Privacy Policy

caty.app — AI chat app source code by OÜ Catyonic · Effective date: May 9, 2026

1. Who we are

caty.app ("the Website") is operated by OÜ Catyonic, a company registered in Estonia (registry code 17463508), located at Madara tn 9a, 10612 Tallinn, Estonia ("we", "us", "our"). We are the data controller for personal data collected through this Website.

2. What caty.app is

caty.app sells the source code of an AI chat application that customers can rebuild, rebrand, and ship as their own product. The Website itself is a marketing and sales site — it presents product information, collects contact inquiries, and processes payments through a third-party provider.

3. Data we collect

3.1 Contact form submissions

When you fill in the contact form on the Website, we collect:

• Name you provide.
• Email address you provide.
• Message content you submit.
• Source (which page or button triggered the form) — used internally to understand which sections drive inquiries.

This data is delivered to our team mailbox contact@catyonic.com via Web3Forms (a form delivery service). It is used solely to reply to your inquiry. Submissions are retained in our mailbox for up to 24 months and then archived or deleted.

3.2 Purchase data

When you buy caty.app source code, payment processing is handled entirely by Stripe Payments Europe Ltd. (Ireland). We do not receive or store your payment card details. From Stripe we receive only:

• Customer name and email (used to deliver the source code package and the receipt).
• Country and VAT/tax identifiers where applicable.
• Order confirmation, transaction ID, and amount.

Stripe's own privacy policy applies to the payment process: stripe.com/privacy. We retain purchase records for accounting purposes for the period required by Estonian tax law (currently 7 years).

3.3 Server logs and security data

Our hosting provider and content-delivery network (Cloudflare) automatically log:

• IP address of incoming requests.
• User agent (browser and OS string).
• Requested URL, timestamp, and response status.

These logs exist for security, abuse prevention, and basic troubleshooting. We retain them for 30 days and then they are automatically rotated and deleted. We do not link them to identifiable users beyond what is necessary to investigate a specific incident.

3.4 Cookies

The Website uses a minimal set of cookies:

• Cloudflare security cookies (e.g. __cf_bm) — strictly necessary to detect and block abusive traffic. These are exempt from consent under the EU ePrivacy Directive.
• Stripe checkout cookies — set only on the payment page, strictly necessary to complete a transaction.

We do not use advertising cookies, behavioral tracking, third-party analytics, retargeting pixels, or social-media trackers.

4. Data we do NOT collect

• We do not run third-party analytics (Google Analytics, Meta Pixel, etc.) on this Website.
• We do not sell, rent, or share your personal data with advertisers.
• We do not build behavioral profiles of visitors.
• We do not collect any data from inside the caty source code that customers buy and run on their own infrastructure — that runs entirely under the customer's control.

5. Legal basis for processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Contact form submissions — consent (Art. 6(1)(a)) — you actively choose to submit the form and provide your details.
• Purchase processing — performance of a contract (Art. 6(1)(b)) — necessary to deliver the product you purchased.
• Server logs and security cookies — legitimate interest (Art. 6(1)(f)) — necessary to keep the Website secure and operational.
• Tax records retention — legal obligation (Art. 6(1)(c)) — required by Estonian Accounting Act.

6. How we share data

We share personal data only with the following processors, each bound by a Data Processing Agreement and operating under GDPR:

• Stripe — payment processing.
• Web3Forms — contact form delivery.
• Cloudflare — content delivery and DDoS protection.
• Contabo (Germany) — server hosting.
• Resend — outbound transactional email.

We do not transfer personal data to any party outside the EU/EEA except where covered by Standard Contractual Clauses or an adequacy decision.

7. Your rights under GDPR

If you are located in the European Union, the United Kingdom, or another jurisdiction with similar data protection law, you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data, subject to legal retention obligations.
• Restriction — request restriction of processing.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or your local supervisory authority.

We respond to verified requests within 30 days. Contact us at the address below.

8. Data retention summary

• Contact form submissions — up to 24 months in our mailbox, then archived or deleted.
• Purchase records — 7 years (Estonian tax law).
• Server access logs — 30 days.
• Marketing cookies — none used.

9. Children

The Website and product are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes affecting how we process your data will be communicated by email if we have your address. Continued use of the Website after changes constitutes acceptance of the revised policy.

11. Contact us

OÜ Catyonic
Madara tn 9a, 10612 Tallinn, Estonia
Email: contact@catyonic.com