Privacy Policy
Last updated: 13 November 2026 · Version 1.9
Adopt.me is operated and supported by BuxUp Limited. BuxUp Limited is a company registered in England and Wales, company number 05974418. Registered office: 318 Old Street, London, England, EC1V 9DR. Contact: contact@adopt.me. Official company record.
BuxUp Limited is the controller for personal information it determines how and why to process for adopt.me. This notice explains the current website and distinguishes demonstration activity from a separately configured live WordPress service. It is not a claim that all future integrations are already enabled or audited.
1. Information and purposes
| Information | Use and current scope | UK/EEA basis where personal data is processed |
|---|---|---|
| Device and request data, such as IP address, browser and security logs | Hosting, delivering pages, preventing abuse and investigating incidents. Hosting/network providers receive request data when serving the site. | Legitimate interests in a secure, reliable service; legal obligation where a specific obligation applies. |
| Enquiry, complaint and rights-request correspondence | Responding to messages sent to contact@adopt.me, verifying requests proportionately and maintaining records of resolution. | Steps requested before a contract or performance of a contract; legitimate interests in support and resolving complaints; legal obligation for statutory rights requests. |
| Consent and privacy choices | Remembering choices, applying optional-storage permissions and honouring sale/sharing or targeted-advertising opt-outs, including GPC. | Consent for optional storage/use; legal obligation and legitimate interests in respecting and evidencing privacy choices. |
| Language, currency and suggested-charity preferences | Used in page memory. Remembered in session storage only if Preferences is enabled. | Consent for optional persistence. Essential requested functions are addressed in the Cookies Policy. |
| Demo favourites, applications, comments, listings, orders, referrals and assistant messages | Simulated in this browser tab. No backend submission or real transaction is made by the demo. Use fictional information. Uploaded demo files are held in page memory and cleared on refresh/reset. | Requested functionality; no server-side adoption/order processing is performed by this demo. |
| Live account, application, listing, comment, order and referral records, if a separate WordPress service is enabled | Providing the requested service; sharing an application with its responsible shelter; publishing approved listing/comment information; fulfilling orders and meeting accounting duties. | Contract or requested pre-contract steps; legitimate interests for moderation, safety and fraud prevention; legal obligation for required records; separate consent where required. |
Do not put identity documents, precise home locations, financial account details, health information about people or other sensitive material into public fields. Animal health information can still identify people when linked to an owner. We do not need sensitive personal information for targeted advertising.
2. Public and private information
On a live service, approved animal listings, authorised photos and approved display names/comment text are public. Comment email addresses, detailed adopter profiles, applications and private messages must not appear in public catalogs. The optional adopter directory is limited to the fields you expressly choose to publish. Shelter access is limited to relevant applications and authorised staff. The public Agent Edition contains demonstration catalogs and no private browser-session activity or comments.
Demo submissions remain in the current tab, including pending comments. In the installable WordPress package, listing uploads may have directly accessible media URLs even before listing approval; do not upload sensitive material. Publishing or sharing material may allow others to copy it independently of us.
3. Optional tracking, sale/sharing and GPC
No analytics SDK, advertising pixel or social-media tracking embed is enabled by the adopt.me application in this release. We do not use the current app to sell personal information, share it for cross-context behavioural advertising, or conduct targeted advertising. Essential hosting/security services may still process request data.
You can reject optional storage without losing basic access. Privacy choices includes an independent Do Not Sell or Share My Personal Information and targeted-advertising opt-out. The controls recognise Global Privacy Control (GPC) and keep advertising blocked when it is active. This is not replaced by a cookie-only choice. Choices apply to this browser; email us for a request concerning records held elsewhere or to use an authorised agent. We do not treat the older Do Not Track signal as consent. California Privacy Protection Agency guidance.
4. Who receives information
Our hosting platform and necessary infrastructure/security providers deliver the website and process technical requests. The current demo is hosted through the ChatGPT Sites service; BuxUp Limited’s email provider processes correspondence you send to the contact address. We may use professional advisers or disclose information when lawfully required, to address fraud or safety issues, or in a business transfer with appropriate safeguards.
On a live deployment, relevant shelters/rehomers, contracted hosting and email providers, payment providers such as Stripe, delivery providers and requested care providers may receive information needed for the relevant service. Some act as processors under instructions; others, including independent shelters, charities or payment providers, may act as controllers for their own activities. The actual live supplier list and processing arrangements must be reviewed and disclosed before enabling them. WooCommerce stores order data on the merchant’s WordPress installation; no live Stripe session is created by this demo.
