Version dated 25 October 2026
Privacy
All legal texts in one dated PDF with numbered pages.
Who are we?
The controller is MOLDEREZ-CONSULT SRL, Square Valère Gille 13/5, 1050 Ixelles, Belgium, CBE and VAT BE0842.262.084, which operates UFoundMe! on ufoundme.eu. For any question or request concerning your data: hello@ufoundme.eu (or gilles.capelluto@molderez-consult.be). We have not appointed a data protection officer, as this appointment is not mandatory for our activity; these addresses handle all your requests. This policy covers the website, the digital card, the chat, calls, the Studio, the shop, the Wall of Fame, rewards, referrals and the reseller area. The French version is authoritative; the other versions are translations.
The essentials
UFoundMe! is not a GPS tracker: nothing locates your pet continuously. The public card presents your pet, never your e-mail, your address or your surname. The finder writes to you through a private chat: neither of you sees the other’s contact details, unless one of you chooses to share them. We do not sell your data, do not carry out any targeted advertising and do not take any automated decision about you.
Your pet and you: what is public
Information that concerns only a pet is not, in itself, personal data. It becomes personal data when it makes it possible to identify you, alone or combined with other information: the pet’s name, photo, breed, your first name, a neighbourhood mentioned in a message or on a poster. We therefore treat the whole card as personal data relating to you, with all the safeguards of the GDPR. Anyone who scans the tag or opens the link sees: the pet’s name or nickname, its photo, its species and breed, its short introduction and traits, the “lost” status if activated, the first name registered in your account (which can be changed at any time in your settings) and, only if you activate them, the pet’s date of birth, useful medical information and your verified phone number. The following are never published: your surname, your e-mail, your address, the contact details of your circle of trust and your payment data. The card uses a non-guessable link and asks search engines not to index it; it nevertheless remains visible to anyone who holds the tag or the link, and may be shared. When the link is shared in a messaging app or on a social network, a preview may be displayed with the pet’s name and photo and, in lost mode, the word “lost”.
Our advice for a useful and discreet card
A little information is enough to help the finder. We recommend: the pet’s usual name or a nickname; your first name only, or a nickname, as the account first name; a photo of the pet alone, without any person, number plate, house front or recognisable house number; medical information limited to what protects the pet (allergy, treatment, “do not feed”), without any information about your own health; no precise location in the introduction. The date of birth, medical information and phone number are hidden by default. You can change or remove everything at any time in the Studio; the card is updated immediately.
The data subjects and their data
Owner (account holder): first name, billing name if necessary, e-mail, encrypted password or Google identifier, language, avatar, verified phone number if you add it, pets, cards, tags, subscription, orders, delivery and billing addresses, invoices, Mollie payment references (never your full bank card number), messages, alert preferences, Wall of Fame entries, rewards and referrals, technical and security logs., Member of the circle of trust: name or nickname, relationship with the owner, e-mail or phone number, alert channel and time slots, entered by the owner., Finder: messages and photos sent in the chat, language, location only if you share it, contact details only if you write them, technical data of relayed calls (session, duration), non-reversible network fingerprint calculated from the IP address to combat abuse, reports; no account is required from the finder., Visitor: aggregated view counters without identifier; contact form (name, e-mail, message); subscription to campaign news (optional first name, e-mail, language, proof of consent)., Reseller or partner: company, establishment address, surname, first name, position, e-mail, phone number, country, stated volumes and needs, reseller account credentials, business correspondence. Visitors: Google Analytics data only if you accept it.
