Privacy policy

AlpacaKeep is operated by Devid Demetz, a natural person based in South Tyrol, Italy. This notice explains what personal data we collect when you use the service or our marketing site, why we collect it, and the rights you have under EU data-protection law and, if you are in the United Kingdom, under UK data-protection law. If you are in New Zealand or Australia, Sections 7, 9 and 11 also explain how we meet the privacy law there.

1. Data controller

The data controller within the meaning of the GDPR is:

Devid Demetz
Larciunei 46, 39048 Selva di Val Gardena (BZ), Italy
Email: privacy@alpacakeep.com

A Data Protection Officer has not been appointed. Under GDPR Art. 37 designation is mandatory only for public authorities, organisations whose core activities involve large-scale systematic monitoring of data subjects, or large-scale processing of special-category data - none of which applies here. For visitors resident in Germany, BDSG §38(1) sentence 1 additionally requires a DPO when at least 20 persons are constantly engaged in automated processing of personal data; the operator is well below that threshold (sole proprietor, no employees). Data-protection questions can be addressed directly to the controller using the contact details above.

For the New Zealand Privacy Act 2020, our privacy officer is Devid Demetz, at the email address above.

1a. Our role: controller and processor

For your account and login, billing and the records of a paid subscription, the withdrawal and cancellation declarations you send us, support correspondence, the newsletter the buyer inquiries we collect through public sale pages and the address, phone number and contact person's name a farm's owner chooses to show on its public farm page, we are the data controller and this notice describes what we do.

For the farm records you enter into the service - animals, events, breeding records, photos, financial entries, documents and your address book of contacts - you (or the farm you belong to) are the data controller and we act only as a data processor on your instructions, under GDPR Art. 28. One consequence matters in practice: where you record another person's details, for example a vet, buyer or supplier in your contacts, you are responsible for informing them as GDPR Art. 14 requires. We process that content solely to provide the service to you.

When you ask us for help, a person who manages your farm's team can give AlpacaKeep support access to it for a limited time and with a level you choose. We use it only for what you asked, it ends by itself on the date shown, anyone who manages your team can end it earlier, and everything we do is shown in your activity log under "AlpacaKeep support". We can ask for access, but we never enter a farm until someone there allows it. This too is part of providing the service to you, under the Data Processing Agreement (Section 3).

Our Data Processing Agreement governs that processing, including confidentiality, security, assistance, deletion and the use of sub-processors.

2. Data we collect

We collect the following categories of personal data:

