookies do not track you and are not shared with third parties. Under section 25(2) of the German TDDDG no consent is required, which is why there is no cookie banner.

In your browser's local storage the app remembers the colour scheme and the order of your quick actions. Record contents are not cached on the device.

6. Recipients and service providers

• Supabase Inc. (San Francisco, USA): database, sign-in and file storage. The data is stored on servers in Frankfurt am Main (AWS, region eu-central-1). A data processing agreement with the EU standard contractual clauses is in place with Supabase.
• Vercel Inc. (San Francisco, USA): hosting and delivery of the app through a worldwide network. Vercel processes the request data (IP address, requested address) and keeps server logs. A data processing agreement with the EU standard contractual clauses is in place here as well.
• Microsoft Ireland Operations Limited (Dublin, Ireland): our mailbox hello@merla.pet (Microsoft 365). If you write to us, your message is stored there. Processing is governed by Microsoft's data protection terms for Microsoft 365 with the EU standard contractual clauses; the parent company Microsoft Corporation is also certified under the EU-U.S. Data Privacy Framework.
• Resend Inc. (San Francisco, USA): sending the emails the app itself sends, i.e. sign-up confirmation, sign-in code and password reset, from hello@merla.pet. For this Resend processes your email address, the content of these emails and delivery logs. Sending runs through servers in Ireland (region eu-west-1). Open and click tracking is switched off. A data processing agreement with the EU standard contractual clauses is in place with Resend.

There are no other recipients. We pass no data to advertising networks, analytics services or data brokers and embed no third-party fonts, scripts or maps; fonts are served from our own server.

Supabase, Vercel and Resend are based in the USA, Microsoft belongs to a US group. The data of your pet records is stored in the EU; for the remaining processing by the providers, the standard contractual clauses of the EU Commission ensure an adequate level of protection.

7. Sharing, transferring, publishing

• Pet pass link: Anyone with the link sees, without an account, exactly the sections you released, until the expiry date or until you revoke the link. The pages are blocked for search engines. Care instructions are deleted on revocation or expiry. Be mindful of whom you give a link to.
• Transfer link: It is valid for 14 days. After acceptance the record belongs to the new owner; you keep only the log entry with their user tag.
• Members of a space see only each other's display name, not the email address.
• Public adoption page: Foster homes and rescues can enable a public page. Everything on it is visible to everyone, including the contact details you enter for it. Health data, chip and TASSO numbers never appear there. As a private person, do not enter a home address there.

8. Retention

Account, spaces and records remain as long as your account exists. You delete your account yourself in the settings; this permanently deletes your profile, memberships and all spaces you own, including pets and photos. Spaces with other members you hand over first or remove the members.

• Invitations are deleted 30 days after acceptance or expiry.
• Adoption enquiries are deleted six months after completion, open enquiries without activity after twelve months.
• Care instructions on pet pass links are deleted on revocation or expiry.
• Hashed IP values from the pet pass link protection are kept for at most one day.
• Server logs at the hosting provider are deleted after a short time. Database backups are overwritten in rotation; deleted data disappears from them after 30 days at the latest.
• Invoice data of paid plans is retained for as long as commercial and tax law require.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing based on our legitimate interest (Art. 15 to 21 GDPR). Much of this you do directly in the app: change data, export everything as a file, download photos per pet, delete your account.

For everything else, write to us at hello@merla.pet or at the address in the legal notice. You can also complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg or the authority of your place of residence.

10. When you write to us

If you write to us at hello@merla.pet, we process your email address, your name if you give it, and the content of your message in order to reply and handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns your account or a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete messages once your request is settled, unless statutory retention periods require otherwise, for example for business letters.

11. Our Instagram presence

Merla has a profile on Instagram (@merla.pet). Our website contains only a plain link to it: your browser connects to Instagram only once you click it. Before that, no data flows to Instagram.

On Instagram itself, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, processes your data under its own terms; details are in Instagram's privacy policy. Where Meta shows us statistics about our profile, we only see aggregated figures, no data about individual people. For these statistics we are joint controllers with Meta (Art. 26 GDPR); under the agreement Meta provides for this, Meta takes primary responsibility, including for fulfilling your rights. You can exercise your rights with Meta or with us.

12. Security

All connections are encrypted. Access rights are enforced in the database itself, not only in the app, and are checked by an automated test suite. Passwords are stored only as hashes and must meet minimum rules. Photos are kept in private storage and delivered only through short-lived signed addresses. Should a data breach occur nonetheless, we inform the competent supervisory authority and, where there is a high risk for you, also you, as Art. 33 and 34 GDPR require.

13. No automated decisions

We make no automated decisions with legal effect and create no profiles. The due-date displays in the app calculate only with the data you enter and serve as an overview for you.

14. Minimum age

Merla is aimed at adults. Persons under 16 may not create an account.

15. Changes

If the app or the legal situation changes, we adapt this policy. The current version with its date is published here; we inform you in the app about material changes.