Yolki Pet ← Back

Privacy Policy

Last updated: October 20, 2026 · Version: 2.19

YOLKI is a longevity and well-being app for dogs and cats, operated by Coflint OÜ, headquartered in Tallinn, Estonia. Coflint OÜ ("Coflint", "we") is the controller of Yolki Pet and processes your personal data in compliance with the General Data Protection Regulation of the European Union (GDPR), with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) and other applicable laws. This Policy applies both to the yolki.pet website (waitlist, newsletter, quiz, and corporate forms) and to the Yolki Pet app.

We collect account data, data about your pet, the content you send us, your location (with your permission) and usage data, in order to deliver veterinary teleguidance, the AI assistant, the quiz and gamification.

AI-personalised content is optional: you authorise it (or not) through a specific checkbox at sign-up, separate from your acceptance of this Policy, and you may change your mind at any time. To generate guidance and content, we send the AI provider data from your profile and from your pet, together with the text you write — we do not send photos of your pet to the AI; only the vaccination card page, when you ask us to read it. Your content is not used to train third-party models.

YOLKI has a free plan and paid features, and displays no advertising.

You may delete your account and your data inside the app at any time, and exercise all of your rights under the LGPD — including objecting to processing we carry out on the basis of legitimate interest.

1. Who is responsible for your data

The controller of your data is Coflint OÜ. It is Coflint OÜ that decides how and why your data is processed in YOLKI.

Coflint OÜ is an Estonian company (European Union) and is the technology platform behind YOLKI. We have no company, branch or Brazilian tax registration (CNPJ) in Brazil — we simply make the app available to the Brazilian public. Because we process data of people located in Brazil, Coflint OÜ is, for the purposes of Brazilian law, the controller of your personal data, and we comply with the LGPD as well as with the applicable European rules.

Even though we are based in Estonia, we maintain a Portuguese-language contact channel for you and for the Brazilian Data Protection Authority (ANPD): our Data Protection Officer (section 19). That is the channel through which you exercise your rights, without having to contact Estonia.

Some services — such as teleguidance — are provided by independent partners, as explained in section 8.

2. About this document

This Policy took effect on the effective date set out below and applies as worded in the version indicated at the top. Whenever there is a relevant change, we publish a new version and update the last-updated date. The effective date marks when this Policy first became binding; the last-updated date indicates when this wording was published.

3. Who and what this applies to

This Policy applies to the YOLKI app made available to the public in Brazil, and to the yolki.pet website (waitlist, newsletter, quiz, and corporate forms).

Although the company has no establishment in Brazil, the LGPD applies because we offer the service to people located in Brazil. We process your data in accordance with:

Quick definitions. Personal data — information that identifies you or can identify you. Data subject — you. Processing — any operation carried out with your data. Controller — the party that decides on the processing (Coflint OÜ). Processor/sub-processor — the party that processes data on behalf of the controller (our service providers).

Information about your pet, on its own, is not personal data — an animal holds no rights under the LGPD. However, because that information is linked to your account, we treat it with the same care we give to your personal data.

4. You must be 18 or older

YOLKI is only for people aged 18 or over. It is not a service for children or adolescents.

At sign-up, you confirm your age by ticking a self-declaration checkbox ("I am 18 years of age or older...").

If we identify that a user is under 18, we may suspend or close the account and delete the data.

5. How you accept this Policy

At the end of the sign-up flow, we present two separate checkboxes. Neither of them is pre-ticked — the choice is yours.

You may sign in using Google or Apple social login. In that case, we receive the basic data those services share (such as name and email), according to the permissions you authorise.

6. What data we collect

We collect only what is necessary for the app to work and to give you good guidance.

We do not collect your credit card data. See section 12.

7. Why we use your data (purposes and legal bases)

Each use of your data has a clear purpose and a legal basis under the LGPD (article 7).

When we process your data on the basis of legitimate interest, you may object to that processing at any time through our Data Protection Officer (section 19). We will review your request in accordance with the LGPD (article 18, paragraph 2).

8. Veterinary teleguidance: how it works

Video teleguidance is provided by independent partner veterinarians and clinics, registered with the CRMV (the Brazilian regional veterinary council), and not by Coflint. Coflint provides the technology platform; the video call runs on the infrastructure of a third-party provider.

Who processes which data. As a matter of data protection, the clinical data you share during the consultation — what you report about your pet's health, and the professional's assessment and guidance — is processed by the veterinarian or the clinic as an independent controller, because the clinical decision is theirs, in the exercise of their profession. Requests concerning that clinical data may be addressed to the professional; requests concerning the remaining app data, to Coflint (section 19).

This does not affect your consumer rights. Towards you, Coflint is answerable for the service it offers on its platform, under the Brazilian Consumer Protection Code. The division set out above concerns who processes each piece of data, and is not a disclaimer of liability.

In short: the veterinarian decides and is answerable for the clinical guidance and for the clinical data; Coflint is answerable for the platform. Your consumer rights remain intact.

