Privacy Policy

Last updated: 22 October 2026

This policy explains how Genera Software Ltd collects, uses, shares and protects personal information across our website, the Genera platform, and the Genera Driver apps for iOS and Android. We have tried to write it in plain English and to be specific about what actually happens to your data, rather than describing it in general terms.

The short version

• We do not sell personal data, and we do not use it for advertising.
• If you use Genera through a pet care business — as a pet owner, a member of staff or a driver — that business decides what information it keeps about you. We store and process it on its behalf and on its instructions.
• The Genera Driver apps share a driver’s precise location only during a run the driver starts, and stop when it ends. Sharing carries on while the driver uses a navigation app or locks the phone, with the phone showing that location is in use the whole time: a location indicator on iPhone, an “On a run” notification on Android.
• We rely on a small number of trusted providers for hosting, email, payments, maps and notifications, and we name them below.
• You have rights over your data, including access, correction and deletion. Email info@generasoftware.com to use them.

Who we are

Genera Software Ltd (“Genera”, “we”, “us”, “our”) is a software company registered in England and Wales. We build Genera, software for dog daycares, dog walkers, groomers, pet taxis and other pet care businesses, and we build and manage websites for businesses in the sector.

• Company No.: 15009675
• Registered address: C/O Mjf Accountancy, 47 Booker Avenue, Liverpool, England, L18 4QZ
• ICO registration No.: ZC196623
• Privacy contact: info@generasoftware.com

Who this policy covers and our role

This policy applies to:

• Website visitors and enquirers — people who visit generasoftware.com or our Help Centre, request a demo or contact us.
• Business customers — the businesses that subscribe to Genera, and the people who set up and run those accounts.
• Pet owners — customers of businesses that use Genera, including people who use a business’s customer portal.
• Staff, drivers and service providers of businesses that use Genera, including users of the Genera Driver apps.
• Other people named in records — for example emergency contacts, vets, and prospective customers booked in for a meet-and-greet.

When we are the controller

We decide how and why your data is used — and are responsible for it as the “controller” under UK GDPR — for:

• our website, enquiries, demo requests and support requests;
• business customer accounts, our billing of those businesses, and our relationship with them;
• analytics about how people use our website and the Genera platform;
• keeping our services secure and preventing misuse; and
• our own marketing and onboarding emails to businesses.

When we act on behalf of a business

The records a business keeps in Genera — about its customers, their pets, its staff and drivers, bookings, invoices, messages, notes and driver locations — belong to that business. Our terms confirm that businesses own the data they upload. For this information the business is the controller and Genera is its processor: we only use it to provide Genera to that business, on its instructions and under our data processing terms.

If you are a pet owner or work for a business that uses Genera, that business’s own privacy notice also applies to you, and it is usually best to contact the business first about your data. If you contact us instead, we will pass your request to the business promptly and help it respond.

A pet owner’s sign-in can be linked to more than one business that uses Genera. Each business can only see the information held in its own Genera account.

The information we collect

Website visitors and enquiries

• Demo requests and other forms — your name, email address, business name, business size (for example, dogs per day), current software, a preferred time for a demo, and any other answers you choose to give.
• Technical details sent with forms — when you submit a form we record your IP address and browser user agent, which help us detect spam and abuse.
• Help Centre support requests — your name, email address, the category, subject and description of your request, and technical details that help us investigate: the page you were on, your browser, operating system and screen size.
• Emails you send us — your messages and replies to our support emails, together with the names and types of any attachments.
• Usage data — how you use our website, collected through cookies and analytics if you agree. See Cookies and similar technologies.

Business customers

• Account details — when you register: your name, email address, password, phone number, business name and website. Passwords are stored only in hashed form by our authentication provider; we never see them.
• Business details — company number, VAT and tax numbers, address, contact details, branding, your terms and conditions, business documents you upload, and the bank details you choose to show on your invoices.
• Your team — the names, email addresses and roles of the people you invite.
• Billing — your Genera subscription, our invoices to you, and the status of your Direct Debit mandate. Your bank details are entered on GoCardless’s own pages; we receive the mandate reference and status.
• Support and onboarding — support requests raised from inside Genera include your account ID, email address, role, a summary of how your account is set up, your time zone, language, screen size and recent technical errors. We also record onboarding milestones, such as completing setup.
• Product usage — how you use Genera, including session recordings. See Cookies and similar technologies.

