Effective Date: October 15, 2026 Version: 1.0 Applies to: All Users who hold an Account or provide information through the Platform and all parties that process information in connection with the Platform.
Article 1: Introduction and Scope
1.1 This Policy states the safeguards the Company maintains for information held on the Platform, the Company's duties on a security incident and a breach, the coordinated process for reporting a vulnerability, and the duties a User holds for the security of the User's own Account. The Policy states a standard of care; the Policy is not a guarantee against a breach.
1.2 Personal information handling in general is governed by the Privacy Policy. Account credential duties are governed by the Account Registration and Security Policy. This Policy governs safeguards, incident response, and breach notification.
1.3 If a provision of this Policy conflicts with the Terms of Use, this Policy controls for the subject it governs.
Article 2: Definitions
2.1 Account: the account a person or business establishes with the Company to use the Platform.
2.2 Breach: an unauthorized acquisition of, or unauthorized access to, personal information that triggers a notification duty under applicable law.
2.3 Buyer: a person who purchases Products or Services through the Platform.
2.4 Company: All About Pawz, LLC, a Tennessee limited liability company.
2.5 Order: a Buyer's purchase of Products or Services through the Platform, accepted in accordance with the Order Formation and Acceptance Policy.
2.6 Platform: the websites, applications, and services the Company operates under the name All About Pawz, including aapawz.com.
2.7 Products: goods offered for sale through the Platform.
2.8 Seller: a person or business the Company has accepted to offer Products or Services through the Platform.
2.9 Services: services offered through the Platform, including grooming, veterinary, pharmacy, and fulfillment services, as applicable.
2.10 User: any person who accesses or uses the Platform, whether or not the person holds an Account.
Article 3: Safeguards
3.1 The Company maintains administrative, technical, and physical safeguards appropriate to the information the Company holds, including (a) Encryption. Credentials and payment-adjacent information are encrypted in transit (TLS) and encrypted at rest. The Company does not store payment card numbers; card data is held by the payment processor, as governed by the Stripe Services Terms. Allocation of processing to a processor does not transfer the Company's duty under this Policy.
(b) Separation of records. Records are separated by the party to whom the records belong, enforced in the Platform's data controls. One party's records are not visible to another party by reason of Platform access alone.
(c) Access control. Access to personal information follows least privilege: a system and a member of staff access only the information the function requires. Seller information is visible to the Seller; Buyer information is visible to the Buyer; staff access is limited by role.
(d) Access records. Access to personal information is recorded: the person or system that accessed the information, the information accessed, the time, and the surface used: so that misuse is discoverable and not merely prohibited. The Company retains access records for the period the Privacy Policy states for security records.
3.2 Article 3.1 states the standard of care the Company maintains and reviews. No safeguard program is absolute. The Company's enforceable commitment on failure of a safeguard is Article 4: prompt response and notification as the law requires.
Article 4: Incident Response and Breach Notification
4.1 A suspected security incident is triaged on receipt: from a User report, automated detection, or a vendor notice: and classified by scope: the information involved, the number of persons affected, and whether unauthorized activity is ongoing.
4.2 Response is scaled to severity. For a critical incident, meaning active exploitation or credential or payment-adjacent information at risk, the Company acknowledges the incident within thirty (30) minutes and gives containment first priority, with a workaround or resolution within four (4) hours. For a high-severity incident, meaning confirmed unauthorized access without evidence of ongoing exploitation, the Company acknowledges within four (4) hours and contains within twenty-four (24) hours. For a medium- or low-severity matter, including a vulnerability without evidence of exploitation, the Company tracks the matter to resolution and updates the reporter.
4.3 Containment precedes full investigation. Revocation of credentials, isolation of an affected system, and closure of an attack path come before determination of the complete scope. The incident record documents both the containment and the investigation.
4.4 Where a Breach triggers notification duties under applicable law, the Company notifies each affected User without unreasonable delay and within the deadline the applicable law sets, and notifies each regulator and other party the law requires. For Tennessee, the outer limit is forty-five (45) days; that limit is a backstop and not the target, and notification issues as soon as the scope is understood well enough to notify accurately.
4.5 A breach notice states what happened, the information involved, the measures the Company has taken, and the steps the affected person is to take. A notice does not minimize the event and does not assign blame to the affected person.
4.6 Where law enforcement requests a delay of notification for an investigative purpose, the Company complies with a lawful request and notifies when the delay lifts. Each delay under this Article is documented in the incident record.
