Effective Date: September 9, 2026
Last updated: September 9, 2026
Wali LLC, a Missouri limited liability company
This Privacy Policy describes how Wali LLC ("Wali," "we," "us") collects, uses, shares, and protects personal information in connection with the Wali platform and website (the "Service"). It forms part of our Terms of Service.
The Service is offered in the United States. By using it, you consent to the practices described here.
Payment card details are collected and processed by Stripe, Inc. and are not received or stored by us. We retain subscription status, billing dates, the record of your consent to subscription terms, and the last four digits of your card.
We do not collect Social Security or government identification numbers, information about any human being's health, or precise geolocation. We do not knowingly collect personal information from children under 13.
We use personal information to operate and secure the Service; to authenticate you; to store, organize, and display your records; to extract information from documents you upload; to enable links you choose to share; to display dates on your local calendar; to process payments; to send transactional email; to send marketing email where you have opted in; to improve and troubleshoot the Service; to enforce our Terms; and to comply with law.
When you upload a document image, its contents are transmitted to artificial intelligence services operated by a third party in order to extract information for your records. We disclose those services by name below.
| Service | Operator | Purpose | Terms |
|---|---|---|---|
| Google Cloud Vision API | Google LLC | Reads text from your uploaded document image | Privacy Policy · Cloud Data Processing Addendum |
| Google Gemini API | Google LLC | Converts that extracted text into record fields | Privacy Policy · Gemini API Additional Terms |
Google Cloud Vision is used under Google Cloud's terms and Google's Cloud Data Processing Addendum. Google Gemini is used on Google's paid service tier. Under both, Google does not use the content we submit to train or improve its models, to publish it, or to disclose it to others. We do not use Google's unpaid AI tier for document processing, because that tier permits the provider to use submitted content to develop its products and permits human review of it.
Only the text extracted from your document is sent to the Gemini API. The document image is not, and neither is your name, email address, or account identifier.
Wali does not use your documents or your pets' records to train any artificial intelligence model of our own.
Failure to disclose the transmission of personal information to third-party AI services may constitute a material misrepresentation under state consumer protection law, including the Missouri Merchandising Practices Act. This section is provided so that you have complete information about how documents you upload are processed.
We disclose information to any person to whom you issue a shared link, in the scope you select.
We disclose information to service providers who process it on our behalf, under agreements requiring them to protect it and use it only for the purposes we specify:
| Provider | Function |
|---|---|
| Supabase, Inc. | Database, file storage, authentication |
| Vercel, Inc. | Application hosting and content delivery |
| Stripe, Inc. | Payment and subscription processing |
| Google LLC | Document processing (see Section 3) |
| Brevo (Sendinblue SAS) | Transactional and marketing email. Privacy Policy |
| PostHog, Inc. | Product analytics and session replay within the application |
| Google LLC (Analytics 4) and Microsoft Corporation (Clarity) | Website analytics |
We do not sell, rent, or trade personal information or pet records, and we do not share personal information for cross-context behavioral advertising.
We may disclose information where we believe in good faith it is necessary to comply with law, regulation, or legal process; to enforce our agreements; to protect the rights, property, or safety of Wali, our users, or the public; or to detect or address fraud or security issues.
If Wali is acquired or merged, or if substantially all of its assets are transferred, personal information may transfer as part of that transaction. We will give notice to the extent required by law before information becomes subject to a different privacy policy.
Information is stored in the United States on infrastructure operated by Supabase, Inc. and Amazon Web Services, with encryption in transit and at rest.
Access to records is restricted at the database level so that an account may reach only its own data. Requests affecting billing information or a subscription are authorized against the authenticated session and cannot be directed to another account. Document images are held in private storage that is not publicly reachable by URL and are never included in a shared link.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Contact us at hello@thewalipet.com if you believe your account has been compromised.
A cookie is a small text file a website stores in your browser. Similar technologies include local storage, which keeps information in your browser without sending it back on every request, and pixels or tags, which record that a page was loaded.
We use them for three purposes only: to keep you signed in, to remember your settings, and to understand how the Service is used so we can improve it. We do not use cookies for advertising. We run no ad networks on the Service, we do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
These make the Service work and cannot be switched off, because without them you cannot sign in, stay signed in, or complete a purchase. They are not used for analytics.
| Set by | What it does | Typical duration |
|---|---|---|
| Wali / Supabase (authentication) | Keeps you signed in and protects your session. Stored in your browser's local storage rather than as a cookie. | Until you sign out or the session expires |
| Stripe | Fraud prevention and secure processing on checkout and billing pages. | Session to 1 year, depending on the cookie |
| Webflow | Delivers and displays the marketing site correctly. | Session |
These tell us which pages and features people use, where they run into trouble, and what is broken. You can turn them off. See Section 6.5.
| Service | Operator | What it does | Typical duration |
|---|---|---|---|
| Google Analytics 4 | Google LLC | Counts visits and page views on the marketing site and reports them in aggregate. Privacy Policy | Up to 2 years |
| Microsoft Clarity | Microsoft Corporation | Heatmaps and aggregate behavior on the marketing site. Privacy Statement | 1 day to 1 year |
| PostHog | PostHog, Inc. | Product analytics and session replay inside the application. Privacy Policy | Up to 1 year |
These services are operated by the companies named above and are subject to their own privacy policies, which we link. We do not permit them to use information collected through the Service to build advertising profiles about you.