Account data: Email address, name, locale preference, and hashed password - provided at registration. If you subscribe to a paid plan, we also keep a record of the request you tick just before checkout (that your plan starts during the 14-day withdrawal period), in the words you were shown, with the plan, the date and time, and the version of the Terms, and we email you a confirmation of the contract.
Google Sign-In (optional): If you choose to sign in with Google, we receive your email address and display name from your Google account instead of a password; no password is stored for Google-only accounts. These fields are stored exactly like password-based account data. See Sections 6 and 7.
Farm data: Animals, events, breeding records, photos, financial entries, and any other content you enter into the service.
Newsletter signups: Your email address and language, the page you signed up on, which consent wording you were shown, and the time, IP address and browser user-agent of your signup. Since October 2026 every new signup has to be confirmed with the button in the email we send you, and we also store the time, IP address and browser user-agent of that confirmation. Together these are our proof of your consent under GDPR Art. 7(1).
Technical and log data: IP address, user-agent string, and request timestamps - collected for security monitoring, abuse prevention and running the service, including seeing how many requests each page receives. When you send a buyer inquiry we also store a one-way fingerprint of your IP address (a salted hash that cannot be turned back into the address), used only to rate-limit repeated submissions - never to identify or track you. The public newsletter and list-for-sale forms compute the same kind of fingerprint only if their hidden anti-bot trap is triggered. If you create an account we store the country you select, because registration is currently open in some countries only. If you send us feedback from inside the product we store your message together with the page you were on. If you send us a withdrawal or cancellation declaration through the forms linked at the foot of every page, with or without an account, we store your name, your email address, the contract details and any reason you give, and the date and time we received it, and email you a receipt; with it we store the same kind of one-way IP fingerprint, used only to limit repeated submissions.
Cookies: Essential authentication and session cookies set by Supabase Auth, plus one first-party marker cookie (ak-session) that only records whether a session exists - see Section 12 for details.
Buyer inquiries: If you contact a seller through a public sale or breeder page, we collect the name, email address and message you enter and, if you give it, your phone number, and a one-way fingerprint derived from your IP address (used only to rate-limit abuse). You do not need an account to send an inquiry. If the farm is in Australia, the form asks you to agree before your inquiry is sent there (Section 7).
Beta access requests: If you ask for access to the private beta with the form on our early-access page, we collect your name, email address, farm name (or town) and country, a website or social page if you give one, the size of your herd (as a range), where you keep your records today, the note you add if you write one, the language of the page and which page you came from. The request is sent by email to our contact mailbox (mailbox.org) and is not stored in our database. We also send you one email to confirm that we received it.
Contact details on a public farm page: A farm's address and phone number appear on its public farm page only if the farm's owner switches them on, and the owner can switch either off again at any time. The owner can also give the first name of a contact person (for example on a "Write to Anna" button), which appears only while the owner keeps it filled in and can be removed at any time. When the phone number is switched on, the page shows a Show phone number button instead of the number. If you press it, we send you the number and store a one-way fingerprint of your IP address (a salted hash that cannot be turned back into the address; the address itself is not stored) together with the farm and the time. We use it only to limit how often numbers can be requested (at most 10 per visitor in 24 hours), so that the button cannot be used to collect farmers' phone numbers in bulk, never to identify or track you. This rests on our legitimate interest in preventing abuse (Art. 6(1)(f)), and the fingerprint is deleted after about 30 days (Sections 5 and 8). You do not need an account to see a number.
AI certificate readings (optional): When you choose Add from a document, the selected certificate image or PDF, animal and ancestor identifiers, breeder details, the reading instructions and the proposed result are processed. We do not send account credentials or unrelated farm records.
Questions to Ask your herd (optional, closed test): If your farm takes part in the closed test of Ask your herd, we process the question you type, the answer as it is shown to you, the sources it cites and which lookups were made to answer it. To answer, the AI looks up your farm's records: animal names and identifiers, sex, dates of birth, weights, body condition scores, fibre results, breeding and births, health events and medications given, tasks, and labels your farm typed, such as task titles and paddock names; for the Owner and Co-Owners also totals of income and expenses by category. It is never sent notes, contacts, details of buyers or vets, email addresses, documents, photos or account credentials. Under each answer you can say whether it was right and, if not, why; we count these ratings for each version of our instructions to the AI without reading the questions. We read the questions asked on a farm and their answers only if the farm's Owner or a Co-Owner has allowed it on the Ask page, and only those asked since then (Sections 4 and 5). Otherwise our own tools show us only technical details, such as when a question was asked, whether it worked, which AI model answered, how long it took and what it cost. See also Sections 6, 7 and 8.

3. How and where data is processed

Primary application data is encrypted in transit (TLS) and at rest and stored on Supabase infrastructure in Frankfurt. The named sub-processors in Section 6 may perform the limited processing described there. Two optional AI features run through Anthropic's Claude API: certificate reading, which happens only when you request it, and Ask your herd, which is open only to farms in its closed test and runs only when a member asks a question. Their processing is not confined to the EU (the data is stored in the United States) and does not provide EU residency; details and safeguards are in Sections 6 and 7.

We implement reasonable technical and organisational measures to protect personal data in accordance with GDPR Art. 32. No security system can guarantee complete protection against all possible threats.