Why we use your data and on what basis
Creating and managing the account, pets, cards and tags; providing the chat, translation, alerts, calls, lost mode and the Studio: performance of the contract (Article 6.1.b GDPR)., Orders, payment, delivery, guarantee, returns and support: contract and pre-contractual measures (6.1.b)., Accounting, invoicing, taxation and responses to authorities: legal obligation (6.1.c)., Forwarding a finder’s message, photos or call to the owner: legitimate interest of the finder, of the owner and of the pet’s welfare in rapid and protected contact (6.1.f)., Notifying the circle of trust: legitimate interest of the owner and of the pet in being reached quickly (6.1.f)., Security, prevention of fraud, spam and abuse, moderation, evidence and legal defence: legitimate interest (6.1.f)., Aggregated cookieless view counters: legitimate interest in measuring the reliability of the service without tracking anyone (6.1.f)., Publishing your phone number on a card, printing your phone number on the poster, displaying the date of birth or medical information, publishing a photo on the Wall of Fame, having it pre-screened by AI, sharing a location in the chat, receiving a basket reminder or campaign news: your consent (6.1.a), which you may withdraw at any time, without affecting what was done before., Rewards programme and related messages (birthday, referral): performance of the programme in which you participate (6.1.b); you may ask us at any time to stop these e-mails., Relations with resellers: pre-contractual measures and contract (6.1.b), then legitimate interest in business follow-up between professionals (6.1.f). If you do not provide the data necessary for the contract, we cannot provide the function concerned. Activating Google Analytics: your consent (6.1.a), which you can withdraw at any time with the “Manage cookies” link.
You have found a pet
You do not need an account. Your messages and photos are visible only to the owner and, if the owner has provided for it, to their circle of trust; they are encrypted on our servers. Your contact details are not disclosed, unless you write them yourself. Your location is requested only after a click on “Share my location”; refusing blocks nothing. Audio and video calls are relayed by our servers, without showing your number or your IP address, and are not recorded. Messages are translated automatically so that they can be understood. Avoid sharing unnecessary sensitive information. If you are a minor, get help from an adult if possible.
Circle of trust
The owner may add close contacts who receive the alerts. The owner provides us with their contact details and undertakes to have informed them and to have their agreement. We use them solely to forward alerts concerning the pet. A close contact may ask us at any time to no longer be contacted (hello@ufoundme.eu). When the owner removes a close contact, their e-mail and phone number are erased immediately; the audit log keeps only a record of the action, without contact details.
Poster and “lost” posts
Lost mode prepares an A4 poster and texts ready to share. Your number appears on it only if you enter it and tick the consent box; it is neither stored nor placed in a web address. You are the one who prints and publishes: once the poster has been put up or a text has been published on a social network, we can no longer remove it and the platform applies its own rules. Deactivating lost mode removes the “lost” status from the card.
Wall of Fame
Before submitting, you choose between human review only and AI pre-screening followed by a human decision. The photo and its caption are sent only if you tick this option: to Mistral AI (France) first; if Mistral AI is unavailable, to Anthropic (United States); and only if both are unavailable, to Z.AI (Singapore), which receives the photo only, never the caption: the caption is then checked by a person alone. If a service declines to analyse a photo, it goes to human review and is not sent to the next service. The AI publishes nothing: a person always decides, and the QR must be blurred before any publication. A rejected submission is erased; a pending submission is erased after 30 days; a published photo remains visible until it is removed by its author or by a moderation decision.
Location and photos in the chat
In the chat, location and photos are always optional. The browser asks for the location only after the “Share my location” action; refusing does not block the conversation. Coordinates and photos are encrypted, reserved for the participants and deleted after 30 days at the latest. Photos are checked, re-encoded in WebP without unnecessary metadata, never published automatically, and their sender can delete them.
Optional basket reminder
At payment, a box that is unticked by default allows you to request a single e-mail reminder, two days after an order that remains unpaid. The e-mail, language and order reference are used only for that purpose. The reminder is cancelled as soon as payment is confirmed and is never repeated. Its content is encrypted in the sending queue and then erased; the minimal metadata are kept for no more than 90 days.
Automated decisions and artificial intelligence
We do not take any decision based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Automatic translation and the optional pre-screening of the Wall of Fame are only aids: a person always decides. Anti-abuse filters may slow down or temporarily block a suspicious submission; write to us to obtain a human review.
