Privacy Policy

1. Who We Are

habitatHQ is a wildlife and nature center animal care management platform operated by Fullstakrs LLC, a Connecticut limited liability company ("Fullstakrs," "we," "us," or "our"). Our registered address is in Glastonbury, Connecticut, USA.

For the purposes of applicable data protection law, Fullstakrs LLC is the data controller for account and usage data. Your organization (the Customer) is the data controller for all Customer Data (animal records, staff records, etc.) you upload to the Service; Fullstakrs LLC acts as a data processor for that data.

2. Scope

This Privacy Policy applies to information collected through the habitatHQ web application (habitathq.org and customer subdomains), our marketing website, and any communications between you and Fullstakrs LLC. It does not apply to third-party services you connect to the Service (such as Stripe, Google, SignalWire, or AI API providers), which have their own privacy policies.

3. Information We Collect

Account information. When your organization registers, we collect the organization name, administrator name, email address, and billing information (processed by Stripe — we do not store payment card details).

Sign-up security information. When an account is requested and when its email address is confirmed, we record the IP address and browser details (user agent) used and the times. We use this only to prevent abuse, such as automated or fraudulent sign-ups, and to investigate it if it happens.

Customer Data. All data you enter into the Service — animal profiles, medical records, feeding schedules, staff records, shift schedules, task logs, audit entries, and any uploaded files — is Customer Data. You control this data. We process it only to deliver the Service.

Usage data. We collect information about how the Service is used, including pages visited, features accessed, error logs, and timestamps. This data is used for service improvement and troubleshooting.

Communications. If you contact us by email or through the Service, we retain records of that communication.

Staff and volunteer data. Your organization may enter personal data about staff and volunteers (names, email addresses, phone numbers, certifications, role assignments). This is Customer Data controlled by your organization.

4. How We Use Information

• Providing, maintaining, and improving the Service;
• Processing subscription payments and managing billing;
• Sending transactional communications (invoices, service alerts, password resets);
• Sending task and shift reminders on behalf of your organization (SMS and email), as configured by your organization's directors;
• Responding to support requests;
• Detecting and preventing fraud, abuse, and security incidents;
• Complying with legal obligations.

We do not use Customer Data to train AI models, serve advertising, or build profiles for marketing purposes.

5. Data Sharing

We do not sell Customer Data. We share data only as follows:

• Stripe — payment processing. Stripe's privacy policy governs payment data.
• SignalWire / Twilio — SMS delivery. Phone numbers and message content are transmitted to your configured SMS provider to deliver reminders.
• Google — if Google Sign-In is enabled (Enterprise plan), authentication tokens are exchanged with Google's OAuth infrastructure.
• Cloudflare (Turnstile) — bot protection on the sign-up page. To tell people from automated programs, Cloudflare receives technical information about your browser and connection when you load and submit the sign-up form. Cloudflare's privacy policy governs that data.
• AI API providers — if AI features are enabled, data necessary to fulfill the request is transmitted to the applicable provider via its API using your organization's own API keys: lab result text to Anthropic; chatbot questions to Groq and/or Google (Gemini), depending on configuration; and web search queries to Tavily. We do not control how these providers use transmitted data; their privacy policies apply.
• Infrastructure providers — the servers hosting the Service may be operated by third-party hosting providers. These providers have access to server-level data under confidentiality agreements.
• Legal requirements — we may disclose data if required by law, court order, or to protect the rights, property, or safety of Fullstakrs, our customers, or others.

6. Data Storage & Security

Customer Data is stored on servers located in the United States. Enterprise plan customers have data stored on a dedicated server instance. Professional and Starter plan customers share application infrastructure, with data logically separated by organization.

We implement reasonable administrative, technical, and physical safeguards designed to protect against unauthorized access, alteration, disclosure, or destruction of data. These include encrypted connections (HTTPS/TLS), access controls, and audit logging. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Data Retention

We retain Customer Data for the duration of your active subscription. Upon termination, we retain data for 30 days to allow for export requests, after which it may be permanently deleted. Billing and transaction records are retained as required by applicable law (typically 7 years).