PostHog records session replays, which reconstruct interactions with the interface so we can find defects. Replay is configured to mask sensitive content: document images, text extracted from them, record content displayed on screen, and anything typed into a form are hidden and are not captured. Browser console output is not captured. Masking applies in every region whenever replay is running.
If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics and session replay stay off until you affirmatively consent, and remain off if you decline. Strictly necessary technologies run either way, because the Service cannot function without them.
Everywhere else, analytics are on by default and you may turn them off at any time. In the application, open account settings and use the "Product analytics" control. Turning it off stops product analytics and session replay for your account.
Browser and service-level controls. Most browsers let you block or delete cookies in their settings, though blocking strictly necessary cookies will prevent you from signing in. Google offers a Google Analytics opt-out browser add-on that works across every site you visit. Where your browser sends a Global Privacy Control signal, we treat it as a request to opt out of analytics for that browser.
Do Not Track. Browsers send this signal inconsistently and no common standard governs how a site should respond, so we do not respond to it. We honor the Global Privacy Control signal and the account setting described above instead.
A link you generate contains a randomly generated identifier and may be opened by any person holding it, without an account.
A vaccination certificate link displays your pet's name, vaccine type, administration date, and status. It does not display your name, email address, postal address, or telephone number. A certificate reports status as a matter of fact and does not recommend any action.
A link showing more than vaccination status carries an expiration date you select and expires at the end of that day in the time zone in which it was created. We do not issue permanent links of that kind.
You may deactivate any link at any time from your account.
Transactional email. We send account notices, periodic reminders before a vaccine expires, notice before a free trial ends, notice at least 15 days before an annual renewal, notice in advance of deletion of stored document images, and billing confirmations. You cannot opt out of transactional email while your account is active, but you may control record reminders from your notification settings.
Marketing email. Sent only where you have opted in. Every marketing message identifies itself, includes our valid postal address, and includes a working unsubscribe link. We honor unsubscribe requests within 10 business days as required by the CAN-SPAM Act, 15 U.S.C. § 7701 et seq.
We retain personal information and pet records while your account is active. On deletion of your account we delete them within 30 days, except information we must retain by law, information necessary to resolve a dispute or enforce an agreement, and anonymized or aggregated data that does not identify you.
Storage of document images is a paid feature. If a paid subscription ends, the account is downgraded rather than deleted, and uploaded document images are retained for 30 days and then permanently deleted unless the subscription is renewed. We give notice by email in advance of that deletion. Record data already saved to a pet's profile remains in the account.
The rights below are available to every user. Section 10.1 sets out additional rights we extend to all United States residents.
Access and correction. You may view and correct your information from account settings, or contact us for assistance.
Deletion. You may delete your account and all associated records at any time from account settings.
Portability. You may download your account information, pets, and records at any time from account settings using the "Download my data" control. No request or waiting period is required. For another format, contact us and we will fulfill verified requests within 30 days.
A number of states, including California, have enacted consumer privacy statutes granting residents specific rights. Whether a given statute applies to a business depends on its size and activities, and the statutes differ from one another. Rather than extend different rights to different residents, Wali extends the following rights to every resident of the United States, regardless of the state you live in and regardless of whether a statute requires it of us.
You have the right to:
How to make a request. Most of these can be exercised directly in your account settings without contacting us. Otherwise, email hello@thewalipet.com with the subject line "Privacy Request." We will verify that the request comes from you, or from an authorized agent acting on your behalf with your written permission, by confirming control of the email address on the account. We respond within 45 days and may extend once by a further 45 days where reasonably necessary, in which case we will tell you before the first period ends. There is no charge for a request unless it is manifestly unfounded or excessive.
If you are a resident of a state whose statute affords you a right not listed above, that right is available to you and you may exercise it by the same method.
Missouri has not enacted a comprehensive consumer data privacy statute. The rights in Section 10.1 are available to you regardless. Mo. Rev. Stat. § 407.1500 requires notification of a security breach involving personal information; see Section 11.
We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use or disclose sensitive personal information for any purpose other than providing the Service. We do not use personal information to train artificial intelligence models.
If a security breach results, or is reasonably believed to have resulted, in unauthorized access to unencrypted personal information of Missouri residents, we will notify affected individuals in accordance with Mo. Rev. Stat. § 407.1500, in the most expedient time possible and without unreasonable delay, and in any event no later than 60 days after discovery, unless law enforcement requests a delay. Notice will be given by email to the address on file and, where required, to the Missouri Attorney General. Where a breach affects more than 1,000 Missouri residents, we will also notify consumer reporting agencies as required by law.
The Service is not directed to children under 13 and we do not knowingly collect their personal information. If we learn we have, we will delete it promptly. Users under 18 may use the Service only with the involvement and consent of a parent or legal guardian.
This Policy does not apply to any third-party website or service linked from the Service. We are not responsible for their practices.
We may update this Policy. We will give at least 30 days' notice by email of any material change. Continued use after the effective date constitutes acceptance.
Questions about this Policy, or a request under Section 10, may be sent to:
Wali LLC
10685-B Hazelhurst Dr.
Houston, TX 77043
hello@thewalipet.com
thewalipet.com
Related documents: Terms of Service · Veterinary Disclaimer.
.svg){kind=icon}
