Privacy policy

Last updated: 17 October 2026

This policy explains how we use personal data when you visit quiz.catandtray.com (the “Site”), take our online check and buy Cat & Tray products. It covers the data we use, why, our legal bases, how long we keep it, who receives it and your rights under the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

1. Who is responsible for your data

Oblivion Capital LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, registration Company registered in the State of Wyoming (USA) is the controller.
For questions about your data, contact [email protected].

2. Data we use

Browsing data: IP address, browser and device type, pages viewed, date and time. Our hosting provider processes this information to show and protect the Site.
Your answers to the online check: they stay in the page in your browser and are used there to work out your result. We do not store your answers and we do not link them to you, except the result itself if you tick the tips box at the end (see below). We count, in totals only, how many people start the check, answer each question and reach each result (no identifier, no cookie). When you buy, the result you reached (for example “Plan B”) is attached to your order so that your confirmation email can tell you where to start.
Email address you give to receive your result: we use it to send you that one email with your result and, only if you tick the box, to send you tips and offers (see below): we then keep the result you reached (for example “most likely a spray, Plan D”) with your address, to choose which tips to send you. If you then buy, the same address is filled in for you on the payment page, where you can change it. To prevent abuse, we keep a hashed (SHA-256) fingerprint of your address and IP address for no more than 2 days.
Order data: email address, name and country entered at checkout, products bought, amount, date, order reference, the record of your consent to immediate access and acknowledgement that you lose your right to cancel, campaign parameters (UTM) and the country you connected from (derived from your IP address, which is not kept). Payment details are entered directly with Stripe; we never receive your full card number.
Messages to us: your email address and what you write.
Cancellation or refund requests sent with the “Cancel contract here” form: full name, order reference or purchase email address, products concerned, the email address for our acknowledgement, and the date and time of your request. To limit abuse of the form, hashed (SHA-256) fingerprints of your IP address and email address are kept for no more than 2 hours.
Tips and offers email data: email address, first name if given at checkout, products bought, order reference and date, and whether you agreed or objected, with the date. We use the products you already own so that we never offer you something you have. If you agreed to email analytics: whether, when and how often each email was opened and which links were clicked (see below).
Advertising measurement data (only with your consent): online identifiers, including Meta cookies, IP address, browser and device information, page views, product views, check results reached and buy-button clicks collected through the Meta Pixel. The same events are also sent from our server through Meta’s Conversions API, with your IP address, browser information, Meta identifiers and a random identifier specific to our site (cookie “q4_xid”, no more than 13 months), hashed using SHA-256. When you buy, the purchase event (amount, products and order reference) is sent the same way, together with your email address, this random identifier, the customer identifier assigned by our payment provider and, where available, your name and billing country, all hashed using SHA-256. Hashing does not make this data anonymous. Without your consent, none of this data is sent to Meta.

3. Why we use it and our legal bases

Purpose	Legal basis (Article 6 UK GDPR)
Show and protect the Site	Our legitimate interest in a reliable, secure website
Count, in totals only, how the online check is used, to improve it	Our legitimate interest in improving our service (no identifier, nothing stored on your device)
Email you the result of the check you asked for	Taking steps at your request (a service you asked for). This email contains no advertising.
Process orders, deliver files by email, provide customer service, and handle guarantees and refunds	Performance of the contract
Offer a one-click additional purchase on the confirmation page after a card payment (your card stays linked to your order at Stripe for about 30 minutes at most and is then removed: it is never kept for other purchases)	Performance of the additional contract if you choose to accept the offer
Keep accounting records	Legal obligation
Prevent payment fraud and abuse of our forms	Legitimate interest
Measure where sales come from (UTM parameters and connection country of an order)	Our legitimate interest in understanding our campaigns, without placing anything on your device
Email customers tips and offers about our own similar products	Legitimate interest, under the customer “soft opt-in” of regulation 22(3) PECR: you are told at checkout, can refuse there free of charge, and can unsubscribe in one click in every email
Email tips and offers to people who ticked the box at the check	Consent (regulation 22 PECR; Article 6(1)(a) UK GDPR). You can withdraw it at any time, in one click in every email.
Measure whether our tips and offers emails are opened and their links clicked, to make them more useful	Consent (regulation 6 PECR; Article 6(1)(a) UK GDPR). You can withdraw it at any time with the link in every measured email.
Measure Facebook and Instagram advertising and show ads to people likely to be interested (Meta Pixel and Conversions API)	Consent, including under regulation 6 PECR. You can withdraw it through “Manage cookies”.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The result of the online check is general guidance chosen by a fixed set of rules; it is not a decision about you.

If you have bought from us: we may send a few emails with tips for using your files and offers for our own similar products. We tell you this at checkout and on the confirmation page. At checkout you can refuse free of charge: use the “Opt out in 1 click” link on the payment page.
If you ticked the box at the check: we send you tips and offers because you agreed, chosen according to your result. If you then start an order without finishing it, we may send you one reminder, once only. If you did not tick the box, you only receive the email with your result.
Otherwise: we do not send you marketing emails, and we never send reminders about an order you did not complete.
Unsubscribe: at any time, free of charge, with the one-click link in any marketing email, your email app’s “Unsubscribe” button, by replying “STOP” or by writing to [email protected]. We will still send emails about your orders, such as download links and refund confirmations.

