Shipping & currency
Choose your shipping country or region. Your currency follows the country you pick.
Privacy
We collect what it takes to sell you a harness and get it to your door, whatever you choose to tell us about your dog, and, like almost every online store, data about how you use the site that goes to a short list of named companies for analytics and advertising. We never sell your details. You can see, correct or delete what we hold by emailing one address, wherever you live.
Below: what we collect and where it comes from, what we use it for, every company that sees it and why, the cookies and pixels by name with the switch to turn them off, how long we keep things, and your rights with the address to use them. The law where you live may give you more than this page; nothing here takes any of it away.
Every tracker named. And one address that answers, read by a person.
Ask about your dataRead the policy itselfFour sources. Most of it is the order; the rest is what you choose to tell us and what your browser sends.
Your name, email address, delivery address and phone number, what you ordered and when, and the notes you add. Messages to us by email, the contact form or chat. Reviews, with the name and photos you choose to post. Newsletter and SMS sign-ups. Ambassador and trade applications, which ask for your social handles, business details and how to pay you.
Breed, weight, age, birthday and what the dog does, when you give them in a size tool, a quiz, a form or an order note. We use them to recommend sizes and products. Health details belong in the ASK A VET app, which has its own privacy policy; the store does not ask for them.
Card numbers go straight to the payment provider (Shop Pay, PayPal, Apple Pay, Google Pay or the card processor in the checkout). We receive the payment method, the last four digits and whether it went through, never the full number. Login is by a one-time code sent to your email, so there is no password for us to store.
Device and browser type, IP address and approximate location, the pages you view, what you search for and add to the cart, and the ad or link that brought you here. Some of this goes to the analytics and advertising companies named below. A session replay tool records how visitors move through pages; the section on cookies says exactly what it sees and how to stop it.
Why
Six reasons, each with the data it needs and the legal basis the European rules ask us to name.
| Purpose | What we use | Legal basis |
|---|---|---|
| Taking, delivering and supporting your order | Name, address, phone, email, order contents, payment status, delivery scans | Performing our contract with you |
| Answering you | Your messages and the order they concern | Contract, and our legitimate interest in helping you |
| Recommending sizes and products | What you tell us about the dog, your orders | Legitimate interest, and consent where we ask for it |
| Sending marketing | Email address, phone number for SMS, what you have bought and looked at | Consent, or the existing-customer rule where the law allows it; every message has an unsubscribe |
| Measuring and advertising | Browsing and cart events sent to the analytics and advertising companies below | Consent where the law requires it; otherwise legitimate interest, with the switch on this page |
| Preventing fraud and meeting legal duties | Order, payment and device data; tax and accounting records | Legal obligation, and legitimate interest in running a safe store |
By name
Every company that receives personal data from woopf.com, what it does for us, and what it gets. Each works under a contract that limits it to our instructions.
| Who | What they do for us | What they receive |
|---|---|---|
| Shopify | Runs the store, the checkout, customer accounts and Shop Pay; hosts the data | Everything in your account and orders; stored on Shopify's systems in North America |
| Payment providers: Shop Pay, PayPal, Apple Pay, Google Pay and the card processor | Take the payment | Your card or wallet details, which we never see, and the order amount |
| Our warehouse in Shenzhen and the carriers | Pack, ship and deliver | Name, address, phone number and what is in the parcel, which customs may also see |
| Klaviyo | Sends our email and SMS marketing and tracks what subscribers open and browse | Email, phone number if you gave it, orders, pages viewed on the site |
| Zendesk | Runs the chat and support inbox | Your name, email and what you write to us |
| Judge.me | Collects and displays reviews | Your name, email, order and the review and photos you post; the review is public |
| Lucky Orange | Heatmaps and session replay, so we can see where the site confuses people | Mouse movement, clicks, scrolling and page views; text typed into forms is masked; the payment page is not recorded |
| Analytics and advertising measurement through Tag Manager | Browsing and purchase events tied to a cookie | |
| hCaptcha or Google reCAPTCHA | The anti-bot check on the login, contact and review forms | The device signals needed to tell people from bots |
| Meta (Facebook and Instagram) | Measures our ads and shows you our ads on its platforms | Browsing and purchase events from the pixel and, server to server, from the checkout, matched to your Meta account where you have one |
| TikTok | Measures our ads and shows you our ads on TikTok | Browsing and purchase events from the pixel |
| Social Snowball | Runs the ambassador programme | Ambassadors' names, emails, payout details and referral sales; nothing about ordinary customers beyond the code they used |
| SparkLayer | Runs trade accounts for clinics and retailers | Trade customers' business details, contacts and orders |
Your rights
The law that gives you these rights depends on where you are. We do not make you work out which one applies; everyone gets all of them.