Information businesses store in Genera

Each business decides what to record. Depending on how it uses Genera, this can include:

• Pet owners — name, email addresses, phone numbers, home address and its map coordinates, profile photo, notification preferences, bookings, invoices, credits, memberships, notes, and payment references (for example Stripe or GoCardless customer IDs and Direct Debit status — never full card numbers).
• Pets — name, breed, sex, date of birth, neutering and microchip details, photos, food and care details, behaviour and health notes and alerts, assessments, and vaccination records and certificates.
• Home access details — property type, key type and key sets, alarm codes, and collection and drop-off instructions. These are visible only to the business’s authorised team members, including the drivers who collect and return pets.
• Emergency and vet contacts — names and phone numbers.
• Signed terms — when an owner accepts a business’s terms: their typed name, a signature image, the date and a copy of the terms they agreed to.
• Bookings and activity — services, dates and times, check-in and check-out, cancellations and their reasons, and a change log showing who changed a booking and when.
• Messages and notes — messages between owners and the business, broadcasts, notes written by staff and drivers, and reports and blocks raised in chat.
• Staff and drivers — name, email address, home address, date of birth, start date, photo, role, pay type and rate or salary, working hours, rota, holiday allowance, and holiday and sick-day records.
• Prospective customers — for meet-and-greet bookings: name, address and phone number.

Health information about people. Sick-day records and notes about staff can be health data, which UK GDPR treats as a special category. The business that records it is responsible for having a lawful reason to do so (typically its obligations as an employer). We process it only to provide Genera to that business.

Technical and device information

• Sign-in and security — session cookies that keep you signed in and, when you change your email address, the IP address and browser used, so we can protect your account.
• Activity — which Genera portal you last used, when, and whether in a browser or as an installed app.
• Notifications — if you turn notifications on: the browser push subscription (including your browser’s user agent), or your mobile device’s push token and device name or model.
• Email delivery — whether emails we send were delivered, bounced or marked as spam and, for some emails, whether and when they were opened, along with the email app, device type and operating system used. See Emails, notifications and marketing.
• Driver location — see Genera Driver apps.

How we use information and our lawful bases

UK GDPR requires a lawful basis for each way we use personal data. Where we act on behalf of a business, the business decides its own lawful basis and we follow its instructions.

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can object at any time — see Your rights.

Genera Driver apps (iOS and Android)

This section applies to the Genera Driver apps for iOS and Android, used by drivers and staff of businesses that use Genera. It sits alongside the rest of this policy and describes the additional data the apps handle. The business you drive for is the controller of your data and of the customer data you see in the app; Genera acts as its processor.

Location data

The apps collect precise location data. Here is exactly how:

• Only when you start it. Location sharing begins only when you start a run and confirm that you want to share your location, or switch on location sharing in the app. Your phone asks for location permission the first time.
• Only during a run. On iOS the app requests the “While Using the App” permission only and never requests “Always”. On Android it asks only for the “While using the app” permission and never for “Allow all the time”. Once you start a run from the app, it keeps sharing while you use a navigation app or your screen is locked, so your business can follow the run between stops. While it does, iPhone shows its location indicator in the status bar and Android shows an “On a run” notification. Location is never collected outside a run, or after the app is closed.
• When it stops. Sharing stops when you end the run, complete every stop, change day or route, sign out, lose access to the business’s account, turn off GPS or withdraw permission. Leaving the app or locking your phone does not stop it: sharing carries on in the background until the run ends. Closing the app from your recent apps (on iPhone, swiping it away in the app switcher) also stops it.
• What is sent. Latitude, longitude and accuracy, plus direction of travel and speed where your phone provides them. Our servers record when each update arrives. No device identifier is sent with location updates.
• How often. An update is sent at most every 20 seconds, and only after you have moved about 50 metres or two minutes have passed. In Low Power Mode or battery saver this becomes every 60 seconds, 100 metres or five minutes. Readings less accurate than 150 metres (250 metres in low-power mode) are discarded. The Android app needs your phone’s precise location permission and will not share an approximate location.
• Who can see it. Authorised administrators of the business you drive for, on their live map. Your live position is not shown to pet owners.
• Why we collect it. So the business can see where a run is, coordinate pickups and drop-offs, answer owners’ questions about arrival times, and confirm that stops happened. Location is used for this service only.
• What we keep. We keep only your most recent position. Each new update replaces the previous one, so we do not build up a history of your movements. When you complete a stop, we record who completed it and when, as part of the booking record.
• What we do not do. We do not use location for advertising or profiling, and we do not sell it or share it with data brokers.
• Demo mode. The GPS test in the demo uses your location on your phone only and never sends it to us.
• Permission is yours to control. You can decline the location permission, or withdraw it at any time: on iPhone in Settings → Privacy & Security → Location Services, and on Android in Settings → Location → App location permissions (the exact path varies by device). Live route tracking will not work without it, but the rest of the app remains usable.