Email analytics (opens and clicks): only with your consent

What: if you agree, the tips and offers emails we send you contain a tiny invisible image and links that pass through our email provider, Brevo (Sendinblue SAS, France). They record whether and when an email is opened, the links you click, and the technical data that comes with that (such as IP address and email app). This is the kind of technology covered by regulation 6 PECR, so we only use it with your consent.
Why: to see which emails and topics are useful, so that we send better and fewer emails. We look at the results per email and per topic; we do not use them to make decisions about you.
How you agree: by ticking the box at the end of the check (its wording says that we measure opens and clicks), or by ticking the optional box on the order confirmation page. The box is never pre-ticked. If you do not agree, you still receive the same emails as a customer, sent through Resend (Plus Five Five, Inc., United States) with no tracking pixel and no redirected links; we only see, on our own site, when a link from an email leads to an order (campaign parameters in the link).
How to withdraw: at any time, with the “Turn this off” link at the bottom of every measured email, by unticking the box on the order confirmation page, or by writing to [email protected]. You keep receiving our emails, without measurement. Unsubscribing stops the emails and the measurement altogether.
How long: the record of your choice (date, wording) for as long as we email you, then 3 years; open and click data is kept by Brevo (Sendinblue SAS, France) for a limited period and we keep only totals per email and per topic.

4. Who receives your data

Your data is used by Oblivion Capital LLC and by these providers only as needed for their work:

Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): hosting the Site, running the order service and storing the files to download, as a processor.
Stripe (Stripe Payments UK, Ltd. (to be confirmed for the US account)): online payments and fraud prevention. For some operations, including fraud prevention and regulatory obligations, Stripe is a separate controller. Its privacy policy: stripe.com/gb/privacy.
Resend (Plus Five Five, Inc., United States): sending order confirmations, download links, check results and refund confirmations, without tracking pixels or click tracking (processor).
Brevo (Sendinblue SAS, France): managing contact lists and unsubscribes for the emails described above, as a processor. These emails are sent through Resend (Plus Five Five, Inc., United States), as a processor; to people who agreed to email analytics they are sent through Brevo (Sendinblue SAS, France), which measures opens and clicks for us, as a processor.
Meta Platforms Ireland Ltd.: only with your consent. For the collection and transmission of data through the Pixel and Conversions API we are joint controllers with Meta; Meta is a separate controller for its own later processing. See Meta’s privacy policy.
Our professional advisers (such as accountants and lawyers) and authorities where the law requires it.

We do not sell your data.

5. Transfers outside the United Kingdom

Oblivion Capital LLC is established in the United States. Some providers, including Cloudflare, Inc., Resend (Plus Five Five, Inc., United States), Meta Platforms, Inc., and Stripe for some operations, may also process data in the United States or other countries outside the United Kingdom. These transfers rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for certified organisations whose certification covers the transfer, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with supplementary measures where needed. You can write to us for details and a copy of these safeguards.

6. How long we keep data

Order data and accounting records: 6 years from the end of the relevant financial year (UK tax and accounting rules), or longer where the law requires it.
Customer data used to manage our relationship and send offers: 3 years from your last purchase or contact with us.
Email addresses given at the check with the box ticked: until you unsubscribe, and in any case 3 years from your last contact with us; the record of your consent (date, wording) is kept as long as we use your address, then 3 years.
Email addresses given at the check without the box ticked: not kept after the result email is sent (only the hashed anti-abuse fingerprint, 2 days at most, and our email provider’s delivery logs).
If you unsubscribe, we keep only your email address on a suppression list so that we do not contact you again.
Customer service messages: 3 years from the last exchange.
Hosting security logs: a limited period set by the hosting provider.
Your cookie choice: 6 months. Meta cookies: see our Cookie policy (no more than 13 months). Random identifier “q4_xid”: no more than 13 months from its creation, deleted if you withdraw consent.

7. Your rights

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict its use and to data portability. You can object to processing based on legitimate interest, and to direct marketing at any time without giving a reason. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before. For cookies, use “Manage cookies” at the bottom of each page.

To use your rights, write to [email protected]. We reply within one month (extendable by two months for complex requests; we will tell you within the first month). If we have reasonable doubts about your identity, we may ask for information to confirm it.

You have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk/make-a-complaint. We would appreciate the chance to deal with your concern first, so please consider writing to [email protected] before contacting the ICO.

8. What you must give us

You can browse the Site and take the check without giving us any personal information. Your email address and payment details are needed to complete a purchase and deliver your files. Giving your email at the end of the check is optional: you can skip it and still see your result. Advertising consent is optional; refusing it does not affect browsing or buying.

9. Security

The Site uses HTTPS throughout. Download links are signed and expire after a limited time. Access to data is restricted to people who need it.

10. Changes

We may update this policy when our services or the law change. The date of the last update is shown at the top of this page.

Back to the main page