4. Purposes of processing

We process personal data for the following purposes:

Providing the service - managing accounts, farm records, and sharing within a farm workspace.
Communicating with users about the service - transactional emails and support replies.
Newsletter: a few emails a year with news about AlpacaKeep, such as new features, the launch and offers, sent only to people who signed up for it; you can unsubscribe at any time.
Security, fraud and abuse prevention, and compliance with legal obligations, such as confirming a paid contract and receiving, confirming and carrying out withdrawals and cancellations.
Reading a certificate with AI, only when an authorised user requests it, to prepare a draft pedigree that the user must check before anything is saved.
Handling reports about content published through the service, and our decisions on them (notice and action under the Digital Services Act): the report, the decision, the reasons we send and the dates.
Answering your request for access to the private beta and sending you an invitation.
Answering questions about your herd with AI (Ask your herd), only for farms in its closed test and only when an authorised member asks: the AI looks up the farm records it needs and writes an answer; for questions about feeding and care it may first search public websites, with searches built only from the question and the farm's country.
Improving Ask your herd, only where the farm has allowed it: reading the questions asked on the farm and their answers, to find wrong answers and fix our instructions to the AI and the way it looks up records. The farm's Owner or a Co-Owner decides this for the whole farm on the Ask page; it covers the questions of everyone on the farm from then on, and the others on the farm are told in the app. We see them without the asker's name or email address and without the farm's name, but a question and its answer can still contain details of a farm, such as animal names, so they are not anonymous. We never use them to train AI models, never pass them on or sell them, and never use them to contact or judge a farm.

5. Legal basis (GDPR Art. 6)

We rely on the following legal bases for processing:

Contract and documented instructions (Art. 6(1)(b) and Art. 28) - Account and service administration is necessary to provide the requested service. For farm content, the farm is the controller, chooses its Art. 6 legal basis and instructs AlpacaKeep under the Data Processing Agreement. The records consumer law requires us to keep or send for a paid subscription (the request you tick before checkout, the contract confirmation, withdrawal and cancellation declarations and their receipts) are processed to comply with a legal obligation (Art. 6(1)(c)).
Consent (Art. 6(1)(a)) - Newsletter subscription. You may withdraw consent at any time without affecting the lawfulness of prior processing.
Legitimate interest (Art. 6(1)(f)) - Security monitoring, abuse prevention, ensuring the integrity of the service, and seeing how many requests each page receives (from our hosting request logs). This includes the IP fingerprint stored with a withdrawal or cancellation declaration and the one stored when someone presses Show phone number on a farm page. It also covers showing a farm's address, phone number and contact person's name on its public page, which we do only because the farm's owner chose to publish them.
Legitimate interest (Art. 6(1)(f)) - Buyer inquiries. When you send an inquiry, we pass your name, email address, message and, if you give it, your phone number to the farm you chose, and keep the conversation so that you and the farm can continue it. We do this because you ask us to: it rests on our legitimate interest in delivering the messages buyers send through the service, together with your own interest in reaching the farm (Art. 6(1)(f)). There is no consent box for the inquiry itself, because an inquiry cannot be delivered without these details; the form says where they go, under the Send button. The one exception is a farm in a country whose privacy law the EU and the UK have not recognised as adequate, today Australia: there the form asks you to agree to your details being sent to that country (Art. 49(1)(a), Section 7). That agreement covers only the transfer; the basis for handling your inquiry stays the same. You can object at any time (Section 9) and ask us to delete an inquiry (Section 8). The farm that receives it handles your details as a controller in its own right (Section 6). The IP fingerprint that accompanies it is processed under legitimate interest (Art. 6(1)(f)) for abuse prevention.
Steps before a contract (Art. 6(1)(b)) - Beta access requests. We use the details you send to answer your request and, when there is a place for your farm, to send you an invitation. These are steps taken at your request before entering into a contract (Art. 6(1)(b)). If you also tick the box for AlpacaKeep news, that part rests on your consent (Art. 6(1)(a)) and is handled like a newsletter signup.
Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) - Handling reports about published content, and sending our decisions with their reasons, is required by the Digital Services Act (Art. 6(1)(c)). Keeping the record of those decisions, so that we can answer a later challenge or claim, rests on our legitimate interest (Art. 6(1)(f)). We tell the person whose content is concerned who reported it only where that is strictly necessary.
The farm's permission (Data Processing Agreement, Section 3b) - Reading the questions asked on a farm and their answers (Section 4), when the farm's Owner or a Co-Owner has allowed it on the Ask page. It is voluntary and separate from using Ask your herd: saying no, or not deciding, changes nothing else. The Owner or a Co-Owner can withdraw it at any time and as easily as it was given: switch off Share this farm's questions on the Ask page, and reading stops at once; it can also be withdrawn by writing to us. Withdrawing does not make earlier reading unlawful. For this use we are the controller, not the farm's processor (Data Processing Agreement, Section 3b). The permission covers everyone who asks on the farm; the others on the farm are not asked, and the Ask page tells them that the farm shares its questions. It counts only while the person who gave it is an Owner or Co-Owner of the farm. We record each choice with who made it, the time and the wording shown.

