Privacy Policy
Last updated: 19 September 2026
Controller and contact. The data controller is Simon Anderson, trading as Cats On Couches. For privacy questions, access/correction/deletion requests, or to withdraw publication permission, contact privacy@catsoncouches.com.
Information and why we use it
- Cat name and optional caption: to identify and, if approved, present the submission. Website display relies on your separate website-publication consent.
- Optional submitter name and Instagram handle: to identify or credit a submission during review. We do not publish these unless separately agreed with you.
- Email address: to administer the submission, contact you about review, and handle rights requests. We do not display it, use it for marketing, add it to a mailing list, or provide it to advertisers. This uses our legitimate interests in handling submissions and responding to their owners.
- Photo and timestamp: to review the submission, keep the original private, and record when it was received. Website publication relies on your separate, affirmative permission. Instagram/social publication requires the separate optional permission.
- Permission choices, notice version, moderation status and submission ID: to document what you authorised and administer the review. Permission records are retained under the schedule below.
We do not request postal address, telephone number, date of birth, or profile details. Website and social publication permissions are separate; declining the optional social permission does not prevent website submission. Permission can be withdrawn using the contact above. Withdrawal does not affect earlier processing, but we will stop future publication and review removal requests.
Lawful bases
We rely on legitimate interests (UK GDPR Article 6(1)(f)) to receive and administer submissions, communicate about moderation, and handle rights requests. Our interests are operating a moderated cat-photo site and preventing unauthorised use; we limit the data, keep submissions private until reviewed, and offer an objection/contact route. We rely on consent (Article 6(1)(a)) for publishing the photo/cat name/caption on catsoncouches.com and, only where separately selected, on associated social accounts. You may withdraw either permission at any time. We do not use submission details for direct marketing or advertising.
Who receives information and international processing
Access is limited to the site operator and service providers needed to run the site. Cloudflare provides website hosting, Worker processing, the private R2 pending-photo store, and D1 submission database. Approved public photos are served from a separate public R2 bucket. Pending photos are private and are not served by a public API. We do not share submission data with advertisers.
After you actively allow advertising, Adsterra and its ad-delivery partners may receive technical information needed to deliver and measure banners, such as IP address, browser/device details, page/request information, and ad interactions, and may use cookies or similar storage technologies. Adsterra’s Privacy Policy describes its technical data, service providers and international processing; its Cookies Policy gives further cookie information. Adsterra identifies companies in Cyprus and the UAE and says staff or suppliers may process data outside the EEA. Review its policies for the applicable safeguards and retention details. Cats On Couches does not send submission email, names, Instagram handles or cat-submission metadata to Adsterra. Use “Advertising choices” in the footer to withdraw or change your choice.
Cloudflare may process or access data globally, including in the United States and other countries. Cloudflare describes its international transfer safeguards in its GDPR information and transfer terms. Depending on the service and location, transfers may use applicable UK adequacy regulations or contractual safeguards such as the UK International Data Transfer Addendum with standard contractual clauses. Cloudflare’s current documentation explains the safeguards and how to request details.
Retention
- Pending: while awaiting moderation. The private original and submission details remain private.
- Rejected: delete the private photo and submission record, including unnecessary personal data, within 30 days of rejection.
- Approved: retain the published photo while it remains published. Keep only the submission ID, received timestamp, permission/notice-version record, status and object reference needed to evidence and manage publication. Remove email, submitter name, Instagram handle, cat name and caption from private submission metadata after approval unless a specific ongoing need is documented.
- When an approved photo is permanently removed, delete its private original and delete or anonymise any personal data no longer needed. Backups or provider security logs may persist for a limited period under the provider’s retention controls.
Your rights and requests
You may request access to your information, correction, erasure, restriction, or object to processing, where those rights apply. Data portability may apply to data processed automatically on the basis of consent. You may withdraw either publication permission at any time. Some rights are subject to legal limits and the lawful basis. Contact us at the address above and include the submission ID if known; otherwise give the email used for submission so we can find the record. We may ask for reasonable information to verify identity.
For an access request, we will locate and securely provide relevant submission details. For corrections, we will update the private D1 record. For erasure or withdrawal, we will remove the image from the public catalogue and R2, deploy the updated catalogue, delete the private original, and delete or anonymise the associated personal record as appropriate. We will not put request details in public files or documentation. You may complain to the UK Information Commissioner’s Office.
Cookies, advertising and device storage
Submission information is never supplied to advertising systems or used for ad targeting. Cats On Couches uses Adsterra display banners. The banner script and associated storage/cookies load only after you choose “Allow ads” in the banner area; choosing “No thanks” keeps ads off. The banner names Adsterra and links here before asking. Use “Advertising choices” in the footer to withdraw or change your choice. Cloudflare may use strictly necessary security technologies. Only Banner format is configured; no popunders, interstitials, social bars, or notification ads are configured.
We do not make decisions about submissions solely by automated processing and do not profile submitters.