If you use the Genera driver portal in a web browser instead of the app, your browser will ask for permission before sharing your location, and your location is shared while the portal is open with permission granted. The same storage rules apply.

Other information the apps use

• Account and identity — your name, email address, phone number and role with the business, used to sign you in and authorise access. You sign in with your email address and password; the apps never store your password.
• Routes and stops — pet and owner names, addresses and postcodes, collection and drop-off times, services, notes and instructions for each stop, and the confirmations you record.
• Owner and pet details — the customer records the business gives you access to, which can include phone numbers, addresses, emergency and vet contacts, and home access information such as key details and alarm codes. When you search, your search text is sent to our servers to find matching records.
• Notes — notes you add are shared with the business’s team and are never shown to customers. They cannot be edited or deleted in the app.
• Messages — messages you send and receive, and any reports or blocks you make. When you report a message, a copy of it is kept with the report for the business to review.
• Schedule and time off — your rota, work pattern and holiday allowance, and any holiday or sick-day requests you send, including an optional note. A note on a sick-day request may contain health information, so please include only what the business needs.
• Maps and navigation — the iOS app shows stops on an Apple Maps map and uses Apple’s address lookup to place them, and “Directions” opens Apple Maps. On Android, “Open in Maps” opens Google Maps with the addresses of the stops on your route, and “Navigate” opens your chosen maps app with one address. Once opened, those apps are covered by Apple’s or Google’s privacy policies.
• Calls — tapping a phone number opens your phone’s dialler. The apps cannot see your contacts or call history.

Push notifications

• If you turn notifications on, we store your device’s push token, the platform, the app’s identifier, and your device’s name (iOS) or model (Android), so we can alert you about routes, notes and messages. On iPhone we also record whether the build uses Apple’s sandbox or production notification service.
• Notifications are delivered through Apple Push Notification service on iOS and Firebase Cloud Messaging (a Google service) on Android.
• A push token identifies the device, not you personally. It is not an advertising identifier and is not used for advertising or tracking.
• The token is removed from our servers when you turn notifications off in the app, and when you sign out, which clears every device registered to your account. On Android, signing out also deletes the Firebase token from the device.
• On Android, Firebase may create an installation identifier on your device when the app starts, as part of how its messaging service works. It is only shared with us if you turn notifications on.

What is stored on your device

• iOS — your sign-in session is stored securely in the iOS Keychain and removed when you sign out. Your notification preference and push token are kept in the app’s settings on the device.
• Android — your sign-in session is stored encrypted, using a key held in the Android Keystore, and removed when you sign out. Your notification preferences are kept in the app’s settings. The app is excluded from device backups and transfers, and its preview is hidden in the recent-apps screen.
• Both — routes, customer details and messages are held in the app’s memory only, never saved to your device, and cleared when you sign out. Location readings are not saved on the device. Deleting the app removes everything it stored.

What the apps do not do

The apps use your camera or photos only when you choose to attach a photo to a message or a pet’s profile, and receive only the photos you pick or take. On Android this goes through the system photo picker and your camera app, so the app is never given access to your photo library or camera. The apps do not access your contacts, microphone or health data, and they contain no advertising identifiers or third-party analytics, crash-reporting or advertising SDKs. They do not track you across other companies’ apps or websites. If you have chosen to share analytics with Apple or Google in your device settings, those companies may give us anonymised crash reports.

Driver accounts and deletion

Driver accounts are created and removed by the business that employs you, so please ask it first to close your account. You can also ask us directly to access or delete your personal data by emailing info@generasoftware.com, and we will action or forward your request within 30 days.

Payments

• Card payments and BACS Direct Debit through Stripe. When an owner pays a business by card, or sets up a Direct Debit through Stripe, the card or bank details are entered on Stripe’s secure pages. We never see or store full card numbers. We keep the Stripe customer reference, payment status and invoice.
• Direct Debit through GoCardless. Businesses can collect payments from owners through GoCardless, and we use GoCardless to collect our subscription fees from businesses. Bank details are entered on GoCardless’s own pages; we receive the mandate reference and status.
• Payment providers’ own responsibilities. Stripe and GoCardless are regulated payment providers. They also use some data for their own purposes, such as preventing fraud and meeting regulatory requirements, under their own privacy policies.
• Accounting software. If a business connects its Xero or QuickBooks Online account, Genera sends owners’ names, email addresses, phone numbers and addresses, and invoice and payment details (which can include pet names), to that business’s accounting account. If a business chooses to import its customer list from QuickBooks, Genera receives those customers’ names, email addresses, phone numbers and billing addresses from QuickBooks and adds them as owners for that business. We only access the accounting account the business connects, only for these purposes, and the business can disconnect it at any time.