6. Recipients and sub-processors

Personal data is shared only with the processors listed below for the stated purposes. A processor receives a category of data only when the relevant feature requires it.

Supabase Inc. - Database, authentication, and file storage. Region: Frankfurt, Germany (EU). No personal data leaves the EEA via this processor. Data Processing Agreement
Vercel Inc. - Application hosting and CDN. Edge functions are pinned to fra1 (Frankfurt). Some platform telemetry may be processed in the United States under EU Standard Contractual Clauses. Data Processing Agreement
Cloudflare Inc. - DNS resolution. No application data stored; processes only DNS queries to alpacakeep.com. Data Processing Agreement
Mailbox.org (Heinlein Hosting GmbH) - Email hosting for the @alpacakeep.com mailbox. Provider: Heinlein Hosting GmbH, Berlin, Germany (EU). Privacy policy
Resend (Plus Five Five, Inc.) - Sending our newsletter emails, and nothing else. Resend receives the subscriber's email address and the content of each email, never account or farm data. Our list of subscribers stays in our own database in Frankfurt: we keep no contact list at Resend and we do not track whether an email is opened or a link clicked. Emails are sent from Resend's EU region (Ireland), but Resend's processing, including its logs, takes place in the United States (see Section 7). Provider: Plus Five Five, Inc., San Francisco, United States. Data Processing Agreement
Anthropic Ireland, Limited - Optional AI features through the Claude API. Certificate reading: when an authorised user submits a certificate, Anthropic receives the selected image or PDF, reading instructions and generated proposal. Ask your herd, only for farms in its closed test: when a member asks a question, Anthropic receives the question, the farm's country, units and currency, the asker's role on the farm and the results of the lookups the AI makes in that farm's records (Section 2), and writes the answer. For questions about feeding and care, Anthropic may also search the web, with searches built only from the question and the farm's country, never from the farm's records; Anthropic runs these searches through its own sub-processors, and its published list names Brave Search and TurboPuffer, both in the United States, for web search (checked 9 October 2026). Anthropic's Commercial Terms do not allow it to train its models on this content. Anthropic deletes API inputs and outputs within 30 days, but may keep content that its automated safety systems flag under its Usage Policy for up to 2 years. The data is stored in the United States and the processing may run in any region Anthropic uses; there is no EU residency. Provider: Anthropic Ireland, Limited, Dublin, Ireland, the Anthropic entity for customers in the EEA under its Commercial Terms. Data Processing Agreement · Anthropic's sub-processors

If we add or replace a sub-processor that processes account or farm data, we update this list and notify users with active accounts by email at least 30 days before the change takes effect, giving them an opportunity to object under our Data Processing Agreement. A provider that receives no account or farm data, such as the newsletter sender, is added to this list before it starts its work.

Google Sign-In (independent controller, not a sub-processor). If you choose "Continue with Google", you authenticate directly with Google (Google Ireland Limited / Google LLC). For the sign-in service Google acts as an independent data controller, not as our processor. We receive only the email address and display name you authorise; they are stored in our database in Frankfurt exactly like password-based credentials. Google's own processing is governed by Google's privacy policy.

