Operator and privacy contact
EmotionalSupportAnimal.org is responsible for the site activities described here. Send a request through our private contact form.
Who this policy covers
This policy describes how the owner and operators of EmotionalSupportAnimal.org (“we,” “us,” or “our”) handle personal information through this Site, its provider directory, editorial profiles, badges, and request forms. We determine how the information collected for these Site activities is used. Contact us through the private request form.
This policy does not govern a listed provider’s website, clinical services, payment account, or independent practices. Providers are responsible for their own privacy notices and obligations. Information that you send directly to a provider is subject to its practices. Our directory is not a patient portal.
Information we collect and why
We collect information you provide, information from public or authorized sources, and technical information generated when the Site is used. The categories and purposes are:
| Category and source | Examples and use |
|---|---|
| Provider applications | Company name, website, headline, description, services, coverage, pricing, backlink address, contact name and email, optional Twitter/X handle, and selected plan. We use these to prepare profiles, assess applications, verify links, communicate, and administer listings. |
| Public websites and review sources | Website titles, descriptions, and public text used to suggest editable application details; attributed reviewer names, review excerpts, dates, ratings, counts, and source links imported by administrators. We use these to inform directory visitors and assess or correct listings. |
| Editorial profiles | Names, photos, roles, credentials, biographies, education, expertise, affiliations, and supplied professional links. Administrators provide these for the team page and individual profiles. |
| Requests and correspondence | Your optional name, email, selected topic and privacy right, optional jurisdiction, agent status, affected page URL, message, submission time, verification notes, response deadlines, outcome and request status. We use these to respond, verify authority when necessary, address complaints, and maintain a record of the response. |
| Authentication and access | When hosting or administrative access requires sign-in, the hosting service supplies an account identifier, email, and sometimes display name. We use these to control access. Provider applications use private access links; the application database stores a hashed token. A pending welcome email stores an encrypted copy of its private application link; that queued copy is removed after the email service accepts the message. |
| Payment and administration | If paid services are enabled, contact email, customer and subscription references, checkout identifiers, billing status, event identifiers, review deadlines, plan selection, acceptance records, and administrative actions. We use these for subscriptions, service delivery, security, accounting, and disputes. |
| Technical usage and security | Hosting and network services process IP addresses, requested URLs, browser or device information, referrer information where supplied, timestamps, and error or security events. The application also uses hashed IP-based keys and counters to limit abuse. These support delivery, reliability, access control, and operational traffic reporting. |
Required fields are identified in the form. If you choose not to provide them, we may be unable to process that application or request. Please do not include secret tokens, passwords, payment card details, government identifiers, patient files, ESA letters, diagnoses, or unnecessary information about another person.
What becomes public
Approved provider profile fields are public: company name, website, description, headline, services, coverage, pricing, supplied social handle, directory status information, badge identifier, relevant review dates, and published review sources or excerpts. A published review may include its author’s public display name, text, rating, date, and source link. Published team profiles include the professional information and photo entered for publication.
Provider contact names and emails, private application links and token hashes, administrator notes, internal checklists, payment references, and legal-request messages are not intentionally displayed on public pages. They remain accessible to authorized operators and service providers as needed. Information voluntarily placed in a public description or review is public even if it is also provided in a private field.
Draft team profiles and unpublished review records are restricted to administrators. Public pages may be indexed, copied, or cached by search engines and others. Removing information from our Site cannot by itself remove every external copy, but we will take steps required by applicable law.
How we use information
- Operate the Site, prepare and publish authorized profiles, and provide requested directory services.
- Review applications, check backlinks, maintain badges, and investigate inaccurate, abusive, or infringing content.
- Respond to inquiries, corrections, privacy requests, appeals, security reports, and billing concerns.
- Authenticate administrators, protect private application access, detect misuse, troubleshoot errors, and assess service performance.
- Process optional payments and cancellations, maintain necessary business records, enforce valid agreements, and comply with legal obligations.
