Privacy Notice
Last updated · 25 May 2026
1. Who we are
This service (“SnoutShot”) is operated by Recall Labs Limited, a company registered in England & Wales (company number 17223162), registered office Henwood House, Henwood, Ashford, Kent, TN24 8DH. “SnoutShot” is our trading name. In this notice, “we”, “us” and “our” mean Recall Labs Limited.
We are registered with the UK Information Commissioner’s Office (ICO). ICO registration: application submitted — number to follow.
Contact for data protection matters: [email protected] (or write to us at the registered office above, marked “Data Protection”).
2. What SnoutShot does (and our two roles)
SnoutShot helps dog daycare and boarding businesses (“operators”) share photos with dog owners. Operators’ staff take photos during the day; our software uses AI to identify which dog appears in each photo and delivers personalised photo collections to each owner, usually by WhatsApp.
Our role under data protection law depends on whose data it is:
- When we provide the service to an operator, that operator decides what data about their customers (the dog owners) is collected and why. In that relationship the operator is the “controller” and we act as a “processor” — we handle the dog owners’ data on the operator’s instructions. If you are a dog owner, please also read your daycare’s own privacy information, and direct data requests to them in the first instance (we will help them respond).
- For our own business data — our operator accounts, the staff who use our dashboard, our billing, our marketing and our website — we are the controller. This notice explains how we handle that data, and describes the processing we carry out for operators so everyone understands the full picture.
3. The personal data we handle, and why
a) Operators and their staff (we are controller)
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, business name, role | Create and run your account; support | Performance of a contract |
| Account login / authentication data (via Clerk) | Secure sign-in | Performance of a contract |
| Billing details (via Stripe) | Take payment for the service | Performance of a contract; legal obligation (tax records) |
| Support messages | Help you | Legitimate interests (running a support function) |
| Marketing preferences | Send product updates if you opt in | Consent (and/or legitimate interests for existing customers) |
b) Dog owners and their dogs (we are processor, on the operator’s behalf)
| Data | Why | Lawful basis (the operator’s) |
|---|---|---|
| Owner name, phone number, (optional) email | Deliver the owner’s dog photos, usually via WhatsApp | The operator relies on consent for WhatsApp delivery and legitimate interests for operational records |
| Photographs taken at the daycare | Detect and identify dogs; build photo collections | Operator’s legitimate interests / consent |
| Dog details and AI “embeddings” (a numeric fingerprint of a dog’s appearance) | Match the right dog to the right owner | Operator’s legitimate interests |
Note on photographs: photos taken in a busy daycare can incidentally include people (staff, owners, passers-by). Where a photo contains an identifiable person, that photo is personal data, and we handle it with the same care as the rest.
c) Everyone who uses our website / app
| Data | Why | Lawful basis |
|---|---|---|
| Usage analytics (via PostHog) | Understand and improve the service (aggregate statistics) | Legitimate interests (and permitted without consent for first-party analytics under the Data (Use and Access) Act 2025) |
| Error and performance logs (via Sentry) | Keep the service working and secure | Legitimate interests |
| IP address, device/browser info | Security, fraud prevention, basic functionality | Legitimate interests |
We do not use the data to make solely automated decisions that produce legal or similarly significant effects about you. The AI identifies dogs, not people, and a human reviews borderline matches.
4. Who we share data with (our processors / sub-processors)
We use a small set of trusted suppliers to run SnoutShot. Each handles data only on our instructions under a data processing agreement. Our current suppliers:
| Supplier | What it does | Location | Safeguard for any non-UK transfer |
|---|---|---|---|
| Supabase | Database & photo storage | Ireland (EU) | UK adequacy (EU), no extra safeguard needed |
| Modal | AI dog detection & identification | USA | Provider DPA: SCCs + UK IDTA Addendum |
| Clerk | Sign-in / authentication | USA | Provider DPA: SCCs / UK IDTA Addendum |
| Upstash | Job queue / caching | EU | UK adequacy (EU), no extra safeguard needed |
| 360dialog | WhatsApp message delivery | USA (migrating to EU) | Provider DPA: SCCs / UK IDTA Addendum, until EU migration completes |
| Resend | Transactional email | USA | Provider DPA: SCCs / UK IDTA Addendum |
| PostHog | Product analytics | EU | UK adequacy (EU), no extra safeguard needed |
| Sentry | Error monitoring | EU | UK adequacy (EU), no extra safeguard needed |
| Stripe | Payments | USA/EU | Provider DPA: SCCs; PCI-DSS |
| Railway | Application hosting | EU | UK adequacy (EU), no extra safeguard needed |
We may also disclose data if required by law, or to protect our rights, safety, or property.
International transfers
Some suppliers above are outside the UK. Where we transfer personal data outside the UK, we rely on an approved safeguard — usually the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (IDTA) in the supplier’s data processing agreement, or the UK extension to the EU–US Data Privacy Framework where the supplier is certified. You can ask us for details of the safeguard that applies to a specific transfer.
5. How long we keep data
- Operator account & staff data: for as long as the account is active, then up to 12 months after closure (longer where law requires — e.g. accounting records kept 6 years).
- Dog owner data & photos: kept on the operator’s behalf per their instructions/settings. By default photos are retained up to 12 months then deleted, and all owner data is deleted within 30 days of the operator’s account ending or on the operator’s instruction.
- Analytics: up to 14 months. Error logs: up to 90 days.
We delete or anonymise data when it is no longer needed for the purposes above.
6. Your rights
Under UK data protection law you have the right to: access your data; ask us to correct it; ask us to delete it; restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). Where we act as a processor for an operator, we will pass your request to that operator and assist them in responding.
To exercise a right, contact us at [email protected]. We will respond within one month. There is normally no charge.
You also have the right to complain to the ICO (ico.org.uk; 0303 123 1113) — though we’d appreciate the chance to put things right first.
7. Cookies and similar technologies
We use a small number of cookies/local storage for essential functions (signing you in, security) and for first-party analytics to improve the service. Under the Data (Use and Access) Act 2025, our analytics use does not require a consent banner, but you can object at any time — see our separate Cookie Notice for details. We do not use advertising or cross-site tracking cookies.
8. Marketing
We only send marketing (e.g. product updates) to operators who have opted in, and you can unsubscribe at any time via the link in any message or by emailing us. We do not sell your data.
9. Security
We protect data with measures appropriate to the risk, including encryption in transit and at rest, access controls and tenant isolation (each operator’s data is segregated), least-privilege access, and monitoring. No system is perfectly secure, but we take this seriously and review it regularly.
10. Children
SnoutShot is a business tool used by adults (operators and dog owners). It is not intended for children and we do not knowingly collect children’s data.
11. Changes to this notice
We may update this notice from time to time. We will post the new version here and update the “last updated” date; significant changes will be communicated to operators directly.
12. Contact
Recall Labs Limited (t/a SnoutShot), Henwood House, Henwood, Ashford, Kent, TN24 8DH · [email protected] · ICO registration: application submitted — number to follow.