Emails, notifications and marketing

• Emails sent on behalf of businesses — booking confirmations, changes and cancellations, invoices and payment reminders, Direct Debit setup, vaccination reminders, assessment reports, broadcasts, and an email when a chat message has been unread for about 30 minutes. These are sent from a Genera address with the business as the reply-to address. Businesses choose which of these are switched on, and owners can manage their booking, daily and marketing notification settings and push notifications in their profile.
• Account emails — account confirmation, password resets, email-change confirmations and security alerts. These are always sent because they protect your account.
• Email open tracking — some emails contain a small tracking image that tells us whether and when they were opened, and which email app and type of device were used. This helps businesses and us know that important messages have arrived. You can prevent it by turning off automatic image loading in your email app.
• Phone, SMS and WhatsApp — if a business customer gives us a phone number, we may contact the account owner about their account, billing and support by phone, SMS or WhatsApp. WhatsApp messages are processed by Meta on our behalf. You can ask us to stop using WhatsApp at any time by replying STOP or emailing info@generasoftware.com.
• Onboarding emails — when a business signs up, we send the account owner emails to help them get set up, based on their progress. You can unsubscribe using the link in those emails or by contacting us.
• Marketing — we only send marketing about Genera where you have agreed, or where the law allows it for existing business customers, and every marketing message lets you opt out. Business customers choose at sign-up whether to receive product updates and offers from Genera by email, WhatsApp and post, and can change this at any time in Settings → Notifications. We record that choice, when it was made and the wording shown. We never sell or share your data with other companies for their own marketing.

Cookies and similar technologies

Cookies are small files stored by your browser. We also use similar technologies, such as your browser’s local storage. Some are strictly necessary for our services to work; others, such as analytics, are optional.

On our website

Visitors from the UK and EU see a cookie banner and can choose which optional categories to allow. You can change your choice at any time using Cookie Preferences in the website footer.

Until you agree to analytics, Google Analytics sets no cookies, but Google may still receive basic, cookieless signals — for example, that a page was viewed — without anything being stored on your device. Microsoft Clarity and PostHog do not load at all until you agree to analytics. Once they do, they record how you move through our pages, including scrolling, clicks and what is shown on screen. Anything you type into a form field is hidden from the recording. Our website also loads fonts from Adobe Fonts, and a video on our “Our story” page is hosted by Wix, so those providers receive your IP address and browser details when the page loads. Some of our setup guide pages also load fonts from Google Fonts.

In the Genera app and business customer portals

• Strictly necessary — sign-in session cookies, and local storage that remembers things such as the business and pet you last selected, table layouts, dismissed messages and tour progress.
• Google Analytics — measures how the app is used.
• LogRocket — records how you use the app, including pages viewed, clicks and what is displayed on screen, and links the recording to your account ID and email address. We use it to reproduce and fix problems and to help with support requests.
• Vercel Speed Insights — measures how quickly pages load.

You can block or delete cookies in your browser settings, but blocking strictly necessary cookies will stop you signing in.

Who we share information with

We do not sell personal data. We share it only as follows:

• The business you are connected to. If you are a pet owner, staff member or driver, the business and its authorised team can see the records in its Genera account, according to the roles it gives them.
• Our service providers (listed below), under contracts that require them to protect the data and use it only to provide their services to us.
• Payment providers Stripe and GoCardless, who also act as independent controllers for some purposes (see Payments).
• Our own team. A small number of Genera staff can access accounts to provide support, fix problems and keep the service secure. This access is restricted, and key actions are recorded in an audit log.
• Professional advisers, such as our accountants, lawyers and insurers, where necessary.
• Authorities, such as the police, regulators or courts, where the law requires it or to protect the rights, property or safety of people.
• A buyer or successor, if Genera is involved in a merger, acquisition or sale of assets. Your data would remain protected by this policy, and we would tell you about any change.

Our service providers

International transfers

Our application servers are in London, but several of our providers are based outside the UK and may process data elsewhere. Many are US companies, including Supabase, Vercel, Netlify, Postmark, Stripe, Google, Apple, LogRocket, Meta, Microsoft, Anthropic and Adobe. Others are in the European Economic Area.

Where personal data leaves the UK, we make sure it stays protected by relying on:

• UK “adequacy regulations”, which cover the EEA and US companies certified under the UK Extension to the EU–US Data Privacy Framework; or
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Contact us if you would like more information about the safeguards for a particular provider.