We do not use Site data to make clinical diagnoses, determine disability, or decide housing eligibility. Website suggestions are extracted from submitted public pages; the current importer does not send applications to an external generative-AI service. Submitting a provider application or a privacy request does not subscribe you to a marketing list.
Who receives information
Service providers. The Site uses OpenAI’s Sites hosting and access services and Cloudflare infrastructure for delivery, database storage, file storage, and related security functions. These services process the information necessary to support their functions. We may also use professional advisers and ordinary communication services to address a request. Access by authorized Site personnel is for operating and administering the Site.
Provider welcome emails. When email delivery is enabled, we use Resend to send a transactional welcome email to a provider’s submitted contact address. When delivery is not configured, the encrypted message remains queued until sent or removed. Resend processes the recipient address, contact and provider names, email content (including the private application link), and delivery information. We retain sending status and message references to support troubleshooting and prevent duplicate sends. These emails do not subscribe you to a marketing list.
Payments, if enabled. Stripe processes payment details through its checkout. We send relevant contact and transaction information and receive subscription and payment-status references. The Site’s application database does not store full card numbers or card security codes. Stripe’s services and your separate account with it are governed by its own applicable privacy terms.
Public recipients. Published directory, review, and editorial material is available to visitors as described above. When we fetch a submitted website or verify a backlink, that website’s host receives a request for the supplied URL; the host may log that request. An external page you visit may receive standard browser and referral information.
Legal and operational recipients. We may disclose relevant information when required by law or valid legal process; to investigate suspected fraud, infringement, or security incidents; to protect people and enforce lawful rights; or to obtain legal advice. We may share the relevant substance of a complaint with an affected provider or rights holder when necessary to assess it. We limit disclosure according to the circumstances and applicable law.
Business transfers and your instructions. Relevant information may transfer during a merger, acquisition, reorganization, or sale of the Site, subject to legal requirements and applicable privacy commitments. We may disclose information at your direction or with consent when required. These provisions do not authorize selling sensitive information or a materially incompatible use without the notice, consent, or other safeguards required by law.
Cookies, badges, and privacy signals
The site application uses essential cookies only. Advertising pixels, optional analytics, cross-site behavioral advertising and automated decisions with legal or similarly significant effects are not enabled. We do not sell personal information for money or other valuable consideration or share it for cross-context behavioral advertising.
The secure application-access cookie (__Host-esa-application-…) lets a provider resume an application for 30 days from use. The privacy-preference cookie (__Host-esa-privacy) stores a fixed opt-out value for up to 12 months without a unique tracking identifier. Both are first-party, Secure and HttpOnly. Hosting, security, sign-in and a separately opened payment checkout may also use essential cookies under their providers’ policies. Browser settings can remove or block cookies; doing so can affect access to private areas.
Use Your Privacy Choices to save a no-sale-or-sharing preference without an account, email or identity check. We recognize Global Privacy Control through the browser’s signal and retain the opt-out preference in this browser. The site’s no-sale-or-sharing practice applies even when a preference cookie is absent. “Do Not Track” does not disable essential security or delivery. Preferences are browser-specific; clearing cookies removes the saved value.
Loading our badge on another website sends a request to our hosting infrastructure. It can include the IP address, browser information, badge URL, time and any referrer supplied by that browser. Badges do not set advertising cookies or track visitors for advertising. Providers embedding them must give appropriate notices on their own websites. Review snippets are served directly by this site without third-party review widgets.
If an optional purpose is introduced, the necessary notice and purpose-specific choices must be available before it is enabled. Continuing to browse or accepting our Terms is not consent to advertising, optional tracking, or marketing.
Health-related and other sensitive information
The Site discusses emotional support animals but does not request medical records, collect an ESA evaluation questionnaire, provide treatment, or use precise location to identify visits to healthcare facilities. Do not submit diagnoses, treatment history, clinical letters, or other sensitive records in directory descriptions or request forms.