Article 5: Vulnerability Reports and User Duties
5.1 A security researcher who discovers a vulnerability shall report the vulnerability through support@aapawz.com rather than exploit the vulnerability. For a researcher who follows the coordinated process in this Article: limited probing sufficient to establish the vulnerability, prompt report, a reasonable period for remediation, no exploitation, and no access to or retention of another person's information beyond what establishes the vulnerability: the Company acknowledges receipt promptly, keeps the researcher informed of remediation, and does not pursue a claim against the researcher for conduct within the coordinated process.
5.2 Conduct outside the coordinated process in Article 5.1: testing an exploit against production data, access to another User's information to demonstrate a finding, and withholding of a vulnerability for leverage: is unauthorized access governed by the Acceptable Use Policy, not research under this Policy.
5.3 A User shall maintain credential security in accordance with the Account Registration and Security Policy, including a strong and unique password, prompt report of a suspected compromise to support@aapawz.com, and no sharing of the Account.
5.4 The Company does not request a password by email, text message, chat, or telephone. A communication that requests a password is not a Company communication and shall be reported to support@aapawz.com. A suspected compromise is reported at the moment of suspicion, without waiting for confirmation of loss.
5.5 A User shall keep the contact information in the Account current. Breach notices, security alerts, and verification messages are sent to the contact information on file.
Article 6: Processor and Vendor Security
6.1 A processor or service provider with access to personal information in connection with the Platform is bound by contract to maintain appropriate safeguards, to notify the Company of a breach affecting Platform information, and to cooperate with incident response. A vendor breach that affects Platform information is handled as a Company incident under Article 4, and the notification to the affected person issues from the Company, because the affected person's relationship is with the Company.
6.2 The Company assesses vendor security in proportion to the information involved and repeats the assessment periodically. A contract with such a vendor requires notice to the Company of a material change in the vendor's security position.
Article 7: Liability
7.1 Exclusion of certain damages. To the fullest extent permitted by law, neither party is liable to the other for indirect, incidental, special, punitive, or consequential damages, or for lost profits, lost revenue, or loss of goodwill, arising out of or relating to this Policy, even if the party has been advised of the possibility of those damages.
7.2 Cap. To the fullest extent permitted by law, the Company's total liability arising out of or relating to this Policy shall not exceed the greater of (a) the amounts the party paid to the Company under the Company's documents in the twelve months before the event giving rise to the claim, or (b) one hundred dollars ($100).
7.3 Carve-outs. This Article does not limit (a) a party's indemnification obligations under this Policy; (b) liability for fraud or willful misconduct; (c) amounts owed for Orders, fees, chargebacks, or refunds under the Company's documents; or (d) liability that cannot be limited under applicable law, including a notification duty under Article 4 that applicable law imposes.
7.4 Essential purpose. The parties agree that this Article allocates risk between them, that it is an essential part of the basis of their bargain, and that it applies even if a limited remedy fails of its essential purpose.
Article 8: Indemnification
8.1 Duty. Each party shall indemnify, defend, and hold harmless the Company and its members, managers, employees, and agents from and against every claim, demand, action, loss, liability, judgment, settlement, cost, and expense (including reasonable attorneys' fees) arising out of or relating to: (a) that party's breach of this Policy; (b) that party's Products, Services, listings, or User Content where that party is a Seller; (c) that party's violation of any law or of the rights of any person; and (d) taxes for which that party is responsible under the Company's documents. For a Buyer or User, this duty is limited to claims arising from that party's own User Content, unauthorized access, and misuse of the Platform.
8.2 Procedure. The Company shall give prompt written notice of a claim under this Article. The indemnifying party shall control the defense with counsel reasonably acceptable to the Company. The Company may participate in the defense at its own expense. The indemnifying party shall not settle a claim in a manner that imposes any obligation or restriction on the Company, or that does not release the Company fully, without the Company's prior written consent.
8.3 Survival. This Article survives the termination of this Policy.
Article 9: Enforcement and Appeals
9.1 Investigation. The Company may investigate any suspected violation of this Policy. The party under investigation shall cooperate with an investigation and shall produce the records the Company's documents require the party to keep.
9.2 Notice. If the Company determines that a party has violated this Policy, the Company shall give written notice stating the provision violated and the facts relied on, except where notice would compromise an investigation of fraud, a safety risk, or a legal obligation.
