ESA Pass
Make their card

Privacy policy

Version 2026-10-08.1. Applies to esapass.com and the services provided through it ("we", "us", "our"). By using the site or buying from us, you agree to the practices described here, including the advertising cookies, tracking and data sharing in section 3. If you do not agree, please do not use the site.

The short version

  • We collect your name, email, phone number, city and state, and your pet's name, species, breed, color, birthday and photo. We do not request diagnoses, medical records, or clinician letters. Your purchase and the information you choose to provide may still be sensitive.
  • Stripe processes payment and, for Complete Kits, collects your mailing address. We never see your card number.
  • The public verification page shows your pet's name, species, breed, your city and state, the registration date and listing status. Never your name, email or address.
  • We report every checkout and completed purchase to Meta (Facebook and Instagram) and Google to measure and improve our advertising. We also use Meta and Google advertising cookies and tags for every visitor. Section 3 explains exactly what is sent and how to opt out.
  • We do not sell your personal information for money. Some state laws treat advertising disclosures like ours as a "sale" or "sharing" of personal information, or as "targeted advertising". You can opt out on our Your privacy choices page.

1. What we collect

  • You give us: your full name, email, optional city, state; your pet's name, species, optional breed, color and birthday, and an optional photo.
  • Stripe collects for us: payment details (held by Stripe), your phone number and billing ZIP code and country, and a shipping address for printed kits, which Stripe passes to us so we can mail your kit.
  • We generate: a registration number, your certificate and card PDFs, a private kit link, and order records (products, amounts, dates and status).
  • Automatically: IP address and browser information (user agent) when you check out or use the site, and a log of verification lookups (IP, time, result) so you and we can see when a number was checked. Server logs are kept up to 90 days.
  • Cookies and similar technologies: essential cookies to run checkout and administrator login; product analytics cookies and local storage (section 2); and Meta and Google advertising cookies, which we set for every visitor (section 3).

By category, this is: identifiers (name, email, phone number, IP address, cookie, advertising and order identifiers); commercial information (purchase records); internet activity (pages visited and interactions); approximate location (city, state, ZIP code and IP-derived location); and the pet photo you upload. We do not ask for health information, government ID numbers or precise geolocation, and we do not use personal information to infer characteristics about you.

2. How we use it

To create and deliver your kit, run the verification page, mail printed kits, send order emails (receipt, delivery, shipping, and a reminder before your 12-month listing ends), handle refunds and disputes, prevent fraud and abuse, comply with legal obligations, enforce our terms, measure and improve our advertising, and understand and improve the purchase experience.

Unfinished-order reminders: once you type your email into the order form, we save your progress. If you don't complete your purchase, we may send up to two emails about that order, about 20 minutes and about a day later, each with a one-time discount code. Every one has an unsubscribe link, and unsubscribing stops them for good. We send no other marketing email unless you opt in.

Product analytics: we use PostHog (US hosting) to understand visits, checkout steps, purchases and kit usage, and to replay masked interactions. Analytics uses cookies and local storage to connect visits and purchases. Form inputs and page text are masked in replays; pet images, private links and payment details are excluded.

3. Advertising and purchase measurement

Meta. When you start a checkout and when a purchase is confirmed, our server sends an event to Meta through its Conversions API. Each event contains: the event type (checkout or purchase), time, purchase value and currency, that it came from esapass.com; SHA-256 hashes of your email address, phone number, first and last name, city, state, ZIP code, country and a customer identifier derived from your email; your IP address and browser information; and Meta browser and ad-click identifiers. Meta uses this to match the event to a Meta account and to measure, attribute and optimize our ads.

Google. The Google Ads tag loads on the pages of our site. On each page it gives Google your IP address, browser information, the page address, the referring page, and any Google cookies or ad-click identifiers in your browser. When your order confirmation page loads, it also reports the purchase with an order reference, value and currency, and your email in hashed (SHA-256) form so Google can match the purchase to the ad you clicked. Google uses this to measure, attribute and optimize our ads.

