Pista

Privacy Policy

How Pista collects, uses and protects your personal data

Last updated: November 2026 — version policy-2026-11

Pista is a platform that helps reunite lost pets with their owners through proximity alerts and neighbourhood mutual aid. This page describes what data we collect, why, and what your rights are.

Data controller

  • Pista — the lost & found pet alert platform.
  • Privacy contact: privacy@pistapet.com
  • For any question about your data or to exercise a right, write to this address.

Data we collect

  • Account: first name, last-name initial, email address, preferred language.
  • Alerts: pet description and photos, city, disappearance area, status.
  • Messaging and reports: content of exchanges between users and filed reports.
  • Newsletter consent: email address, language, signup source, date and form version; IP address and browser are retained as consent evidence.
  • Technical data: error logs, aggregated usage metrics, session cookies required for the service.
  • We do not collect or store banking data; any payment goes through a dedicated payment provider.

Purposes

  • Provide the service: publish alerts, notify watch zones, connect users.
  • Transactional emails: confirmations, alert notifications, reminders — required for the service.
  • Newsletter and marketing emails: only with your explicit consent, confirmed by double opt-in.
  • Security and fraud prevention: anti-abuse, moderation, scam protection.
  • Aggregated statistics to improve the product.

Legal bases

  • Service performance: account, alerts, messaging, transactional notifications.
  • Consent: newsletter and marketing communications (withdrawable at any time).
  • Legitimate interest: platform security, fraud prevention, aggregated audience measurement.
  • Legal obligation: retaining certain data where the law requires it.

Recipients and processors

  • Google Firebase (authentication, database, storage) — application data hosting.
  • Cloudflare (site hosting, Turnstile anti-abuse protection).
  • Brevo (transactional and newsletter email delivery).
  • PostHog EU (audience measurement hosted in Europe).
  • Personal data is never sold or shared with third parties for advertising purposes.

Retention periods

  • Account and alerts: until account deletion, after which personal data is purged.
  • Newsletter consent: until withdrawal; consent evidence is kept 3 years after withdrawal (limitation period).
  • Technical logs: short retention needed for diagnostics and security.
  • Conversations: anonymized when the account is deleted; the other party's content is preserved.

Your rights

  • Access and portability: export your data from your account (“Export my data”).
  • Rectification: edit your information from your profile.
  • Erasure: delete your account from settings; your marketing consents are purged at the same time.
  • Withdraw newsletter consent: unsubscribe link in every email, or account deletion.
  • Objection and restriction: write to privacy@pistapet.com.
  • Complaint: you may contact the CNIL (cnil.fr) if you believe your rights are not respected.

Cookies and trackers

  • Strictly necessary cookies: login session, language preference.
  • Audience measurement: PostHog EU, aggregated data.
  • Cloudflare Turnstile: anti-bot token on public forms — no advertising purpose.

Transfers outside the European Union

  • Some processors (Google, Cloudflare) may process data outside the EU.
  • These transfers are governed by the European Commission's standard contractual clauses.

Security

  • Encrypted connections (HTTPS), data access restricted by security rules.
  • The consent registry is never publicly exposed.
  • Passwords are managed by Firebase Authentication — never stored in plain text.
Post an alert