Privacy Policy

Last updated: 8 August 2026

This Privacy Policy explains what personal data CatsAI d.o.o. (“CatsAI”, “we”, “us”) collects when you visit catsai.agency(the “Site”), why we collect it, how long we keep it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Croatian data protection law.

1. Who we are (data controller)

We have not appointed a Data Protection Officer, as we are not required to do so. For any privacy question, write to the email address above.

2. What data we collect and why

2.1 Contact form enquiries

When you submit the contact form on the Site, we collect the data you type into it: your name, email address, and your message, plus, if you choose to provide them, your company name and the project typeyou are interested in.

• Purpose: to read your enquiry, reply to you, and discuss a possible project.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR).
• Consequence of not providing it: name, email and message are required — without them we cannot receive or answer your enquiry.

Form submissions are delivered to us by email through our email provider and are stored in our business mailbox.

2.2 Server and hosting logs

Like almost every website, our hosting infrastructure automatically records technical data when a page is requested — including your IP address, the date and time of the request, the requested URL, the HTTP status, the referring page, and your browser and operating system identifiers (user agent). We also read the language preference your browser sends (Accept-Language) to show the Site in an appropriate language.

• Purpose: to deliver the Site, keep it secure and available, and diagnose technical faults and abuse.
• Legal basis: our legitimate interest in the secure and reliable operation of the Site (Art. 6(1)(f) GDPR).

2.3 Analytics

The Site may use Google Analytics, a web analytics service provided by Google Ireland Limited, to understand how visitors use our pages in aggregate (for example, which pages are visited and for how long). Google Analytics sets cookies and processes an abbreviated form of your IP address together with usage data. We do not use analytics data to identify you personally, and we do not sell it.

• Legal basis:your consent, where consent is required for the storing of, or access to, information on your device (Art. 6(1)(a) GDPR). You can withdraw consent at any time by clearing and blocking cookies in your browser or by installing Google’s opt-out browser add-on.
• More information: Google Privacy Policy.

3. Cookies

We do not use cookies for advertising or profiling. The Site itself does not require any cookie to function — your language preference is resolved from the URL or your browser settings, not from a stored cookie.

You can delete or block cookies at any time in your browser settings. Blocking them does not affect your ability to use the Site.

4. Who we share data with

We do not sell personal data and we do not share it with third parties for their own marketing. We do rely on service providers who process data on our behalf under a data processing agreement:

• Hosting and content delivery — to serve the Site and store server logs.
• Email provider — to transmit and store contact-form enquiries and our correspondence with you.
• Analytics provider — Google Ireland Limited, where analytics is enabled (see section 2.3).

We may also disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

5. International transfers

Our providers may process data outside the European Economic Area, in particular in the United States. Where that happens, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses together with supplementary safeguards. You may request a copy of the relevant safeguards by contacting us.

6. How long we keep data

• Contact-form enquiries and related correspondence: for as long as needed to handle your enquiry, and afterwards for up to 3 years, unless a contract results — in which case statutory accounting and tax retention periods (generally up to 11 years under Croatian law) apply to the relevant records.
• Server logs: typically up to 12 months, then deleted or anonymised.
• Analytics data: retained according to the configured Google Analytics retention period, generally up to 14 months.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and obtain a copy;
• have inaccurate or incomplete data corrected;
• have your data erased (“right to be forgotten”);
• restrict processing in certain circumstances;
• receive the data you provided in a structured, machine-readable format and have it transmitted to another controller (data portability);
• object at any time to processing based on our legitimate interests;
• withdraw consent at any time, where processing is based on consent — this does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, email [email protected]. We will respond within one month; where a request is complex, we may extend that period and will tell you if we do.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Croatian supervisory authority, the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia — azop.hr. You may also complain to the supervisory authority of your habitual residence.

8. Security

The Site is served over HTTPS, and access to enquiry data is limited to the people at CatsAI who need it to answer you. We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

9. Children

The Site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. External links

The Site links to third-party websites and profiles (for example TikTok, YouTube and LinkedIn). We are not responsible for the privacy practices or content of those sites; please read their own privacy policies before providing them with personal data.

11. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our services or legal requirements. The current version is always published on this page with the “last updated” date at the top. Material changes will be highlighted on the Site.

13. Contact

Questions about this policy or about how we handle your data? Email [email protected] or write to CatsAI d.o.o., Mirnovečka 44, 10430 Samobor, Croatia.

© 2026 CatsAI d.o.o. All rights reserved.