Pista

Privacy Policy

How Pista collects, uses and protects your personal dataLast updated: November 2026 — version policy-2026-11

Pista is a platform that helps reunite lost pets with their owners through proximity alerts and neighbourhood mutual aid. This page describes what data we collect, why, and what your rights are.

  1. 01Data controller
  2. 02Data we collect
  3. 03Purposes
  4. 04Legal bases
  5. 05Recipients and processors
  6. 06Advertising (Google AdSense)
  7. 07Retention periods
  8. 08Your rights
  9. 09Cookies and trackers
  10. 10Transfers outside the European Union
  11. 11Security

Data controller

  • TECHFLARE SASU (3 Chemin de Bel-Air, 77000 Melun, France), publisher of Pista — the lost & found pet alert platform.
  • Privacy contact: privacy@pistapet.com
  • For any question about your data or to exercise a right, write to this address.

Data we collect

  • Account: first name, last-name initial, email address, preferred language.
  • Alerts: pet description and photos, city, disappearance area, status.
  • Messaging and reports: content of exchanges between users and filed reports.
  • Newsletter consent: email address, language, signup source, date and form version; IP address and browser are retained as consent evidence.
  • Technical data: error logs, aggregated usage metrics, session cookies required for the service.
  • We do not collect or store banking data; any payment goes through a dedicated payment provider.
  • Identification photos: analyzed in memory then deleted, never stored. Voluntarily contributed photos: kept only if you checked a permission (encyclopedia publication and/or recognition improvement), with the indicated breed, the model used and proof of your consent.

Purposes

  • Provide the service: publish alerts, notify watch zones, connect users.
  • Transactional emails: confirmations, alert notifications, reminders — required for the service.
  • Newsletter and marketing emails: only with your explicit consent, confirmed by double opt-in.
  • Security and fraud prevention: anti-abuse, moderation, scam protection.
  • Aggregated statistics to improve the product.
  • AI image analysis: estimating the breed of a photographed pet — the photo is processed in memory and deleted immediately.
  • Voluntary photo contributions: publishing your photo on encyclopedia pages ("encyclopedia" scope, subject to human review) and/or keeping it to train and evaluate our recognition tool ("dataset" scope, never published) — only with your explicit, separate consent.

Legal bases

  • Service performance: account, alerts, messaging, transactional notifications.
  • Consent: newsletter and marketing communications (withdrawable at any time).
  • Legitimate interest: platform security, fraud prevention, aggregated audience measurement.
  • Legal obligation: retaining certain data where the law requires it.

Recipients and processors

  • Google Firebase (authentication, database, storage) — application data hosting.
  • Cloudflare (site hosting, Turnstile anti-abuse protection).
  • Brevo (transactional and newsletter email delivery).
  • PostHog EU (audience measurement hosted in Europe, no persistent cookie).
  • Google AdSense (ad delivery on public pages — see the “Advertising” section).
  • Personal data is never sold.

Advertising (Google AdSense)

  • Google AdSense ads may appear on the site's public pages (articles, encyclopedia entries, information pages) — never in your account, messaging or admin pages.
  • For visitors in the EU, UK and Switzerland, personalised ads are only served with your consent, collected through a certified consent management platform (TCF v2.2).
  • If you decline, only non-personalised ads may be served and access to the site is never blocked.
  • You can change or withdraw your consent at any time via the consent message, and manage your Google ad preferences on adssettings.google.com.

Retention periods

  • Account and alerts: until account deletion, after which personal data is purged.
  • Newsletter consent: until withdrawal; consent evidence is kept 3 years after withdrawal (limitation period).
  • Technical logs: short retention needed for diagnostics and security.
  • Conversations: anonymized when the account is deleted; the other party's content is preserved.
  • Contributed photos: until you withdraw consent or delete your account, then the file and its metadata are synchronously deleted.

Your rights

  • Access and portability: export your data from your account (“Export my data”).
  • Rectification: edit your information from your profile.
  • Erasure: delete your account from settings; your marketing consents are purged at the same time.
  • Withdraw newsletter consent: unsubscribe link in every email, or account deletion.
  • Objection and restriction: write to privacy@pistapet.com.
  • Complaint: you may contact the CNIL (cnil.fr) if you believe your rights are not respected.
  • Photo consent withdrawal: revoke each contribution from your account — the photo and its metadata are deleted synchronously. Models already trained cannot be "un-trained".

Cookies and trackers

  • Strictly necessary cookies: login session, language preference.
  • Audience measurement: PostHog EU, aggregated data.
  • Cloudflare Turnstile: anti-bot token on public forms — no advertising purpose.
  • Advertising cookies: Google and its partners may set cookies to measure and personalise ads — only with your consent in the EU, UK and Switzerland.

Transfers outside the European Union

  • Some processors (Google, Cloudflare) may process data outside the EU.
  • These transfers are governed by the European Commission's standard contractual clauses.

Security

  • Encrypted connections (HTTPS), data access restricted by security rules.
  • The consent registry is never publicly exposed.
  • Passwords are managed by Firebase Authentication — never stored in plain text.
Post an alert