Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how Raw & Well collects, uses, shares and protects Your personal data when You use our website and application (the “Service”), and describes Your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are (Data Controller)

The data controller responsible for Your personal data is:

  • Legal entity: A&H UNITED TRADING LTD, trading as “Raw & Well”
  • Company number: 16179988 (registered in England & Wales)
  • Registered address: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom
  • Data protection contact: contact@rawandwell.online
  • Support: support@rawandwell.online

2. What Data We Collect

  • Account data: email address and authentication identifiers (via Firebase Authentication).
  • Pet & nutrition data: information You enter about Your dog (name, weight, life stage, body condition, diet preferences, symptoms and generated meal plans) to provide the core functionality.
  • Device & usage data: IP address, browser and device type, pages visited, dates/times, and diagnostic data. Up to 3 registered devices per account (with last-active timestamps) are stored to enforce device limits.
  • Payment metadata: subscription status and a Stripe customer identifier. We do not store Your full card details — card data is handled directly by Stripe.

3. How We Use Your Data & Our Lawful Bases

  • To provide the Service (accounts, dog profiles, meal plans, symptom journal) — lawful basis: performance of a contract.
  • To process subscriptions and billing — lawful basis: performance of a contract.
  • To keep the Service secure (bot prevention, device-limit enforcement, fraud prevention) — lawful basis: legitimate interests.
  • To measure and improve the Service (analytics, session insights) — lawful basis: consent (via the cookie banner).
  • To meet legal and tax obligations — lawful basis: legal obligation.

4. Cookies & Tracking

We use strictly necessary cookies for the Service to function, and — only with Your consent — analytics cookies (Google Analytics 4) and product-insight tools (Microsoft Clarity). You can accept or decline non-essential cookies at any time using the Cookie Settings control in our footer. Full details of each cookie and tracker, its purpose and retention are set out in our Cookie Policy.

5. Third-Party Processors

We share personal data only with the processors below, each engaged under a data processing agreement:

  • Stripe Inc. (USA) — payment processing and recurring billing.
  • Google LLC / Firebase (USA) — authentication, database (Firestore), hosting and serverless functions storing account, dog, plan and symptom data.
  • Google LLC / Analytics (GA4, USA) — usage analytics (consent-gated).
  • Microsoft Corporation / Clarity (USA) — heatmaps and session insights (consent-gated).
  • Google LLC / reCAPTCHA Enterprise (USA) — bot and abuse prevention.
  • Functional Software Inc. / Sentry (USA) — error and crash diagnostics for authenticated app pages.
  • Google LLC / Fonts (USA) — web-font delivery.
  • Web3Forms (blog contact form only) — delivery of messages You choose to send us via the blog contact form.

6. International Transfers

Some processors above are based in the United States. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, together with the providers’ own safeguards, to ensure an equivalent level of protection.

7. Data Retention

  • Account, dog, plan and symptom data: retained while Your account is active and permanently deleted 30 days after a deletion request (see section 9).
  • Billing records: retained by Stripe for up to 7 years to meet UK tax and accounting obligations.
  • Analytics & diagnostics: GA4, Clarity and Sentry retain data according to their own default retention periods. This data is pseudonymous and not stored in an individually addressable form on our systems. To request erasure of analytics data associated with You, contact us and we will action it through the relevant provider’s tools.
  • Security/anti-abuse records (e.g. trial history): retained where necessary for fraud prevention.

8. Your Rights

Under UK GDPR You have the right to: access Your data; rectify inaccurate data; erase Your data; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing).

  • Access & portability: export all Your data as JSON from the Account page (“Export Data”).
  • Erasure: request account deletion from the Account page (30-day grace period, then permanent deletion).
  • Withdraw analytics consent: use the Cookie Settings control in the footer.
  • Other requests: email contact@rawandwell.online. We respond within one month.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling 0303 123 1113.

9. Data Deletion & Account Closure

When You request deletion, Your account is flagged and permanently purged after 30 days (dogs, weekly plans, symptom logs, authentication record and access data are deleted, and any active subscription is cancelled). You may cancel the request within the 30-day window. We retain Your Stripe customer record where required for tax, accounting and fraud-prevention purposes (a legitimate interest and legal obligation); it is not used for any other purpose after closure.

10. How We Protect Your Data

Clinical and health-related data is never persisted in browser storage in production — it is held in memory only, protected by our ClinicalStorageGuard, and cleared on logout. All data is transmitted over encrypted connections (TLS) and scoped to Your unique user identifier. We apply a strict Content-Security-Policy and modern security headers across the site.

11. Children’s Privacy

The Service is not directed at children and we do not knowingly collect personal data from anyone under 16. If You believe a child has provided us data, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date.

13. Contact Us

  • Data protection & privacy requests: contact@rawandwell.online
  • Support: support@rawandwell.online
  • Post: A&H UNITED TRADING LTD, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom
Back