Is the parent link secure?

The parent link is built to be as easy as tapping a WhatsApp message. That convenience comes with one trade-off, and it is worth understanding it.

How it works

• Each customer has their own link, which contains a long random code. There are far too many possible codes to guess one.
• There is no login. Whoever opens the link sees that customer's page.
• The link only ever shows one customer's data. A wrong or old code shows a plain "This link has expired or isn't valid" page and nothing else.

The trade-off

Anyone who has the link can view the page. Treat it like a house key: it is safe as long as it stays with the right person.

If a parent forwards the message to a partner or a pet sitter, that person can see the same page, and can do the same things: fill in the check-in form, sign an agreement, ask to reschedule or cancel, accept or decline a waitlist offer, pay a deposit or an invoice, acknowledge an incident report and upload a vaccination certificate. For most families that is exactly what they want. If a link ends up with someone who should not have it, reset it (see below).

What the link shows

• The customer's first name, their pets and vaccination dates
• Upcoming, current and recent bookings, with the check-in code, the price lines and the estimated total
• Deposits that are due or paid, waitlist requests and open slot offers
• Photos, videos, care logs and report cards your team has shared
• Incident reports a manager has chosen to share
• Active packages, wallet balance, loyalty points and non-draft invoices
• The text of your active agreements

What it does not show

• The customer's phone number, email or home address
• Card or UPI details. Parents can pay a deposit or an invoice from the link, but the payment itself happens on Razorpay's or Stripe's own page. FurKisses never sees or stores card details
• Internal notes, drafts, or anything not marked as shared
• Any other customer's information

What can someone change with the link?

An existing booking never changes without your team. Requests to reschedule or cancel wait for your approval. Uploaded certificates wait for review. Check-in forms and signatures are saved and you are notified each time.

Two things do take effect straight away:

• Accepting a waitlist offer creates a confirmed booking for the offered slot. Declining it, or leaving the waitlist, passes the slot on.
• Paying a deposit or an invoice records the payment, and a paid deposit can confirm a pending booking if your booking policies say so.

Someone who has the link can pay a bill for the customer, but can't take money from them: no card is saved, and every payment is entered by hand on the gateway's page.

Other protections

• Search engines are told not to index these pages, and the pages are never listed in your sitemap.
• The link is not passed on to other websites when a parent taps an outside link such as Directions.
• Photos and videos are opened through temporary addresses that stop working after about an hour.
• Pages are not stored in shared caches.
• The link is never written to FurKisses logs or analytics.

Resetting a link

If a parent tells you their link was shared by mistake, or their phone was lost, an owner, admin or manager can reset it from the customer's profile.

1. 1Open the customer.
2. 2Reset the parent link.
3. 3Send the new link to the parent.

The old link stops working immediately, including in every earlier WhatsApp message. Alerts sent after the reset carry the new link automatically.

Good habits

• Check that the WhatsApp number on the customer's profile is correct before you send alerts.
• Ask parents not to post their link in groups or on social media.
• Reset the link when a customer's phone number changes hands.