Clicking a map search, social-share button, provider link or charity website link sends the requested URL, title or search information to the destination service. Your browser may also disclose technical/referrer information under its settings. Their privacy notices apply there. We do not load third-party social embeds automatically.
5. International transfers
Hosting, correspondence or a provider you choose may involve processing outside your country. Where UK/EEA transfer rules apply, we use the appropriate lawful mechanism, such as an adequacy decision or approved contractual safeguards and any necessary supplementary measures. Contact us for information about a relevant transfer and the applicable safeguards. We will not assume that a provider’s country alone establishes compliance; live suppliers and transfer arrangements must be checked before activation.
6. How long information is kept
Demo activity stays in session storage until Reset demo activity, browser-session removal or expiry of the browser’s session; some browsers restore tabs. Optional preferences use the same session scope. Demo file uploads are held only in page memory. Consent records are treated as expired after 180 days and removed when the control next runs; the sale/sharing opt-out stays until you change it or clear site storage. The Cookies Policy lists the exact keys.
Enquiries are kept for the time reasonably needed to respond and resolve follow-up or disputes. Rights-request records are retained where necessary to demonstrate handling. Security records follow the relevant hosting provider’s justified retention settings. Legal, accounting or claim records may need longer retention. We review necessity rather than keeping information indefinitely by default. A live deployment must set and communicate category-specific periods before collecting real accounts, adoption applications or orders; this demonstration does not establish those production schedules. Ask us about a particular record.
7. Your privacy rights
Depending on the law that applies and its exceptions, you may request access, a copy, correction, deletion, restriction, portability or information about recipients and sources; object to processing based on legitimate interests; and withdraw consent without affecting earlier lawful processing. You can object to direct marketing at any time. We do not make solely automated decisions producing legal or similarly significant effects through this demo.
Send a request to contact@adopt.me, identify your request and provide enough information to locate the relevant record. Do not send identity documents unless proportionately requested through a suitable channel. We verify identity or an agent’s authority where appropriate, explain any lawful refusal or limitation and tell you how to challenge it. We do not require account creation merely to make an opt-out request and do not discriminate for exercising applicable rights.
For UK/EEA requests, we ordinarily respond within one month, with a permitted extension where necessary and notice of the reasons. ICO guidance on responding to access requests. Applicable US state laws may provide access, deletion, correction, portability, sale/sharing/targeted-ad opt-out and appeal rights, with different coverage thresholds, exemptions and response rules. We apply the deadline required for your request, ordinarily 45 days where that statutory period applies, and notify you of any permitted extension. California Attorney General’s CCPA guidance. A right’s availability is not identical in every US state. California residents may have additional rights regarding categories of information, disclosures and certain sensitive-information uses. We do not offer a financial-incentive programme for personal information.
You may complain to the UK Information Commissioner at ico.org.uk, your competent EEA supervisory authority, or the relevant US state regulator/Attorney General. You may also appeal a rights decision to us by email where your applicable law provides that route. Nothing requires you to contact us first before exercising a statutory complaint right.
8. Security, children and changes
We use proportionate technical and organisational safeguards and access controls, but no system is risk-free. Please report suspected exposure or abuse promptly. The service is not directed to children under 18 for account creation, applications or purchases. We do not knowingly seek children’s personal information for the demonstration; contact us if a child has submitted it so we can investigate and address it.
We update this notice when practices change, show the review date and seek fresh optional consent where needed for a new purpose. The current legal policies are in English; other website content may have translations. Questions: contact@adopt.me.
Contact form details
The hosted demonstration form prepares an email draft on your device. It does not submit the form fields to our server or save them in browser storage. You choose whether to send that draft through your email provider to contact@adopt.me.
On the WordPress version, submitting the contact form sends your name, reply email, enquiry topic, optional reference and message to BuxUp Limited’s email delivery service for delivery to contact@adopt.me. The form module does not keep a separate database copy of the message. Our mailbox and email provider may retain correspondence under the enquiry retention rules above. We use the details to answer your request and administer the service, relying on legitimate interests or, where applicable, steps you request before entering a contract or a legal obligation for rights requests. This is not marketing consent.
The WordPress form uses essential nonce and signed form tokens, a hidden spam-check field, and temporary keyed hashes of the request IP address and email address to limit repeated attempts. Rate counters and duplicate-submission markers expire after one hour. The form module does not retain the raw IP address in those counters; ordinary hosting logs may still record technical requests as described above.