A message, review, or URL could nevertheless contain or reveal health-related information. We handle that information only as needed for the request, safety, lawful content administration, or another legally permitted purpose; we do not use it for targeted advertising or to infer a clinical condition. Where applicable law requires separate consent, authorization, notice, or deletion protections for consumer health or sensitive data, those requirements apply independently of these Terms and this policy.
If sensitive information appears on a profile or in an imported review without appropriate authority, use the privacy or correction option in our contact form to identify the page without repeating the sensitive details. We can assess restriction, redaction, or deletion. Your use of this educational Site does not create a healthcare-provider relationship or a representation that every record is governed by HIPAA.
Retention periods and criteria
We keep information only while needed for the stated purpose, a specific legal obligation or a documented legal hold. A valid request can require earlier deletion or restriction. The following schedule guides operator reviews; it does not mean every record is automatically erased on its review date.
| Information | Retention or review rule |
|---|---|
| Applications and provider contact details | While the application or listing is active. Inactive applications are due for review after 12 months without activity; unnecessary data should then be removed unless a documented purpose remains. |
| Public profiles, editorial information and review snippets | While published and relevant, subject to correction, objection and deletion rights. Unpublished drafts are due for review after 12 months. Unpublishing alone does not erase the record or its image. |
| Privacy requests | A minimal request-and-response record is retained for at least 24 months for accountability. Unnecessary contact and message details can be redacted after resolution. Longer retention requires a continuing legal need or hold. |
| Other inquiries | For handling and follow-up; closed requests are due for review after 12 months unless a dispute, obligation or hold requires longer retention. |
| Access and email records | Application cookies expire after 30 days. Token hashes remain while the application exists or until access is replaced. Pending encrypted welcome content remains until sent or removed; the queued content is cleared when accepted for delivery. Delivery references support troubleshooting and duplicate prevention. |
| Abuse-prevention counters | Keys expire at the end of their rate-limit window, currently no more than 24 hours. Expired counters are deleted on the next rate-limited request. |
| Billing, security and legal records | Only for service administration, specific recordkeeping duties, security investigations or legal claims. Applicable obligations and provider backup/log retention determine the period; payment card data is held by the payment processor, not our application database. |
Operators must review records and apply deletion or de-identification when the purpose ends. Backups, hosting logs, delivered emails and external caches have separate retention processes. Where required, deletion instructions or processing restrictions extend to service providers and restored backups. Hiding a public page alone does not fulfill a deletion request.
Security and your access links
The Site uses HTTPS, administrative access checks, restricted draft records, input validation, hashed application-access tokens, and request limits as parts of its safeguards. No system, network transmission, or storage method can be guaranteed perfectly secure. This statement does not waive our security or breach-notification obligations.
Treat a private application URL like a password. Anyone who has it may be able to access application or subscription functions. Do not publish it, include it in a public review, or forward it unnecessarily. If it is exposed or lost, contact us so access can be reviewed and the link replaced. When sending a security report, do not access unrelated records or include active secrets in the form.
Your choices and privacy requests
Use the private request form and select “Privacy or data request.” You do not need an account or a purchase to make a request. Tell us what you are requesting and enough information to locate the relevant record, such as a public profile URL or the contact email used in an application. Avoid sending sensitive identity documents in the initial message.
Depending on your location and the law that applies to our activities, you may have rights to access or obtain a copy of personal information, learn how it is used or disclosed, correct it, request deletion or portability, restrict or object to processing, withdraw consent, or opt out of sale, targeted advertising, or certain profiling. Legal exceptions and verification requirements may apply. Withdrawal does not make prior lawful processing unlawful. We do not discriminate for exercising a protected privacy right.
