Legal

Privacy Policy

Last updated: 25 October 2026

Who we are

CatchLoop is operated by Morgan Brunot, a private individual based in France ("we"). For any privacy question, contact privacy@catchloop.co.

Controller vs processor

Two relationships, kept separate:

Your account data (you, the workspace administrator): we are the controller. We process your email and name to run your account.
Your end users' data (your customers, who sign in on your portal to vote, post and comment): you are the controller and we are the processor, acting on your instructions. Our Data Processing Agreement governs this.

If you signed in on a team's portal

The team that runs the portal decides what happens to your data; CatchLoop stores it and sends its emails on the team's behalf.

Your account belongs to that team's portal only. It holds your email, the name you chose, and the requests, votes and comments you post.
Your email is used to sign you in and to tell you when a request you follow ships. Mute a request or stop every email from My requests, or with the link at the bottom of each email.
To see, export or delete your data, ask the team. You can also write to privacy@catchloop.co and we pass your request on.

What we process

Administrators: email and name, for authentication (magic link) and account management, the teams you belong to, and when you accepted the Terms and this policy, and which version. An invitation stores the invited address until it is accepted or withdrawn.
End users: a customer account exists only on the portal of the team where it was created. It holds the email address, an optional display name, the requests, votes and comments it posts, the requests it muted, and whether it turned emails off. The requests it follows are not stored separately: they are the ones it posted, voted on or commented on.
Sign-in links: for administrators and end users alike, the address the link was sent to and, for an end user who was voting or posting, what they were doing, so it can finish after sign-in. Only a hash of the link is stored; it works once and expires after an hour (an invitation after a week).
Emails sent: a record of each announcement email, to whom and whether it went out, so nobody is told twice.
Pro waitlist: the email address you leave on the pricing page or in Settings, and your workspace if you were signed in.
Where a workspace came from: when you sign up, the campaign tags (UTM) and referring site of the link that brought you and the first page you saw, kept with your workspace so we learn which channels work. The signup form carries them; nothing is stored in your browser for it.
Technical data: IP address (transiently, for rate limiting and abuse prevention) and standard server logs.

We do not use tracking or advertising cookies, and we never sell personal data.

If you visit this website

We measure the audience of this website (home, product, pricing, docs, blog and legal pages) with Umami, which we host ourselves on our server in the EU (OVHcloud, France): the statistics go to no third party. It sets no cookie, builds no personal profile and does not store IP addresses. It counts page views, the referring site and campaign tags, clicks on the signup and waitlist buttons, and the browser, device type and approximate location they came from. If your browser sends Do Not Track, nothing is counted. Customer portals never carry it.

What we email, and when

Administrators: a sign-in link when you ask for one, a confirmation when you create a workspace, a welcome email once it exists, and an invitation when a teammate invites you.
End users: a sign-in link when they ask for one, and an announcement when the team publishes a changelog entry that ships a request they follow, once per entry. Nothing else: a status change, a vote or a comment never sends an email. Every announcement links to the end user's My requests page, where they can mute one request or stop all emails, and carries a one-click unsubscribe link.
Pro waitlist: one email, the day Pro opens.

Where it is hosted

The application and its database run on OVHcloud infrastructure in France. One subprocessor sits outside that host: Resend, a US company that sends our email, so the addresses it handles leave the EU, under the safeguards stated below.

Subprocessors

We use a short, deliberate list of subprocessors:

OVHcloud (OVH SAS, France): hosting of the application and its database, and of our mailboxes (support, hello, privacy).
Resend (Plus Five Five, Inc., USA): transactional email (sign-in links, changelog notifications). Mail is sent from Resend's EU region, but recipient addresses and delivery logs are processed in the US, under the EU-US Data Privacy Framework and standard contractual clauses.

Retention

An end user's session ends after 180 days without a visit, or when they sign out.
An administrator's session ends after 30 days without a visit, after a year in any case, or when they sign out.
A daily job deletes ended sessions, an end user's sign-in link a day after it expires or is used, and an administrator's sign-in or invitation link 30 days after it was sent.
Account and end-user data is kept until you delete it or close your workspace.

Your rights

You can access, rectify, erase and export personal data. End users exercise these rights through you, the workspace administrator: the dashboard lets you export your workspace's data as JSON and delete an end user for good, with their votes and comments. For account-level requests, email privacy@catchloop.co. You may also lodge a complaint with your local supervisory authority.

Cookies

We set only strictly-necessary cookies: a session cookie for the admin dashboard; a session cookie for end users who sign in on a portal, which lasts up to 180 days; and a cl_in cookie that only tells this website you are signed in, so it can show a link to your dashboard, and carries no identity. Session cookies are httpOnly and hold a random token whose hash is all we store. No consent banner is required for these functional cookies.

Changes

We will update the date above when this policy changes and, for material changes, notify workspace administrators by email.