9.3 Opportunity to cure. Where a violation is capable of cure, the party has ten (10) business days from notice to cure it and to confirm the cure in writing. No cure period applies to fraud, unauthorized access, a safety risk, unlawful conduct, or a violation that by its nature cannot be cured.
9.4 Measures. If a violation is established and is not cured within the period allowed, the Company may, proportionate to the violation: (a) issue a written warning; (b) remove or suppress a listing or content; (c) require a credential reset and additional verification; (d) suspend the Account, in whole or in part; (e) terminate this Policy and the Account; and (f) exercise any other right or remedy available under the Company's documents or at law.
9.5 Appeal. A party may appeal a measure under this Article by written notice to legal@aapawz.com within thirty (30) days of the measure, stating the grounds and attaching the records relied on. The appeal is decided by a person who did not make the original decision. The Company's decision on appeal is final. A measure remains in effect during an appeal unless the Company directs otherwise in writing.
9.6 No waiver by delay. The Company's delay in acting on a violation is not a waiver of the violation or of any later violation of the same kind.
Article 10: Term and Termination
10.1 Term. This Policy takes effect when a User first uses the Platform and continues until terminated under this Article.
10.2 Termination by the Company. The Company may terminate this Policy as it applies to a party, and the party's Account, on thirty (30) days' written notice for any reason, and immediately on written notice if the party materially breaches this Policy, engages in fraud or unauthorized access, or becomes ineligible to participate.
10.3 Termination by the party. A party may terminate this Policy as it applies to that party on thirty (30) days' written notice to support@aapawz.com, provided the party has no Order or investigation outstanding.
10.4 Effect of termination. On termination: (a) the rights granted under the Company's documents end; (b) obligations that arose before termination: including payment, refund, chargeback, record-keeping, incident cooperation, and indemnification obligations: survive until satisfied; and (c) the Company shall disburse amounts owed, less amounts the Company may set off under the Company's documents, within thirty (30) days, except amounts held in connection with an open investigation or dispute.
10.5 Survival. The Definitions, Liability, Indemnification, Enforcement and Appeals (for measures taken before termination), Dispute Resolution, and General Provisions Articles survive termination.
Article 11: Dispute Resolution
11.1 Any dispute arising out of or relating to this Policy, or to the relationship it governs, is governed by the Dispute Resolution Policy, which is incorporated into this Policy by reference.
Article 12: General Provisions
12.1 Amendments. The Company may amend this Policy by posting the amended Policy in the Document Center and giving notice to the affected party at the email address in the Account. An amendment that materially increases a party's obligations takes effect thirty (30) days after notice; other amendments take effect on posting. Continued use of the Platform after the effective date of an amendment is acceptance of it. A party that does not accept an amendment may terminate under Article 10 before the amendment takes effect.
12.2 Notices. Legal notices under this Policy shall be sent to legal@aapawz.com. Operational notices, security reports under Article 5, and all other communications shall be sent to support@aapawz.com. A notice to the Company is effective when the Company acknowledges receipt or, for email, one business day after sending, whichever is earlier. Notices to a party are effective when sent to the email address in the Account or posted to the Account's notice facility in the portal, whichever occurs first. Each party shall keep the email address in the Account current.
12.3 Governing law. This Policy is governed by the laws of the State of Tennessee, without regard to its conflict-of-laws rules. Subject to the Dispute Resolution Policy, any proceeding arising out of this Policy shall be brought in the state or federal courts located in Shelby County, Tennessee, and the parties consent to personal jurisdiction there.
12.4 Severability. If any provision of this Policy is held unenforceable, the provision shall be enforced to the fullest extent permitted, and the remaining provisions continue in full effect.
12.5 Entire agreement. This Policy, together with the documents it incorporates by reference, is the entire agreement between the Company and each party for the subject it governs and supersedes every prior or contemporaneous statement, communication, or agreement on that subject, whether written or oral.
12.6 Assignment. A party other than the Company shall not assign this Policy or any right or obligation under it without the Company's prior written consent, and an assignment without consent is void. The Company may assign this Policy to an affiliate or in connection with a sale of all or part of its business, on notice to the affected party.
12.7 Waiver. A waiver of any provision of this Policy is effective only in writing and only for the instance stated. No waiver is a waiver of any other provision or instance.
12.8 Interpretation. Headings are for convenience only. "Including" means "including without limitation." This Policy shall not be construed against a party as its drafter. The English-language text controls over any translation.
Related articles