We may reasonably verify identity or authority before releasing, changing, or deleting information, using information proportionate to the request. An authorized agent may submit a request with evidence of authority where applicable. The form confirms receipt immediately and provides a downloadable reference. For covered GDPR requests, we respond without undue delay and normally within one month; a necessary extension of up to two further months requires notice and reasons within the first month. Covered California access, correction and deletion requests normally receive a response within 45 calendar days; a necessary extension requires notice and reasons and may add up to 45 days. These are maximum periods, not waiting periods. Our initial internal target for an unspecified location is 28 days. Browser opt-outs take effect immediately under our no-sale-or-sharing policy. We explain any lawful refusal and how to challenge it. For a denied request, select “Appeal a privacy decision,” include your request reference, and explain the disagreement. You may also contact the California Privacy Protection Agency, your EEA supervisory authority, or the UK Information Commissioner; our process does not limit those rights. Requests are ordinarily free. Any fee or refusal must be permitted by law and explained. Identity checks use proportionate information only for verification; an authorized agent may need to demonstrate authority. You do not need to verify identity to save a browser opt-out.
Legal bases where GDPR applies
| Purpose | Basis and limits |
|---|---|
| Applications, listings and requested subscriptions | Steps requested before a contract or performance of a contract, where you are a party; otherwise legitimate interests in administering the provider relationship. |
| Public directory and editorial content | Legitimate interests in providing accurate, attributed information, balanced against individuals’ rights. You can object or request correction or removal. |
| Access control, abuse prevention and support | Legitimate interests in operating a secure, reliable site and responding to requests, limited to necessary information. |
| Rights requests, accounting and required disclosures | Compliance with applicable legal obligations; otherwise legitimate interests in accountable operations and resolving disputes. |
| Optional uses requiring consent | Separate, specific consent before the use begins. Withdraw it as easily as it was given through the relevant control or privacy contact. No marketing consent is requested with an application. |
Legitimate interests are not a blanket permission: necessity, proportionality and your rights must be considered. Sensitive information requires an additional lawful condition where applicable; do not submit health records. Published information from third-party sources remains subject to applicable notice and individual-rights requirements.
Regional rights and international visitors
United States. State privacy rights depend on residency, the information involved, and whether the relevant law applies to our activities. For covered California requests, these may include knowing, accessing, deleting, correcting, and limiting certain sensitive-information uses, and opting out of sale or advertising sharing. The categories collected can include identifiers/contact details, commercial/subscription details, internet and security activity, professional information, profile photos and published review content. Sources are you, authorized administrators, public company/review sources, hosting/authentication services and payment services. Purposes and recipients are described in the collection and disclosure sections. We do not knowingly sell or share minors’ information. We do not use sensitive information to infer characteristics or for advertising. We do not offer a financial incentive in exchange for personal information. Other states may provide similar rights and an appeal process.
EEA, United Kingdom, and other locations. The Site primarily addresses U.S. topics. When another jurisdiction’s privacy law applies, we process information on a legally available basis, such as fulfilling a requested service, legitimate interests in operating and securing the Site where those interests are not overridden, legal obligations, or consent when required. Sensitive information requires an additional lawful condition where applicable. You may have rights described above and a right to complain to your supervisory authority.
Hosting, storage, support, and service-provider operations may process information in the United States or other countries with different privacy laws. Where a regulated international transfer occurs, applicable transfer safeguards are required. Merely using the Site is not treated as blanket consent to a transfer that requires additional safeguards. You can ask our privacy contact which safeguards apply to your information and how to obtain a copy or description. This notice does not itself establish a transfer agreement or replace a required processor contract.
Children’s privacy
The Site is intended for a general adult audience, and provider applications and purchases are for adults. We do not knowingly seek personal information from children under 13, or from children below another applicable digital-consent age where that law applies. If you believe a child has supplied personal information, contact us so we can assess and delete it or take other required steps. A parent or guardian can make a privacy request on a child’s behalf, subject to appropriate verification.
Policy changes and contact
We will update the effective date when this policy changes. Material changes will receive additional notice and any required consent before the new practice applies. A policy update will not retroactively authorize a use inconsistent with legally binding commitments.
For questions about this policy or requests relating to your information, contact the operators of EmotionalSupportAnimal.org. The form sends the message to a private administrative inbox and displays a reference number when saved. It does not send an automatic email confirmation. Save the reference if you need to follow up.
Questions or a request?
Send a private message to the site operators about these policies, your information, or a listing.
Contact the site team