Ask what we hold about you and get a copy in a usable format. Your orders and details are also in your account at woopf.com/account.
Correct anything wrong, or ask us to delete your data. We delete everything except what tax and accounting law makes us keep, and we tell the companies above to do the same.
Object to marketing or profiling, withdraw a consent you gave, restrict what we do while a dispute is sorted out, and complain to the privacy regulator where you live if we get it wrong. Email hello@woopf.com with “Privacy” in the subject; we answer within thirty days, and usually far sooner.
Settings, Policies, Privacy policy
This is the text that lives at woopf.com/policies/privacy-policy and is linked from the checkout, the footer and the account pages. It is the same as the page above, in the order a policy needs.
Effective 22 September 2026.
woopf.com is operated by Australian Premium Animal Products Ltd, Office B3, 12/F, Causeway Bay Commercial Building, Causeway Bay, Hong Kong ("WOOPF™", "we"). We are the data controller for the personal data described in this policy. The same company runs PURRZ™ and ASK A VET™; each has its own privacy policy, and section 13 explains how the brands relate. Questions and requests: hello@woopf.com with "Privacy" in the subject.
We collect what we need to take, deliver and support your order, what you choose to tell us about yourself and your dog, and data about how you use the site. We share it only with the companies that help us run the store, listed by name in section 5. We never sell it. We keep order records for as long as tax law requires and the rest for as long as it is useful, with the periods in section 9. You can see, correct, delete or take your data, object to marketing and withdraw consent by emailing us, wherever you live.
From you: name, email address, delivery and billing address, phone number, the contents and history of your orders, order notes, messages you send us by email, form or chat, reviews and the photos in them, newsletter and SMS sign-ups, and the details you give in ambassador or trade applications. About your dog, when you give them: breed, weight, age, birthday and behaviour, used to recommend sizes and products. From your browser and device, automatically: IP address and approximate location, device and browser type, the pages you view, searches, cart and checkout events, and the referring ad or link, collected through the cookies and pixels in section 7, plus session replay of how visitors move through pages. From others: payment providers confirm whether a payment succeeded and give us the payment method and last four digits; carriers give us delivery scans; advertising platforms tell us which ad brought you; Shopify provides the account you log in with. We do not receive or store full card numbers, and we do not store passwords, because login is by a one-time code sent to your email.
To take, deliver and support your order and answer your messages (performance of our contract with you). To recommend sizes and products from what you tell us about your dog and what you have bought (our legitimate interest in running a useful store, and your consent where we ask for it). To send email and, if you opt in, SMS marketing (your consent, or the existing-customer rule where the law allows it; every message has an unsubscribe link, and section 8 has the detail). To measure how the site and our advertising perform and to show you our advertising on other platforms (your consent where the law requires it, otherwise our legitimate interest, with the choices in section 7). To prevent fraud, keep the store secure and keep the records the law requires (legal obligation and legitimate interest). We do not make decisions about you by automated means that have legal or similarly significant effects.