Recipients, processors and transfers
Only authorised persons at MOLDEREZ-CONSULT and the necessary service providers have access to your data, each for their own task and under a processing agreement when acting on our behalf. European providers first: we choose providers established in the European Union first; exceptions are listed below with their safeguards., Hosting: Falcon Internet (FalconDNS), on servers located in an OVHcloud data centre in France (European Union)., Payment: Mollie B.V., the Netherlands (European Union); Mollie is also a separate controller for its own legal obligations as a payment service provider., Transactional e-mails: AuthSMTP, United Kingdom, a country covered by an adequacy decision of the European Commission., SMS and phone verification: Twilio; any processing in the United States is governed by the EU, U.S. Data Privacy Framework and standard contractual clauses., Audio and video calls: infrastructure operated for UFoundMe! by bloo.Cards on servers of Hetzner Online GmbH, Germany (European Union)., Translation: ModernMT, Translated S.r.l., Italy (European Union); as a fallback, Langbly, the Netherlands (European Union)., Google sign-in, if you choose it: Google, a separate controller for authentication; any transfer to the United States is governed by the Data Privacy Framework., Optional pre-screening of the Wall of Fame: Z.AI (JINGSHENG HENGXING TECHNOLOGY PTE. LTD.), Singapore; only the re-encoded photo is transmitted, never its caption or any account data, and only if you tick the option. As Singapore is not covered by a European Commission adequacy decision, this transfer relies on the European Commission’s standard contractual clauses, supplemented by a transfer risk assessment and, where necessary, by supplementary measures; a copy of these safeguards is available on request at hello@ufoundme.eu., Delivery: the chosen carrier, for the name, the address and, if necessary, the phone number., Our accountant and the tax, judicial or administrative authorities where required by law. Any transfer outside the European Union relies on the safeguards provided for in Chapter V GDPR; a copy of these safeguards is available on request at hello@ufoundme.eu. We neither sell nor rent your data. Google Analytics 4, only if you accept it: Google Ireland Limited, processor; a transfer to Google LLC (United States) is covered by the Data Privacy Framework and standard contractual clauses. Optional Wall of Fame pre-screening, first choice: Mistral AI, France (European Union); otherwise: Anthropic, PBC, United States, the transfer relying on the European Commission standard contractual clauses included in its data processing agreement; Z.AI is used only as a last resort, if both are unavailable.
Retention periods
Registration draft in the browser: 2 hours. Studio draft, including photo: 24 hours. Expired code, Magic Link or e-mail change request: one additional day at most. Encrypted chat, photos and locations: 30 days at most. Chat report and minimal metadata: 365 days. Metadata of a sent or abandoned e-mail, without content: 90 days. Member removed from the circle of trust: immediate erasure. Campaign news: 7 days if not confirmed, until withdrawal if confirmed, then 30 days as proof. Aggregated counters: 400 days. Minimised audit log: 5 years. Orders, invoices and accounting documents: legal period, in principle 10 years. Account, pets and cards: throughout the relationship; we may delete or anonymise an account that has had no sign-in for 3 years, after prior notice by e-mail. Reseller: duration of the relationship, then 3 years for business follow-up, unless you object. At the end of these periods, the data are deleted or anonymised, unless there is a legal obligation to retain them or a dispute is pending.
Your rights
You may request access to your data, rectification, erasure, restriction of processing and portability, and withdraw consent given at any time. You may also, at any time and on grounds relating to your particular situation, object to processing based on our legitimate interest; for direct marketing, you may object without giving reasons. Write to hello@ufoundme.eu stating the e-mail address of your account and your request; proportionate identity verification may be requested. We reply without undue delay and at the latest within one month, a period that may be extended by two months for a complex request, with information within the first month. Certain data must be retained despite an erasure request where required by law. You may lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.
Minors
The owner account is reserved for persons aged 18 or over. A minor may contact an owner as a finder, without an account; no identity data is requested from them. We do not carry out any profiling of minors.
Security and breaches
Limited and logged access, separation of environments, protection against request forgery, rate limiting of attempts, secrets kept out of the code, encryption of chats, attachments and the e-mail queue, relayed calls without exposure of IP addresses, logs without private content and scheduled deletions reduce the risks. No system is infallible. Any breach is assessed and documented; where the GDPR requires it, it is notified to the Data Protection Authority within 72 hours and, in the event of a high risk, to the data subjects.
Changes
We adapt this policy when the service or the law changes. The version date appears at the top of the page. In the event of a significant change, such as a new purpose or a new recipient outside the European Union, we notify you in the Studio or by e-mail before it applies and, if necessary, we ask for your consent again.