Privacy policy
This policy explains how we use personal data when you visit catandtray.com (the “Site”) and buy Cat & Tray products. It covers the data we use, why, our legal bases, how long we keep it, who receives it and your rights under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
1. Who is responsible for your data
Oblivion Capital LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, registration Company registered in the State of Wyoming (USA) is the controller.
For questions about your data, contact hello@catandtray.com.
2. Data we use
- Browsing data: IP address, browser and device type, pages viewed, date and time. Our hosting provider processes this information to show and protect the Site.
- Order data: email address, name and country entered at checkout, products bought, amount, date, order reference, the record of your consent to immediate access and acknowledgement that you lose your right to cancel, campaign parameters (UTM) and the country you connected from (derived from your IP address, which is not kept). Payment details are entered directly with Stripe; we never receive your full card number.
- Delivery data: the name, delivery address and, if you give it, phone number entered at checkout, used to deliver your parcel and to email you its tracking link.
- Messages to us: your email address and what you write.
- Cancellation or refund requests sent with the “Cancel contract here” form: full name, order reference or purchase email address, products concerned, the email address for our acknowledgement, and the date and time of your request. To limit abuse of the form, hashed (SHA-256) fingerprints of your IP address and email address are kept for no more than 2 hours.
- Advertising measurement data (only with your consent): online identifiers, including Meta cookies, IP address, browser and device information, page views, product views, check results reached and buy-button clicks collected through the Meta Pixel. The same events are also sent from our server through Meta’s Conversions API, with your IP address, browser information, Meta identifiers and a random identifier specific to our site (cookie “q4_xid”, no more than 13 months), hashed using SHA-256. When you buy, the purchase event (amount, products and order reference) is sent the same way, together with your email address, this random identifier, the customer identifier assigned by our payment provider and, where available, your name and billing country, all hashed using SHA-256. Hashing does not make this data anonymous. Without your consent, none of this data is sent to Meta.
3. Why we use it and our legal bases
| Purpose | Legal basis (Article 6 UK GDPR) |
|---|---|
| Show and protect the Site | Our legitimate interest in a reliable, secure website |
| Process orders, deliver files by email, provide customer service, and handle guarantees and refunds | Performance of the contract |
| Offer a one-click additional purchase on the confirmation page after a card payment (your card stays linked to your order at Stripe for about 30 minutes at most and is then removed: it is never kept for other purchases) | Performance of the additional contract if you choose to accept the offer |
| Deliver your parcel through our fulfilment partner and its couriers, and email you the tracking link | Performance of the contract |
| Keep accounting records | Legal obligation |
| Prevent payment fraud and abuse of our forms | Legitimate interest |
| Measure where sales come from (UTM parameters and connection country of an order) | Our legitimate interest in understanding our campaigns, without placing anything on your device |
| Measure Facebook and Instagram advertising and show ads to people likely to be interested (Meta Pixel and Conversions API) | Consent, including under regulation 6 PECR. You can withdraw it through “Manage cookies”. |
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The result of the online check is general guidance chosen by a fixed set of rules; it is not a decision about you.
4. Who receives your data
Your data is used by Oblivion Capital LLC and by these providers only as needed for their work:
- Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): hosting the Site, running the order service and storing the files to download, as a processor.
- Stripe (Stripe Payments UK, Ltd. (to be confirmed for the US account)): online payments and fraud prevention. For some operations, including fraud prevention and regulatory obligations, Stripe is a separate controller. Its privacy policy: stripe.com/gb/privacy.
- Resend (Plus Five Five, Inc., United States): sending order confirmations, download links and refund confirmations, without tracking pixels or click tracking (processor).
- Meta Platforms Ireland Ltd.: only with your consent. For the collection and transmission of data through the Pixel and Conversions API we are joint controllers with Meta; Meta is a separate controller for its own later processing. See Meta’s privacy policy.
- CJ Dropshipping (CJdropshipping.com), our fulfilment partner: preparing and shipping your parcel, as a processor. It receives your name, delivery address, phone number (if given), email address and the items ordered, and passes the details needed for delivery to the courier.
- Our professional advisers (such as accountants and lawyers) and authorities where the law requires it.
We do not sell your data.
5. Transfers outside the United Kingdom
Oblivion Capital LLC is established in the United States. Some providers, including Cloudflare, Inc., Resend (Plus Five Five, Inc., United States), Meta Platforms, Inc., and Stripe for some operations, may also process data in the United States or other countries outside the United Kingdom. These transfers rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for certified organisations whose certification covers the transfer, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with supplementary measures where needed. You can write to us for details and a copy of these safeguards.
Delivery data is also processed by CJ Dropshipping (CJdropshipping.com), our fulfilment partner in China, where the goods are dispatched from. This transfer relies on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
6. How long we keep data
- Order data and accounting records: 6 years from the end of the relevant financial year (UK tax and accounting rules), or longer where the law requires it.
- Customer data used to manage our relationship: 3 years from your last purchase or contact with us.
- Customer service messages: 3 years from the last exchange.
- Hosting security logs: a limited period set by the hosting provider.
- Your cookie choice: 6 months. Meta cookies: see our Cookie policy (no more than 13 months). Random identifier “q4_xid”: no more than 13 months from its creation, deleted if you withdraw consent.
7. Your rights
Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict its use and to data portability. You can object to processing based on legitimate interest, and to direct marketing at any time without giving a reason. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before. For cookies, use “Manage cookies” at the bottom of each page.
To use your rights, write to hello@catandtray.com. We reply within one month (extendable by two months for complex requests; we will tell you within the first month). If we have reasonable doubts about your identity, we may ask for information to confirm it.
You have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint. We would appreciate the chance to deal with your concern first, so please consider writing to hello@catandtray.com before contacting the ICO.
8. What you must give us
You can browse the Site without giving us any personal information. Your email address and payment details are needed to complete a purchase and deliver your files. Advertising consent is optional; refusing it does not affect browsing or buying.
9. Security
The Site uses HTTPS throughout. Download links are signed and expire after a limited time. Access to data is restricted to people who need it.
10. Changes
We may update this policy when our services or the law change. The date of the last update is shown at the top of this page.