Legal

Data Processing Agreement

Last updated: 24 October 2026

This DPA forms part of the Terms of Service.

1. Roles

For personal data of your end users processed through CatchLoop, you are the controller and Morgan Brunot, the private individual who operates CatchLoop ("CatchLoop"), is the processor. CatchLoop processes this data only on your documented instructions, which include these Terms and your use of the product.

2. Subject matter and duration

The processing lasts for the term of your workspace. Its purpose is to operate your public portal (request board, customer accounts, roadmap and changelog), the announcement emails and the MCP server on your behalf.

3. Nature of the data

• Data subjects: your end users (customers, prospects, teammates who sign in on your portal to submit, vote on or comment on requests).
• Data types: the email address and optional display name of each end-user account; the requests, votes and comments it posts; the requests it muted and whether it turned emails off; its session and sign-in tokens, stored as hashes; the record of announcement emails sent to it; and the requests and vote totals you import. You agree not to send special-category data.

4. Our obligations

• Process personal data only on your instructions, and only to provide the service.
• Ensure people authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational security measures (section 6).
• Assist you, taking into account the nature of processing, in responding to data-subject requests and meeting your security, breach-notification and impact-assessment obligations.
• Notify you without undue delay after becoming aware of a personal-data breach.
• At the end of the term, delete or return the personal data at your choice, save where EU or member-state law requires storage.
• Make available the information needed to demonstrate compliance and allow for reasonable audits.

5. Subprocessors

You authorise the following subprocessors. We will give you prior notice of any intended change and a chance to object.

• OVHcloud (OVH SAS, France): hosting of the application and its database, and of our mailboxes (support, hello, privacy).
• Resend (Plus Five Five, Inc., USA): transactional email (sign-in links, changelog notifications). Mail is sent from Resend's EU region, but recipient addresses and delivery logs are processed in the US, under the EU-US Data Privacy Framework and standard contractual clauses.

Each subprocessor is bound by data-protection obligations no less protective than those in this DPA.

6. Security measures

• Strict tenant isolation: every data access is scoped to a single workspace at the data layer.
• End users sign in with single-use links that expire after an hour; only hashes of sign-in links and session tokens are stored.
• An end-user account belongs to one workspace and is never linked to an account in another.
• Encryption in transit (HTTPS); access to production restricted to authorised personnel.
• Rate limiting and input validation on sensitive endpoints.

7. International transfers

The application and database are hosted on OVHcloud infrastructure in France. Resend, listed in section 5, is a US company: personal data it processes is transferred to the United States under the EU-US Data Privacy Framework and standard contractual clauses, not kept in the EU.

8. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service.

Privacy Policy · Terms of Service