Privacy
How CATR uses personal data to provide accounts, event planning, orders and invoicing.
Version: 2026-11-01-v1
Data controller and contact
CATR ApS, CVR 46528573, Koldinggade 14, 1., 2100 København Ø, Denmark is responsible for the platform’s personal-data processing. Contact team@catr.io about privacy, access or deletion. CATR handles data-rights requests manually and normally responds within one month, with any lawful extension explained.
Information used
CATR processes account, contact, organisation, planning, order and billing details to deliver requested services and perform contracts. Accounting records are also processed to meet legal obligations. Access control, fraud prevention, service support and necessary security records serve legitimate interests, balanced against your rights. Marketing requires a separate applicable basis; accepting booking terms is not consent to marketing.
Service providers
Supabase and Cloudflare support hosting, login and technical operation; Stripe handles payments; Shine/Billy handles accounting; SendGrid handles transactional email. Mapbox is used for address/map features and OpenAI for optional AI planning. Only necessary order information is shared with a supplier. Provider roles depend on the service: payment and accounting providers may also have their own legal responsibilities. Information about relevant providers, agreements and any international transfer safeguards can be requested from CATR. International access or transfer requires an applicable GDPR transfer basis; CATR does not promise that every service is confined to the EU.
Records and deletion
Data is kept only while needed for the stated purpose or a legal obligation. Accounting material is generally retained for five years from the end of the relevant financial year. Closed accounts and non-accounting data are reviewed for deletion or anonymisation; relevant information may be retained for a concrete dispute or other lawful obligation. Signing out is not deletion. Deletion requests are handled individually, including records held by service providers; CATR explains any lawful reason for retaining specific records.
Official referenceYour rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing. Contact CATR first about a request; you can also complain to the Danish Data Protection Agency.
Official referenceDietary and sensitive information
Use anonymous dietary quantities rather than identifiable health details wherever possible. Do not submit another person’s sensitive information without authority and the necessary explicit consent or other lawful basis. Only details necessary for safe fulfilment should reach the relevant supplier. Contact CATR for correction, restriction or removal; the right to withdraw consent does not erase records retained on another lawful basis.
Optional AI planning
When you use AI planning, the relevant planning input is sent to the AI service to generate suggestions. Avoid sensitive information. AI suggestions do not confirm bookings, make payments or decide contractual rights; the organizer reviews and confirms actions.