Usage logs and audit records are retained for up to 12 months. Sign-up security information (Section 3) is kept with your account's audit records and is deleted when your account is deleted. Enterprise customers with dedicated database deployments retain data at their own infrastructure and may delete it on their own schedule.

8. AI Features & Third-Party APIs

AI features require you to configure your own API keys. Lab result parsing uses Anthropic's Claude. The AI assistant chatbot uses Groq and/or Google's Gemini as its underlying language model, depending on your organization's configuration, and separately uses Tavily to perform web searches when answering certain questions. When these features are used, relevant data — such as lab report text, your questions to the chatbot, or search queries — is transmitted to the applicable third-party API. We do not control, log, or retain data processed by third-party AI providers beyond what is necessary to display results to you. We strongly recommend reviewing the privacy policies of Anthropic (anthropic.com), Groq (groq.com), Google (policies.google.com/privacy), and Tavily (tavily.com) before enabling these features.

AI API credentials are stored encrypted in your organization's database record and are not accessible to Fullstakrs staff in plaintext.

9. SMS & Email Communications

The Service sends SMS and email notifications on your organization's behalf to staff and volunteers as configured by your directors. Phone numbers and email addresses used for this purpose are Customer Data controlled by your organization. You are responsible for ensuring that your staff and volunteers have consented to receive such communications where required by applicable law (including TCPA in the United States and PECR in the United Kingdom).

Recipients may opt out of SMS notifications by replying STOP. Email notifications include an unsubscribe mechanism.

10. Cookies & Tracking

The Service uses session cookies necessary for authentication and security (e.g., maintaining your logged-in state). We do not use third-party advertising cookies or cross-site tracking technologies. We do not use Google Analytics or similar analytics platforms. No cookie consent banner is displayed because we do not set non-essential cookies.

11. GDPR — EEA & UK Rights

Legal basis for processing. We process personal data under the following lawful bases: contract performance (providing the Service you subscribed to); legitimate interests (security, fraud prevention, service improvement); legal obligation (tax and financial record keeping); and consent (where explicitly obtained).

Your rights. Subject to applicable law, you have the right to: access personal data we hold about you; correct inaccurate data; request deletion ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; and lodge a complaint with your local supervisory authority.

International transfers. Your data is stored and processed in the United States. We rely on standard contractual clauses or other appropriate safeguards for transfers from the EEA/UK to the US where required.

To exercise your rights, contact us at privacy@habitathq.org. We will respond within 30 days.

12. CCPA — California Rights

We do not sell or share personal information for cross-context behavioral advertising. California residents have the right to: know what personal information we collect and how it is used; delete personal information (subject to certain exceptions); correct inaccurate personal information; opt out of sale or sharing (not applicable — we do not sell); and non-discrimination for exercising these rights.

To submit a verifiable consumer request, contact us at privacy@habitathq.org. We will respond within 45 days.

13. Other Regional Rights

Canada (PIPEDA / Law 25). Canadian residents may request access to or correction of their personal information by contacting us. Quebec residents have additional rights under Law 25, including the right to data portability and to be informed of automated decision-making.

Australia (Privacy Act 1988). Australian residents may request access to or correction of personal information we hold, and may complain to the Office of the Australian Information Commissioner if they believe we have breached the Australian Privacy Principles.

Other jurisdictions. We endeavor to respect applicable privacy laws in all jurisdictions where our customers operate. Contact us at privacy@habitathq.org with any regional privacy questions.

14. Children's Privacy

The Service is intended for use by organizations and their adult staff and volunteers. We do not knowingly collect personal information from individuals under the age of 16. If you believe a minor has provided personal information through the Service, please contact us and we will take steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice within the Service at least 14 days before they take effect. The effective date at the top of this document will be updated with each revision. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

16. Contact & DPO

For privacy-related questions, requests, or complaints:

• Email: privacy@habitathq.org
• General support: support@habitathq.org
• Fullstakrs LLC  ·  Glastonbury, CT, USA

We do not currently have a formal Data Protection Officer. For GDPR-related inquiries, contact us at the email above and we will route your request appropriately.