Shopify Inc., which runs the store, checkout, customer accounts, Shop Pay and analytics and hosts our data. Payment providers: Shop Pay, PayPal, Apple Pay, Google Pay and the card processor, which receive your payment details directly. Our warehouse in Shenzhen, China, and the carriers that deliver, which receive your name, address, phone number and the contents of the parcel; customs authorities may see the same. Klaviyo (email and SMS marketing, and on-site tracking of subscribers). Zendesk (chat and support). Judge.me (reviews). Lucky Orange (heatmaps and session replay). Google (Analytics, Ads and Tag Manager for measurement and advertising). hCaptcha and Google reCAPTCHA (the anti-bot check on forms). Meta Platforms (the Meta pixel and Conversions API for advertising measurement and audiences on Facebook and Instagram). TikTok (the TikTok pixel, for the same purpose on TikTok). Social Snowball (the ambassador programme). SparkLayer (trade accounts). Professional advisers, and authorities where the law requires disclosure. If the business is sold or merged, your data goes with it under this policy. Each service provider acts under a contract that limits it to our instructions; the advertising platforms also use the data they receive for their own purposes under their own policies. We do not sell personal data for money. Advertising pixels do share browsing data with Meta, Google and TikTok, which some laws treat as "sharing" or a "sale"; section 7 says how to stop it.
We are in Hong Kong, our warehouse is in mainland China, Shopify stores our data in North America, and the other companies in section 5 process data in the United States and the European Union. Where data leaves the country you are in, we rely on the transfer safeguards the law provides, including standard contractual clauses in our contracts with providers, and on the protections in this policy.
Essential: Shopify's cookies for the cart, login, country and currency, security and fraud prevention, and the anti-bot check (hCaptcha or Google reCAPTCHA) on forms. These cannot be switched off. Analytics: Shopify analytics, Google Analytics, Judge.me and Lucky Orange, which records mouse movement, clicks, scrolling and page views to show us where the site confuses people; text typed into forms is masked and the payment page is not recorded. Advertising: the Meta pixel and Conversions API, the TikTok pixel, Google Ads tags and Klaviyo on-site tracking, which measure our advertising and let us show our ads to people who visited the store. Your choices: in the European Economic Area, the United Kingdom and Switzerland a cookie banner asks before analytics and advertising cookies are set, and you can change your answer from the footer; in California and other US states with a right to opt out of sale or sharing, the "Do not sell or share my personal information" link in the footer does that, and a Global Privacy Control signal from your browser is treated the same way; everywhere, your browser can block or delete cookies, and Meta, Google and TikTok each offer ad settings of their own. We do not respond to browser Do Not Track signals, because there is no agreed standard for them.
We send email marketing to people who subscribe or who buy from us and do not opt out, and SMS only to people who opt in to it separately. Every email and SMS has an unsubscribe route, and you can also email us to stop. Opting out of marketing does not stop order and delivery emails. We do not currently upload customer lists to advertising platforms to build audiences; if that changes, this section will say so first.
Order, payment and invoice records: seven years after the order, because tax and accounting law requires it. Your account: until you ask us to delete it. Messages and chat transcripts: two years after the last message. Marketing profiles: until you unsubscribe or two years after you last opened or clicked, whichever is first. Reviews: while the product is sold, or until you ask for yours to be removed. Session replay recordings: thirty days. Analytics data: up to fourteen months in identifiable form, aggregated after that.
Payments are processed by PCI DSS compliant providers and we never hold full card numbers. Login is by one-time code, so there is no password to steal. Access to customer data inside the business is limited to the people who need it to serve you. Every provider in section 5 is bound by contract to protect what it receives. No method of transmission or storage is perfectly secure; if a breach ever affects your data, we will tell you and the regulator as the law requires.