9. Artificial intelligence: what it does with your data

You authorise it beforehand — and you may change your mind. Your data is used by the assistant and by AI-personalised content only with your explicit authorisation, given through the specific, optional checkbox at sign-up ("I want personalised content created with artificial intelligence"), separate from your acceptance of this Policy. Before your first conversation with the assistant, we repeat that notice in the chat itself. You may refuse or revoke the authorisation at any time in the app settings. Without authorisation, none of your data is sent to the AI provider for these purposes: the assistant is unavailable, educational content is displayed in a generic version (without personalisation) and YOLKI's other features continue to work normally. The teleguidance summary, described below, is part of the veterinary service and follows its own rule.

What we send. With your authorisation, we send the AI provider: data from your profile — an internal account identifier, your name and, where you provide them, age, gender and approximate location (such as city and neighbourhood) —, structured data about your pet (for example, species, breed, age, weight, whether it is neutered, whether it is vaccinated) and the text you write. We do not send photos of your pet or your documents to the AI assistant. We apply the principle of minimisation. If this changes, we will update this Policy and ask for your authorisation beforehand.

What the AI does: it generates the app's educational content — part of what you see in YOLKI, such as the Discoveries, is created with artificial intelligence, personalised where you authorise it —, replies in the assistant, helps organise your pet's information and supports customer service.

Ancillary services. To suggest relevant content and places, the system queries external services, which receive only what is necessary for each query. Discoveries draw on open-access scientific articles from Europe PMC (a public database run by EMBL-EBI): the query carries only the species, the topic and, where available, the life stage — never your name, your pet's name or your location —, and each Discovery shows the source it used. For nearby places, Google Maps and OpenStreetMap/Nominatim (converting coordinates into an approximate address) receive only your city or region.

What the AI does not do: it does not diagnose your animal, does not prescribe treatment or medication, does not replace a veterinarian and does not take decisions affecting your interests. AI-generated content may contain inaccuracies — confirm important information with a veterinarian. You can report an inappropriate reply or piece of content directly in the app.

Teleguidance summary. When you have a video teleguidance consultation, the consultation transcript (section 9-A) is sent to the AI provider to generate the consultation summary — the one you receive in the app and the record kept by the veterinarian. This is part of the teleguidance service and happens for every completed consultation, regardless of the sign-up authorisation described above. The summary supports the record of the guidance given; the assessment and the guidance remain the veterinarian's (section 8).

Reading the vaccination card. When you use “Scan booklet” with your device online, each photographed page is sent to the AI provider to identify the vaccines, dates, weight and neutering recorded on it — and you check and correct everything before saving. We send only the page image, reduced to the size needed for reading, and your pet's species: not your name, e-mail or account identifier. Of the result, only what you confirm is saved. This transfer is part of the scanning feature you trigger, regardless of the sign-up authorisation described above. Without a connection, the reading is done on the device itself and no image leaves it; and you can always enter the data by hand, without scanning.

How we contract the provider. Processing uses OpenAI's AI models offered by Microsoft through the Azure OpenAI service, running in the Sweden region (European Union) — see section 13. We contract the provider on terms that do not allow your content to be used to train third-party models. To detect and prevent abuse, Microsoft may retain requests and responses for up to 30 days, also within the European Union.

In short: apart from the teleguidance summary and the vaccination card reading, which happen when you use those features, the AI only receives your data if you authorise it. It is educational and guidance support — never a substitute for a professional — and you can switch it off whenever you want.

9-A. Voice, audio and transcription

YOLKI uses your voice in two situations, and neither of them serves to identify you by your voice.

We do not perform speaker recognition. We do not extract features of your voice to identify or authenticate you. For that reason, this processing does not, in itself, constitute sensitive biometric data under article 5, II, of the LGPD. Even so, we apply enhanced security measures to this content.

10. Who we share your data with

We share your data only with those who are necessary for the service to work.

We do not sell your personal data.

11. Processors and sub-processors we use

We rely on technology providers to operate YOLKI:

These partners process data in accordance with our instructions and under security and confidentiality obligations. The up-to-date list of sub-processors, with purpose and country of operation, may be requested through our contact channel, and it is reviewed whenever we add, replace or remove a supplier.

12. Payments and advertising

YOLKI has a free plan and paid features. The Solo plan is free; the Duo plan is a paid subscription, and the video veterinary consultation is charged per appointment or per package. Every price is shown in the app before you confirm.

We do not process payments and we have no access to your card data. Charges are made through Apple's and Google's In-App Purchase systems. They are the ones who process the payment and receive your card data.

Today YOLKI displays no advertising. We do not use advertising identifiers or ad network SDKs, and we do not track you across apps. If we ever display advertising, it will be contextual — tied to the app's context, with no individual profile of the pet parent and no cross-app tracking — and we will update this Policy before starting that processing.

The commercial terms — plans, automatic renewal, cancellation and the right of withdrawal — are set out in the Terms of Use.

12-A. Partner Programme: the data of those who promote Yolki

This section is for anyone joining the Partner Programme — creators, shows, clinics and organisations that promote Yolki with their own coupon. It does not apply to people who simply use the app: if you are a pet tutor, skip to section 13.

The controller is Coflint OÜ (Estonia, European Union), the same as in section 1. The partnership agreement is what authorises this processing.