How long we keep information

We keep personal data only for as long as we need it for the purposes described in this policy:

• Enquiries and form submissions (including the IP address and browser recorded with them) — 12 months after our last contact, unless you become a customer.
• Support tickets and emails — as long as needed to resolve your request, then up to 24 months so we can help with any related issue.
• Business customer accounts — for as long as the account is open. When a business closes its account, we delete the data it stored in Genera within 90 days, unless it asks us to delete it sooner or the law requires us to keep it.
• Our financial records, such as our invoices to businesses and payment records — for the duration of the contract and 6 years afterwards, for legal and tax purposes.
• Records held for businesses — for as long as the business keeps them. Businesses can delete owners, pets and staff at any time. Invoices and charges may be kept where the business needs them for its accounts.
• Driver location — only the latest position is kept, and each new update replaces it.
• Push tokens — until you turn notifications off or sign out, or the token expires.
• Accounting connection tokens (Xero or QuickBooks) — only while the business keeps the connection. They are stored on our servers, never in the browser, and deleted when the business disconnects.
• Email delivery events, activity and security logs — up to 24 months.
• Analytics and session recordings — according to each provider’s retention settings.

Deleted data may remain in backups for a limited period until those backups are overwritten.

How we protect information

• Encryption in transit — all connections to our website, platform and apps use HTTPS/TLS, and the driver apps refuse unencrypted connections.
• Separation between businesses — access rules in our database ensure each business can only reach its own data, and role-based permissions (such as admin, manager, staff, driver and auditor) control what each team member can see.
• Passwords — handled by our authentication provider and stored only in hashed form.
• Payment details — card and bank details are handled by Stripe and GoCardless, not stored by us.
• Restricted internal access — only a small number of our staff have administrative access, and key actions are logged.
• Private invoices — invoice PDFs are stored privately and are available only to signed-in users with permission.
• Mobile apps — sign-in sessions are protected by the iOS Keychain and the Android Keystore, customer data is never saved on the device, and the Android app is excluded from backups and hides its preview in the recent-apps screen.
• Other safeguards — signed and verified webhooks from our payment and email providers, and rate limits on messaging and account changes.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell affected businesses and people without undue delay. Please keep your password safe and tell us straight away if you think your account has been compromised.

Your rights

Under UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data where there is no good reason for us to keep it.
• Restriction — ask us to pause using your data in certain circumstances.
• Portability — receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
• Objection — object to our use of your data based on legitimate interests. You can object to direct marketing at any time, and we will stop.
• Withdraw consent — where we rely on your consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
• Human review — not to be subject to decisions made solely by automated means that have legal or similarly significant effects on you (see Automated decisions and AI).

To use any of these rights, email info@generasoftware.com with your name and the right you want to use. We may need to confirm your identity first. There is normally no charge, and we will respond within 30 days.

If your data is held by a business that uses Genera, that business is responsible for your request, and you can also contact it directly. Pet owners can update some details, including notification settings, in their customer portal.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first, so please contact us.

Automated decisions and AI

• No solely automated significant decisions. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects on them.
• Rules set by businesses. Genera applies rules that a business chooses, for example automatically accepting bookings, requiring a Direct Debit before booking, applying cancellation fees under the business’s terms, activating or pausing memberships, optimising driver routes and flagging pets that have not visited for a while. We also pause a business’s Genera subscription if invoices remain unpaid after a grace period. If you disagree with an outcome, contact the business (or us, for our own billing) and a person will review it.
• AI. The Genera platform and apps do not use AI to make decisions about you. Our team may use Anthropic’s Claude to help analyse support tickets. Before a ticket is sent, names and contact details are removed and the text is scrubbed of personal details. Under Anthropic’s commercial terms, this data is not used to train its models.
• Business insights. We look at usage across each business account, such as bookings volume and growth, to understand how Genera is used and to support our customers. We do not profile people for advertising.

Children

Our services are designed for businesses and adults. They are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact us and we will delete it.

Links to other websites and apps

Our website and apps link to other services, such as social media, Apple Maps and Google Maps. Once you leave our services, their own privacy policies apply, and we are not responsible for how they handle your data.

Changes to this policy

We may update this policy from time to time, and the “last updated” date at the top will reflect any changes. If we make significant changes, we will take reasonable steps to let you know, for example by email or with a notice in Genera.

Contact us

For questions about this policy or your personal data, email info@generasoftware.com, or write to Genera Software Ltd, C/O Mjf Accountancy, 47 Booker Avenue, Liverpool, England, L18 4QZ.