Sellers who receive your inquiry (independent controllers, not our sub-processors). When you send an inquiry through a sale or breeder page, the farm you contacted receives your name, email address, message and, if you gave it, your phone number by email and in their account, so that they can reply to you. Your inquiry and any replies are stored in the service as a message thread: the seller reads it in their account, and when the seller replies you get an email with a link to read the reply in the service (the email does not contain the reply itself; if you hold an AlpacaKeep account under the same email address, you can also open the thread from your account). We keep that thread as controller for as long as the seller's account exists; you can ask us to delete it at any time. Separately, the farm decides how it handles your details, and its own obligations as a controller apply to that use. If the farm is in Australia, the inquiry form says so before you send (Section 7).

7. International transfers

Primary application storage remains in the European Economic Area (Supabase, Frankfurt). Incidental Vercel telemetry transfers are governed by EU Standard Contractual Clauses. If you sign in with Google, the sign-in exchange is handled by Google as an independent controller under its applicable transfer terms. If you use an AI feature (certificate reading, or Ask your herd in its closed test), Anthropic acts as our processor: what is sent to it is stored in the United States and may be processed in any region Anthropic uses, under Anthropic's Data Processing Addendum, which includes the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). Web searches for Ask your herd are run by Anthropic's own sub-processors in the United States under Anthropic's terms. The Claude API does not provide EU residency. Newsletter emails are sent through Resend (Plus Five Five, Inc.), whose processing takes place in the United States, so the subscriber's email address and the content of each newsletter are transferred there. Resend's Data Processing Addendum includes the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), and in it Resend states that it complies with the EU-U.S. Data Privacy Framework.

If you are in the United Kingdom: your account and farm data is stored in the European Economic Area, and UK law allows personal data to be sent from the United Kingdom to the EEA. Where one of our providers processes personal data in the United States, we rely on that provider's data processing terms, which for Supabase, Vercel, Cloudflare, Resend and Anthropic include the UK addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement. You can ask us for the details at any time.

Farms in New Zealand: the EU and the UK recognise New Zealand's privacy law as adequate, so your inquiry can go to a farm there without further steps. When someone in New Zealand writes to a farm in Europe, we rely on European data-protection law protecting their details in a way comparable to New Zealand's (Privacy Act 2020, principle 12).

Farms in Australia: the EU and the UK have not recognised Australia's privacy law as adequate, and no EU standard contractual clauses cover the inquiry you send to the farm. An inquiry to a farm in Australia is therefore sent only if you tick the box on the form, and the transfer rests on your explicit agreement (GDPR and UK GDPR Art. 49(1)(a)); for someone in New Zealand this is also their authorisation under principle 12 of the Privacy Act 2020. You can withdraw it at any time by writing to us; we then remove your inquiry from the service, but what the farm has already received stays with it. When a farm in Australia uses AlpacaKeep, the records it keeps with us, including the names and email addresses of the people on its team, are made available to it in Australia under the EU Standard Contractual Clauses for a processor sending data back to its controller (Module 4, Commission Implementing Decision (EU) 2021/914), which are part of our Data Processing Agreement.

8. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, in accordance with GDPR Art. 5(1)(e):