What we ask for, and why:

What we do not do: we never show a partner who the people using their coupon are. They see numbers, never a name, an e-mail or any tutor data. And we do not use partner data for advertising.

Who we share it with: our accountants in Estonia (for the invoice), the service that sends the programme's e-mails, and the bank or transfer service that executes the payment. The e-mail service is the same as in section 11; the accountants in Estonia and the bank or transfer service act only within the Partner Programme and are not in that list.

How long we keep it: the document photo, for as long as the partnership lasts and for 5 years after it ends. The signed agreement, the invoice and the payment records, for as long as Estonian accounting law requires — seven years from the end of the financial year (Raamatupidamise seadus, § 12) — and for as long as needed to exercise legal claims. The rest of the application, for as long as the partnership lasts and for the limitation period afterwards.

Your rights are the same as in section 15, and the channel to exercise them is in section 21.

13. Where your data is processed

Your data is stored and processed by providers located in Brazil, in the European Union and in the United States, depending on the service, in addition to the providers whose region is determined by themselves, indicated below. Today: file storage is in Brazil (AWS, São Paulo); usage analytics, error monitoring and the app's crash reports are in the European Union (PostHog and Sentry), as are the database backups (Railway Buckets, on Tigris Data's infrastructure, in Amsterdam) and AI processing (Microsoft Azure OpenAI, in Sweden); and in the United States are the account and notification services (Firebase, from Google) and the team's internal notices (ClickUp).

The app backend and database (Railway), the real-time video infrastructure (LiveKit) and email delivery (Loops, delivered through Amazon SES) operate in regions determined by those providers, which are not enumerated in this Policy. You may find out the region currently in use for each of them through our contact channel (section 21).

Whenever there is an international transfer of data, we adopt the safeguards required by law — such as the ANPD's standard contractual clauses (Resolution CD/ANPD No. 19/2024), for data subject to the LGPD, and the European Commission's standard contractual clauses, for flows under the European regime.

The specific location of each server may change over time, without altering the level of protection described in this Policy.

In short: part of your data stays in Brazil; part is processed abroad, always with the protections required by the LGPD and by the European rules.

14. How long we keep your data

We keep your data only for as long as necessary for each purpose. After that, we delete or anonymise it.

When we use data to improve the service, we do so in aggregated or anonymised form.

15. Your rights as a data subject (LGPD, article 18)

You are in control of your data. The LGPD guarantees you the right, at any time, to:

To exercise these rights, contact our Data Protection Officer (section 19) or use the contact channel (section 21).

We respond as quickly as possible. For requests to confirm processing and to access data, we provide the simplified statement immediately and, if you request the complete statement, within 15 days, as required by the LGPD (article 19). Other requests are handled within a reasonable period, depending on their complexity.

16. How to delete your account and your data

You can delete your account and your data directly in the app, whenever you wish.

After deletion, we erase your data, except for data we are required by law to keep.

Having an active subscription does not prevent the deletion of your account — your right to erasure remains fully available. But deleting the account does not cancel the subscription, which was taken out with the app store and must be cancelled by you in the subscription settings of your Apple or Google account. The conditions are set out in section 15 of the Terms of Use.

17. How we protect your data

We adopt technical and administrative measures to keep your data secure: access controls, encryption in transit (TLS) and, where applicable, at rest, and contractual security obligations with our partners.

If a security incident occurs that may give rise to relevant risk or harm to you, we will notify the ANPD and you, within the deadlines and on the conditions set out in the law. Where the European regime applies, we notify the competent authority without undue delay and, wherever possible, within 72 hours of becoming aware of it (GDPR, article 33), and we notify you where the incident may result in a high risk to your rights (GDPR, article 34; LGPD, article 48).

No system is 100% immune; for that reason, keep your login credentials secret.

18. Identifiers, usage analytics and session recording

We use identifiers and similar technologies for the app to work and to understand how it is used:

You can control some of these technologies in your device settings — for example, by resetting or limiting the advertising identifier.

19. Data Protection Officer (DPO) — LGPD, article 41

We have a Data Protection Officer responsible for data processing, who is your point of contact for privacy matters and also the channel through which the ANPD contacts us.

You may also contact the ANPD if you believe your rights have not been respected.

20. Changes to this Policy

We may update this Policy from time to time.

When that happens, we publish a new version, update the last-updated date at the top and record both dates — effective date and last updated — in section 2, and we will notify you by appropriate means — for example, inside the app.

For relevant changes that broaden the processing or reduce your rights, we will ask for your acceptance again.

21. Contact us

22. Governing law and jurisdiction

This Policy complies with the Brazilian legislation applicable to our relationship with you — in particular the LGPD and the Consumer Protection Code — and, where applicable, with the European data protection rules.

Because you are a consumer in Brazil, the Brazilian protective rules always prevail where they are more favourable to you. The courts of your domicile apply, in accordance with the Consumer Protection Code. We do not impose a foreign jurisdiction on you.

23. Data protection authorities

If you believe your rights have not been respected, you may lodge a complaint with the competent supervisory authority: