Privacy policy

Last updated: 17 October 2026

This policy explains how we use personal data when you visit catandtray.com (the “Site”), take our online check and buy Cat & Tray products. It covers the data we use, why, our legal bases, how long we keep it, who receives it and your rights under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

1. Who is responsible for your data

Oblivion Capital LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, registration Company registered in the State of Wyoming (USA) is the controller.
For questions about your data, contact [email protected].

2. Data we use

Browsing data: IP address, browser and device type, pages viewed, date and time. Our hosting provider processes this information to show and protect the Site.
Your answers to the online check: they stay in the page in your browser and are used there to work out your result. We do not store your answers and we do not link them to you. We count, in totals only, how many people start the check, answer each question and reach each result (no identifier, no cookie). When you buy, the result you reached (for example “Plan B”) is attached to your order so that your confirmation email can tell you where to start.
Email address you give to receive your result: we use it to send you that one email with your result and, only if you tick the box, to send you tips and offers (see below). If you then buy, the same address is filled in for you on the payment page, where you can change it. To prevent abuse, we keep a hashed (SHA-256) fingerprint of your address and IP address for no more than 2 days.
Order data: email address, name and country entered at checkout, products bought, amount, date, order reference, the record of your consent to immediate access and acknowledgement that you lose your right to cancel, campaign parameters (UTM) and the country you connected from (derived from your IP address, which is not kept). Payment details are entered directly with Stripe; we never receive your full card number.
Messages to us: your email address and what you write.
Cancellation or refund requests sent with the “Cancel contract here” form: full name, order reference or purchase email address, products concerned, the email address for our acknowledgement, and the date and time of your request. To limit abuse of the form, hashed (SHA-256) fingerprints of your IP address and email address are kept for no more than 2 hours.
Tips and offers email data: email address, first name if given at checkout, products bought, order reference and date, and whether you agreed or objected, with the date.
Advertising measurement data (only with your consent): online identifiers, including Meta cookies, IP address, browser and device information, page views, product views, check results reached and buy-button clicks collected through the Meta Pixel. The same events are also sent from our server through Meta’s Conversions API, with your IP address, browser information, Meta identifiers and a random identifier specific to our site (cookie “q4_xid”, no more than 13 months), hashed using SHA-256. When you buy, the purchase event (amount, products and order reference) is sent the same way, together with your email address, this random identifier, the customer identifier assigned by our payment provider and, where available, your name and billing country, all hashed using SHA-256. Hashing does not make this data anonymous. Without your consent, none of this data is sent to Meta.

3. Why we use it and our legal bases

Purpose	Legal basis (Article 6 UK GDPR)
Show and protect the Site	Our legitimate interest in a reliable, secure website
Count, in totals only, how the online check is used, to improve it	Our legitimate interest in improving our service (no identifier, nothing stored on your device)
Email you the result of the check you asked for	Taking steps at your request (a service you asked for). This email contains no advertising.
Process orders, deliver files by email, provide customer service, and handle guarantees and refunds	Performance of the contract
Offer a one-click additional purchase on the confirmation page after a card payment (your card stays linked to your order at Stripe for about 30 minutes at most and is then removed: it is never kept for other purchases)	Performance of the additional contract if you choose to accept the offer
Keep accounting records	Legal obligation
Prevent payment fraud and abuse of our forms	Legitimate interest
Measure where sales come from (UTM parameters and connection country of an order)	Our legitimate interest in understanding our campaigns, without placing anything on your device
Email customers tips and offers about our own similar products	Legitimate interest, under the customer “soft opt-in” of regulation 22(3) PECR: you are told at checkout, can refuse there free of charge, and can unsubscribe in one click in every email
Email tips and offers to people who ticked the box at the check	Consent (regulation 22 PECR; Article 6(1)(a) UK GDPR). You can withdraw it at any time, in one click in every email.
Measure Facebook and Instagram advertising and show ads to people likely to be interested (Meta Pixel and Conversions API)	Consent, including under regulation 6 PECR. You can withdraw it through “Manage cookies”.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The result of the online check is general guidance chosen by a fixed set of rules; it is not a decision about you.

If you have bought from us: we may send a few emails with tips for using your files and offers for our own similar products. We tell you this at checkout and on the confirmation page. At checkout you can refuse free of charge: use the “Opt out in 1 click” link on the payment page.
If you ticked the box at the check: we send you tips and offers because you agreed. If you did not tick it, you only receive the email with your result.
Otherwise: we do not send you marketing emails, and we never send reminders about an order you did not complete.
Unsubscribe: at any time, free of charge, with the one-click link in any marketing email, your email app’s “Unsubscribe” button, by replying “STOP” or by writing to [email protected]. We will still send emails about your orders, such as download links and refund confirmations.
No open or click tracking: Resend (Plus Five Five, Inc., United States) sends these emails for us with open and click tracking switched off: no tracking pixel, no redirected links.

4. Who receives your data

Your data is used by Oblivion Capital LLC and by these providers only as needed for their work:

Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): hosting the Site, running the order service and storing the files to download, as a processor.
Stripe (Stripe Payments UK, Ltd. (to be confirmed for the US account)): online payments and fraud prevention. For some operations, including fraud prevention and regulatory obligations, Stripe is a separate controller. Its privacy policy: stripe.com/gb/privacy.
Resend (Plus Five Five, Inc., United States): sending order confirmations, download links, check results and refund confirmations, without tracking pixels or click tracking (processor).
Brevo (Sendinblue SAS, France): managing contact lists and unsubscribes for the emails described above, as a processor. These emails are sent through Resend (Plus Five Five, Inc., United States), as a processor.
Meta Platforms Ireland Ltd.: only with your consent. For the collection and transmission of data through the Pixel and Conversions API we are joint controllers with Meta; Meta is a separate controller for its own later processing. See Meta’s privacy policy.
Our professional advisers (such as accountants and lawyers) and authorities where the law requires it.

We do not sell your data.

5. Transfers outside the United Kingdom

Oblivion Capital LLC is established in the United States. Some providers, including Cloudflare, Inc., Resend (Plus Five Five, Inc., United States), Meta Platforms, Inc., and Stripe for some operations, may also process data in the United States or other countries outside the United Kingdom. These transfers rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for certified organisations whose certification covers the transfer, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with supplementary measures where needed. You can write to us for details and a copy of these safeguards.

6. How long we keep data

Order data and accounting records: 6 years from the end of the relevant financial year (UK tax and accounting rules), or longer where the law requires it.
Customer data used to manage our relationship and send offers: 3 years from your last purchase or contact with us.
Email addresses given at the check with the box ticked: until you unsubscribe, and in any case 3 years from your last contact with us; the record of your consent (date, wording) is kept as long as we use your address, then 3 years.
Email addresses given at the check without the box ticked: not kept after the result email is sent (only the hashed anti-abuse fingerprint, 2 days at most, and our email provider’s delivery logs).
If you unsubscribe, we keep only your email address on a suppression list so that we do not contact you again.
Customer service messages: 3 years from the last exchange.
Hosting security logs: a limited period set by the hosting provider.
Your cookie choice: 6 months. Meta cookies: see our Cookie policy (no more than 13 months). Random identifier “q4_xid”: no more than 13 months from its creation, deleted if you withdraw consent.

7. Your rights

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict its use and to data portability. You can object to processing based on legitimate interest, and to direct marketing at any time without giving a reason. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before. For cookies, use “Manage cookies” at the bottom of each page.

To use your rights, write to [email protected]. We reply within one month (extendable by two months for complex requests; we will tell you within the first month). If we have reasonable doubts about your identity, we may ask for information to confirm it.

You have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint. We would appreciate the chance to deal with your concern first, so please consider writing to [email protected] before contacting the ICO.

8. What you must give us

You can browse the Site and take the check without giving us any personal information. Your email address and payment details are needed to complete a purchase and deliver your files. Giving your email at the end of the check is optional: you can skip it and still see your result. Advertising consent is optional; refusing it does not affect browsing or buying.

9. Security

The Site uses HTTPS throughout. Download links are signed and expire after a limited time. Access to data is restricted to people who need it.

10. Changes

We may update this policy when our services or the law change. The date of the last update is shown at the top of this page.

Back to the main page