Account data: Retained while the account is active and for 30 days after deletion, after which it is irreversibly removed - except where billing audit traces must be preserved. The records that prove a paid contract (the request you ticked at checkout, the fact that we sent you the contract confirmation, and any withdrawal or cancellation declaration you send us, with the time we confirmed receiving it) are kept for 12 years from the day each was made, also after an account is erased (then without the link to your account), because they are our evidence if a claim about that contract is ever raised. The IP fingerprint stored with a declaration is deleted after 7 days. Feedback you send from inside the product is kept until your account, or the farm you sent it from, is deleted.
Newsletter data: Retained until you unsubscribe, which you can do with one click from any newsletter email or from your mail client. The details of a signup that is not confirmed within 30 days are deleted. When you unsubscribe we immediately delete the IP addresses and browser user-agents recorded at your signup and at your confirmation, and keep only the minimal record of the subscription and its withdrawal (your email address, the times and which consent wording you were shown), as proof that the opt-out was honoured and so that a later list import can never silently re-subscribe you. You can ask us to erase that record entirely at any time.
Activity log: Operational action logs are retained for 24 months. All other logs are kept for as long as your farm exists in the service and are deleted with it: security and membership changes, billing and finance entries, consent choices, and your animals' health and register entries (treatments and other events, births, deaths, sales, movements and transfers). If you erase your account, your name is removed from the entries you made on farms that remain. Farm records you enter (animals, events, breeding records, contacts and the rest) are kept for as long as your farm exists in the service; a farm is deleted when its last owner deletes their account. Some records you delete, such as weights, photos and shearing records, are removed at once. Most others (animals, events, breeding records, tasks, contacts) are removed for good 24 months after you delete them. These stay until the farm is deleted: financial entries, animal movements and medication stock entries you delete, the record of a deleted document (its file is removed the next night), and animals still linked to financial records or a breeding record. An animal with a movement from the last 3 years is kept until that movement is 3 years old. An animal with a medicine treatment from the last 5 years is kept until that treatment is 5 years old, because medicine records must be kept for 5 years. Uploaded documents are kept until you delete them or your account is erased - an automated per-document-type retention schedule is planned but not yet in operation. Server and request logs are held by the infrastructure providers listed on our sub-processors page under their own retention terms.
Our billing records: Retained for 10 years after the last transaction in accordance with Italian tax retention requirements - applicable once paid plans go live.
Buyer inquiries: Retained while the seller needs them to deal with your enquiry, and removed with the seller’s account. You can ask us to delete an inquiry you sent at any time using the contact address in Section 1.
Beta access requests: The request email is kept in our mailbox for up to 12 months after our last reply about it, and then deleted. You can ask us to delete it sooner at any time using the contact address in Section 1.
Phone number requests: The fingerprint and time stored when someone presses Show phone number are deleted once they are 30 days old, the next time anyone requests a number, and in any case with the farm. A farm's address and phone number stop being shown as soon as its owner switches them off.
AI certificate readings: The uploaded certificate follows the normal document rules. An unapplied proposal and its issue data expire after 30 days. If applied, proposal details are cleared after 90 days and a minimal audit link remains. Anthropic deletes the submitted content and its response within 30 days, but may keep content flagged by its automated safety systems under its Usage Policy for up to 2 years, or longer where the law requires; it does not use them to train its models.
Questions to Ask your herd: Each question and its answer, as shown, are kept for 30 days so that the person who asked can open them again, and only that person can see them, except that we may read those asked on a farm that allows it (Section 4), and only within the same 30 days. They are deleted after 30 days, or earlier when that person chooses Clear my questions; a record without the question and the answer (when it was asked, whether it worked, the AI model, the cost and any rating) is kept for 180 more days and then deleted. Anthropic deletes what it received within 30 days, but may keep content flagged by its automated safety systems under its Usage Policy for up to 2 years, or longer where the law requires; it does not use it to train its models. The farm's sharing choices (on or off, who chose, when, and the wording shown) are kept while the farm exists, as the record of its permission; the link to the person who chose is removed when their account is erased.
Database backups: The database is backed up once a day, and each backup is kept for 7 days and then overwritten. Data we erase from the live service, including after an account deletion or an erasure request, therefore remains in those backups for at most 7 more days. Backups are kept only to recover from a failure and are used for nothing else; if we ever have to restore one, we repeat the erasures made after it was taken. Uploaded photos and documents are not part of these backups.
Moderation records: The record of a report and our decision (what it concerned, the decision, the reasons we sent and the dates) is kept for 10 years after the case is closed, the period in which a claim about the decision can be brought under Italian law, and then deleted. Reports we receive by email stay in our mailbox for the same period; we do not keep the reported content itself beyond the description the record needs.