Meta Pixel and cookies. For every visitor, we set Meta advertising cookies (a browser identifier, and an ad-click identifier when you arrive from a Meta ad) that last up to 90 days, and load the Meta Pixel on selected public pages (not checkout or kit pages) to record page visits. We do not ask for separate cookie consent; using the site means you agree to this.

What our advertising events never include: pet details, registration details, photos, product descriptions, payment-card details or form contents. Hashing your details does not make them anonymous; Meta and Google can match them to an account with the same email, phone number or name. Because they know the events come from esapass.com, Meta and Google can tell that you visited or bought from an emotional support animal identification business.

Meta and Google are independent companies. Once they receive this information, their own terms and privacy policies govern how they use it, including to improve their advertising services. We do not control their practices and are not responsible for them. See Meta's privacy policy at facebook.com/privacy/policy and Google's at policies.google.com/privacy. You can also manage ad preferences in your Meta and Google account settings.

Your choices: you can block or delete Meta and Google cookies in your browser settings, though this does not stop checkout and purchase reporting, which happens on our server. To opt out of that reporting, use Your privacy choices (section 7). You can also limit ads in your Meta and Google ad settings. We cannot recall events already sent.

4. Who we share with

  • Service providers that act on our behalf and receive only what their job requires: Stripe (payments), Vercel (hosting), Neon (database, encrypted at rest), Resend (email), PostHog (product analytics and masked session replays), and a print vendor or postal carrier for printed kits (shipping details and, when needed to print the kit, the personalized document contents).
  • Advertising partners: Meta and Google, as described in section 3.
  • Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of us, our customers or others, including fraud prevention and chargeback disputes.
  • Business transfers: to a buyer or successor in a merger, acquisition, financing, reorganization or sale of assets, subject to this policy.
  • With your direction: for example, the public verification details you choose to show a landlord.

5. Retention

Pending advertising-event payloads are cleared after seven days, and delivery receipts after 30 days, at the next scheduled maintenance run. Advertising matching information stored for a checkout is deleted after seven days, at the next scheduled maintenance run. Order and registration records are kept while your listing is active and for seven years after for tax, accounting and dispute purposes. You can ask us to delete your photo or your whole registration earlier; we'll keep only what the law requires and tell you what remains. Information already sent to Meta or Google is kept under their own retention policies.

6. Security

We use reasonable administrative, technical and physical safeguards, including encryption in transit and at rest and restricted administrator access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects you, we will notify you as the law requires.

7. Your rights and how to use them

Wherever you live, you can ask to access, correct, delete or receive a portable copy of your personal information, and opt out of marketing. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have these rights by statute, plus the right to opt out of the "sale" or "sharing" of personal information and of targeted advertising, and the right not to be discriminated against for using them.

Opt out of advertising reporting ("Do Not Sell or Share"): enter the email you buy with on our Your privacy choices page (also linked in the site footer). From then on we do not report checkouts or purchases made with that email to Meta or Google, and we cancel any not yet sent. You do not need an account or to verify your identity. You can also email support@esapass.com with the subject "Do not sell or share"; we act on emailed requests within 15 business days.

Other requests: email support@esapass.com from your order email. We verify requests by matching them to that email and our order records, and may ask for more information if we cannot verify you. An authorized agent may submit a request with your signed permission, and we may ask you to confirm your identity directly. We respond within 45 days, or tell you if we need up to 45 more days.

Appeals: if we decline your request, reply to our decision with the subject "Appeal". We will respond within 60 days. If you are not satisfied with the outcome, you may contact your state attorney general.

8. Children

The service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.

9. Where we process data

The service is intended for people in the United States, and we and our providers process information in the United States. If you use the service from elsewhere, your information will be transferred to and processed in the United States.

10. Changes and contact

We'll post changes here with a new version date and email you about material ones before they apply to information we already hold. Continuing to use the service after a change is posted means the updated policy applies. Questions or requests: support@esapass.com.