Privacy Policy

Personal data we collect

We collect only the categories needed to provide, secure and improve the Platform or comply with law. The exact data depends on the features you use.

We also receive communications you send to support, including the contact details and information contained in the message.

Why we process data and our legal bases

Where CatMind becomes aware of suspected prohibited or unlawful content — including suspected sexual abuse or sexual exploitation of an animal — we may process the relevant upload, account information, technical records and related communications only to the extent reasonably necessary to investigate, protect animals and people, enforce the Terms, establish or defend legal claims, and comply with applicable law. This does not mean that CatMind continuously or automatically reviews every upload for prohibited content.

Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

Browser storage, cookies and similar technologies

The current Platform uses local browser storage to remember your selected light or dark theme and, after login, to store a short-lived access token used to authenticate requests. Anyone with access to your unlocked browser profile may be able to use an active session, so you must secure your device and log out on shared devices.

Strictly necessary cookies or similar technologies may be used for authentication, security, request routing or remembering privacy choices. Google sign-in uses a short-lived HttpOnly transaction cookie to bind the browser to a one-time OAuth state value; it is removed after the callback. These technologies do not require consent where the law treats them as necessary for a service you requested.

Non-essential analytics, advertising or marketing technologies will not be activated where prior consent is required unless you make a separate affirmative choice. If CatMind introduces them, the Cookies Policy and available preference controls will describe their purpose and duration.

When we share personal data

We do not sell your personal data for money. We disclose data only where necessary for the purposes described in this Policy, with your direction or consent, or where required by law.

• Recipients you choose: when you create a private report link, anyone who receives the link can access only the report fields you selected until the link expires or you revoke it. Private reports exclude your account name, email and original video. Personal notes are excluded unless you switch them on.
• Infrastructure and technical providers: hosting, storage, compute, security, email, support and monitoring providers acting under appropriate contractual terms.
• Authentication providers: when you choose Google sign-in, Google authenticates you and returns an account subject identifier, verified email status and basic profile fields requested by CatMind. CatMind does not request offline Google API access for this sign-in flow.
• Professional advisers: legal, accounting, security or insurance advisers where reasonably necessary and subject to confidentiality duties.
• Authorities and protection: courts, regulators, law-enforcement bodies or affected parties where disclosure is legally required or necessary to protect rights, safety and the Platform.
• Business transactions: a buyer, investor or successor in connection with a merger, financing, reorganisation or sale, subject to appropriate safeguards and notice where required.

Service providers may process data only for the contracted service or other purposes lawfully agreed with you. An up-to-date list of material subprocessors may be requested using the contact details below.

International data transfers

CatMind is operated from the Netherlands. Some service providers may process data outside your country or outside the European Economic Area. Where required, we use a valid transfer mechanism such as an adequacy decision, the European Commission's Standard Contractual Clauses, and supplementary technical or organisational measures.

You may contact us for information about the safeguards relevant to your personal data.

Security

We use technical and organisational measures intended to protect data against accidental or unlawful loss, alteration, access or disclosure. Measures include password hashing, verified email links, single-use password-reset tokens stored only as hashes, session revocation after credential changes, OAuth state, nonce and PKCE checks, authenticated account access, access controls, data minimisation, isolated job storage and deletion workflows.

No internet transmission, model pipeline or storage system can be guaranteed completely secure. You are responsible for using a unique password, protecting your device and access token, logging out of shared devices and promptly notifying us of suspected unauthorised access.

Where a personal-data breach creates a legally reportable risk, we will notify the competent authority and affected individuals as required by applicable law.

Your privacy rights

Depending on applicable law, you may have the right to:

• request access to and a copy of your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of personal data in applicable circumstances;
• restrict or object to certain processing, including direct marketing;
• receive data you provided in a structured, commonly used and machine-readable format;
• withdraw consent at any time where processing is based on consent;
• request information about relevant international-transfer safeguards;
• lodge a complaint with the Autoriteit Persoonsgegevens or another competent supervisory authority.

To exercise a right, contact us using the details below. We may request information necessary to verify your identity and protect the account. Rights may be subject to lawful exceptions, and we will explain any refusal or limitation.

Children and third parties in recordings

The Platform is not directed to children and accounts may be created only by adults as described in the Terms. Do not intentionally upload recordings of minors. If you believe a child or another person appears in content without a valid legal basis, contact us so we can investigate and, where appropriate, restrict or delete it.

Changes to this Policy

We may update this Policy when the Platform, our processing or applicable law changes. We will update the effective date and provide additional notice where required. If a new purpose is incompatible with the purpose for which data was collected, we will provide the required information and obtain consent where applicable before that further processing.