9. Your rights

Under GDPR Arts. 15 to 22, you have the following rights:

Access (Art. 15) - request a copy of the personal data we hold about you.
Rectification (Art. 16) - request correction of inaccurate data.
Erasure (Art. 17) - request deletion of your data (the 'right to be forgotten').
Restriction (Art. 18) - request that we pause processing in certain circumstances.
Portability (Art. 20) - receive your data in a machine-readable format; CSV export of your animals, events, shows, financial entries and fibre results is available directly in the product, and we supply any remaining categories on request.
Objection (Art. 21) - object to processing carried out on the basis of legitimate interest.
Withdraw consent (Art. 7(3)) - applicable to anything processed on the basis of consent (e.g., newsletter); withdrawal does not affect the lawfulness of prior processing.

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to how we handle your personal data. You have the rights listed above under UK law as well, and where this notice refers to the GDPR or one of its articles, that includes the corresponding provision of the UK GDPR.

If you are in New Zealand, you can also ask us under the Privacy Act 2020 to see or correct the personal information we hold about you. We answer within 20 working days. Write to our privacy officer at privacy@alpacakeep.com.

We look after your details to the standard of the GDPR wherever you are. If the Australian Privacy Act 1988 applies to us, you also have its rights to access and correct your personal information.

10. How to exercise your rights

To exercise any of these rights, email privacy@alpacakeep.com. We respond within one month as required by GDPR Art. 12(3); for complex requests we may extend by two further months and will notify you of the extension.

11. Right to lodge a complaint

If you believe your data is being processed unlawfully, you may lodge a complaint with the Italian supervisory authority, the Garante per la Protezione dei Dati Personali, at garanteprivacy.it. Under GDPR Art. 77(1) you may also lodge your complaint with the supervisory authority of your member state of habitual residence; for visitors resident in Germany, that is the Datenschutzaufsichtsbehörde of the relevant Bundesland.

If you are in the United Kingdom, you can complain to us about how we have handled your personal data: write to privacy@alpacakeep.com, or by post to the address in section 1. We confirm that we have received your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the UK data protection regulator, the ICO, at ico.org.uk/make-a-complaint. The ICO usually expects you to complain to us first and to wait for our reply.

If you are in New Zealand, you can complain to the Office of the Privacy Commissioner at privacy.org.nz. It usually expects you to raise the matter with us first.

If you are in Australia and the Privacy Act 1988 applies to us, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, after first writing to us.

12. Cookies and analytics

This site uses only essential cookies - the authentication and session cookies set by Supabase Auth, and a first-party marker cookie named ak-session that carries no identifier and only records that a session exists so public pages can show the right sign-in state - that are strictly necessary to deliver the service within the meaning of ePrivacy Directive Art. 5(3), the Italian Garante's Linee Guida of 10 June 2021, and German TDDDG §25(2) Nr. 2. No consent banner is required for these cookies.

If you sign in with Google, Google sets its own cookies on its own domain (accounts.google.com) during the sign-in flow. Those cookies are set by Google on Google's site, not by us on alpacakeep.com, and are governed by Google's cookie policy.

We do not use analytics or statistics tools on the website or in the app: no script counts your visits, and nothing is read from or stored on your device for that purpose. Our hosting provider, Vercel, records the requests that reach our servers, as every web server does (Section 2, Technical and log data). We use these records for security and to run the service, and we may look there at how many requests each page receives, based on our legitimate interest (GDPR Art. 6(1)(f)).

No advertising or third-party tracking cookies are used, and no behavioural profiles are built. If we ever add an analytics tool, or any other tool that reads or stores information on your device beyond what is strictly necessary, we will ask for your consent first, with a banner where refusing is as easy as accepting, and update this policy before it goes live.

Breeders can embed a widget on their own websites that shows their public listings or, if they choose, their herd, and can let their web developer read the same public animal data as a feed for those pages. When you view such a page, your browser fetches the widget, its photos or that feed from our servers, which receive the same technical request data described above and set no cookies. The breeder's website itself is governed by the breeder's own privacy notice.

13. Changes to this policy

We may update this policy as the service evolves. The 'last updated' date reflects the current version. Material changes, including a new processing purpose or a new sub-processor that processes account or farm data, are communicated by email to users with active accounts at least 30 days before they take effect.