Wherever you live, you can ask us what personal data we hold about you and receive a copy in a portable format; have it corrected; have it deleted, except what tax and accounting law makes us keep; object to marketing or to processing based on legitimate interest; restrict processing while a complaint is resolved; withdraw a consent at any time; and opt out of the sharing described in section 7. Your orders and account details are also visible at woopf.com/account. Email hello@woopf.com with "Privacy" in the subject, or write to the address in section 1. We may ask you to confirm your identity, usually by replying from the email address on the account. We answer within thirty days. We will never treat you differently for using these rights. If you are unhappy with our answer, you can complain to the privacy regulator where you live: in Hong Kong the Office of the Privacy Commissioner for Personal Data, in Australia the OAIC, in the United Kingdom the ICO, in the European Union your national data protection authority, and in California the Attorney General or the California Privacy Protection Agency.
The store is for adults. We do not knowingly collect personal data from anyone under sixteen, and we delete it if we learn we have.
What you tell us about your dog is used to recommend sizes and products and is kept with your customer record; it is not health data and we do not treat it as such. Health records, medical history and anything you tell a vet belong in the ASK A VET™ app, which has its own privacy policy and is where the Smart ID Tag and the GPS tracker create their profiles when you activate them. WOOPF™, PURRZ™ and ASK A VET™ are run by the same company. We do not use your WOOPF™ details to market PURRZ™ or ASK A VET™ to you unless you have opted in to hear from them, and each brand's list is kept separate.
When this policy changes in a way that matters, we email account holders and subscribers before the change takes effect and update the effective date above; small corrections are made on the page. Questions, requests and complaints: hello@woopf.com with "Privacy" in the subject, the contact form at woopf.com/pages/contact, or post to Australian Premium Animal Products Ltd, Office B3, 12/F, Causeway Bay Commercial Building, Causeway Bay, Hong Kong.
Dr Duncan, Bridie and KikoFrom Dr Duncan
A dog store needs your address to deliver a bed and your email to say it has shipped. Everything past that is a choice, and I want you to see the choices rather than find them in a 5,000-word template that also claimed, until this week, to collect passport numbers. So the companies that see your data are named, including the ad pixels every store runs and the session replay tool we use to find out why people give up on a page. If you want them off, the switch is on this page, and I would rather lose the retargeting than lose the trust. The one place I do want data is the ASK A VET app, where your dog's weight, vaccinations and symptoms can make a vet more useful to you. That is a separate promise, made in a separate policy, and it is yours to opt into.
Dr Duncan Houston, emergency veterinarian and founder of WOOPF™
Meet Dr DuncanQUESTIONS, ANSWERED
The short answers; the policy above is what applies.
No. Nobody pays us for your details and we do not rent lists. The advertising pixels do share browsing data with Meta, Google and TikTok, which some laws treat as “sharing”; the switches in the cookies section and the footer link turn that off.
The carriers do. International parcels move faster with a phone number on the label, and customs and the local courier use it when something needs checking. We do not call you about anything else, and we only text you if you opted in to SMS.
Lucky Orange records how visitors move through pages: mouse, clicks, scrolling, which pages. Text typed into forms is masked and the payment page is not recorded. We use it to find the places people give up. The cookie banner where it appears, the footer's opt-out link in the United States, or your browser's cookie settings stop it.
Not for marketing unless you opt in to hear from them. The three brands are run by the same company, but each brand's list is kept separate. If you activate a Smart ID Tag or GPS tracker, the profile you create lives in the ASK A VET app under its own policy.
Email hello@woopf.com with “Privacy” in the subject from the address on the account. We delete your account, your marketing profile and your messages, and tell the companies in the policy to do the same. Order and invoice records stay for seven years because tax law requires it, and nothing else.
They are never with us. Card numbers go to the payment provider and we see the method and the last four digits. Login is by a one-time code to your email, so there is no password to lose either.
You can browse and use the size tools without an account. To buy, we need a delivery address, an email for the order updates and a phone number for the carrier, and checkout works as a guest. The pixels can be switched off first if you prefer.
ASK A VET
Weight, vaccinations, medications, symptoms and the vet conversations about them belong in the ASK A VET app, under its own privacy policy, shared with a vet when you choose to. The store keeps your address and your dog's size; the app keeps the health record. That separation is the point.
Read about ASK A VET
