Privacy and GDPR
How Katcha handles data, our legal documents, and ready text for your privacy policy.
Legal documents
Each document has its own page with a version and date, so you always know what you agreed to.
- For visitors and customersPrivacy PolicyWhat the Katcha check processes, why, for how long and where, and how we handle your account data.
- For customersTerms of ServiceThe agreement for using Katcha: plans, billing, acceptable use, liability and our company details.
- For your legal teamData Processing AgreementOur Art. 28 GDPR contract with you, with the processing details, security measures and sub-processors.
Our privacy promises
Privacy is part of how Katcha is built, not a setting you have to find.
- Hosted in the Netherlands
- Every check runs on EU infrastructure in the Netherlands. [KEEP "NO TRANSFERS OUTSIDE THE EEA" ONLY IF NO US PROVIDER SEES VISITOR DATA]
- Zero cookies
- The script sets no cookies and stores nothing on the visitor's device.
- Data minimisation
- Only the signals needed to tell a human from a script. Never names, emails or what visitors type.
- IP addresses protected
- [IP HANDLING, e.g. "IPs are hashed on arrival and never stored in full."]
- Short memory
- Raw signals are deleted after [RETENTION]. Only anonymous statistics stay.
- Never for ads
- No profiling, no cross-site identifiers, no selling data. Not as a setting, but as the architecture.
- No hard block when unsure
- If the score is unsure, a visitor gets one lightweight check. Only requests the site owner's rules mark as clearly automated are blocked.
- A real person to ask
- Questions about data go straight to the people who build Katcha.
Everything you need for your own compliance
When you add Katcha to your site, you are the controller and we are your processor. Here is what we give you.
| You need | We give you |
|---|---|
| A processor contract (Art. 28 GDPR) | Our Data Processing Agreement, included in every plan |
| Text for your privacy policy | A ready paragraph in English and Dutch, below |
| To know who touches the data | Our public sub-processor list |
| Input for your records and DPIA | A description of the processing and our security measures (DPA Annexes 1 and 2) |
| A legal basis | Legitimate interest in security, Art. 6(1)(f) GDPR. Katcha is designed so that no consent banner should be needed for it. [LAWYER CHECK] |
Text for your privacy policy
Copy this into your own privacy policy and check that it fits the rest of it. It is a sample, not legal advice.
Bot protection (Katcha)
To protect our forms against spam and automated abuse, we use Katcha, a service of Katcha Labs, [ADDRESS], the Netherlands. When you use a protected form, Katcha checks in the background whether the request comes from a human or a bot. For this, Katcha processes your IP address, browser and device characteristics, and how the page is used during the check (such as interaction timing and pointer movement), but not what you type.
The legal basis is our legitimate interest in keeping our website secure (Art. 6(1)(f) GDPR). Katcha processes this data on our behalf under a data processing agreement, only in the EU, and deletes it after [RETENTION]. Katcha sets no cookies and does not use the data for advertising or tracking. More information: https://katcha.eu/privacy