Privacy policy

Last updated November 11, 2026

What we keep about you, why, who helps us run the service, and how to get it changed or deleted.

1. Who we are
2. What this policy covers
3. The data we handle
4. What we use it for
5. Why we are allowed to
6. Artificial intelligence
7. Who helps us run it
8. Where your data goes
9. How long we keep it
10. How we protect it
11. Your rights
12. Deleting your data
13. Age
14. Changes
15. Contact and law

1. Who we are

Cat & Paste (catandpaste.app) is run by LAYE LABS, S.R.L. ("Laye Labs", "we"), RNC 1-33-55113-6, Registro Mercantil 216549SD, Av. Duarte No. 135, Villa Consuelo, Santo Domingo, República Dominicana. We decide how your personal data is used for Cat & Paste, so we are responsible for it (the "controller").

Questions about your data: hello@catandpaste.app. Legal notices: legal@catandpaste.app.

2. What this policy covers

The website, your account, the connection you can add to an AI assistant (the connector), the emails we send you, and payments. It does not cover the websites of the video platforms, of your AI assistant, or of the payment companies, which have their own policies.

3. The data we handle

Your account: your email address, the language you chose, when you signed up and last signed in. For each signed-in session, our sign-in system records the IP address and the browser it came from, until the session ends.
The links you give us: the address of each video you ask the cat to read, the language you asked for, and how the reading went (status, and what it cost us to process).
What is said in the video: to write your playbook we get the text of what is said in the video from our transcript provider. We use it only while the playbook is being written and then discard it. We never download, keep or redistribute the video itself.
Your playbooks: what the cat wrote, and the source it came from (the video's address, title and creator).
Your reads: how many you have, how you got them, when you used them and when they expire.
Payments: for each order, the pack, the amount and currency, its status, and the reference and payment message the payment company sends us. For card payments that message includes the name, email and billing address Polar collected at checkout. For crypto payments it includes the payment id, the coin and the amounts. We never receive or keep card numbers or wallet keys.
The connector: when you connect an AI assistant, the assistant's name, the address it returns to, and the access tokens we issue. We store those tokens only as one-way hashes.
Emails: the sign-in codes and purchase confirmations we send you, through our email provider.
Technical logs: our servers record each request they receive (IP address, browser, the address requested and the time) to keep the service working and safe.

Cookies and similar storage are described on the cookies page.

4. What we use it for

To provide the service: sign you in, read the videos you choose, write and keep your playbooks, and let your assistant use them.
To take payments, add your reads, send you a confirmation and keep our accounts.
To keep the service secure, stop abuse, and find and fix problems.

We do not sell your data, we do not show advertising, and we do not build profiles of you for marketing. We send no marketing emails.

5. Why we are allowed to

Under the EU and UK General Data Protection Regulation, and in the spirit of the Dominican Republic's Law 172-13 on personal data:

Contract: most of the above is needed to give you the service you signed up for and to take your payments.
Legal obligation: we keep payment records because accounting and tax law require it.
Legitimate interests: technical logs and abuse prevention, which keep the service safe for everyone. You can object to these (see your rights).

6. Artificial intelligence

Your playbooks are written by an AI model from the text of what is said in the video. The model can be wrong or leave things out. A playbook is not professional, legal, financial or medical advice; check what matters before you rely on it.

We use OpenAI's API for this. Under OpenAI's own data page (read on 11 November 2026), what we send through the API is not used to train its models, and OpenAI keeps it for up to 30 days for abuse monitoring unless the law requires longer.

No decision about you that has legal or similarly significant effects is made automatically.

7. Who helps us run it

These companies process data for us, each only for the job listed:

Google Cloud (Google LLC, United States; our region is in Northern Virginia): runs the website and the service, and keeps the technical logs.
Contabo (Contabo Inc., United States): hosts the server our database and sign-in system run on, in the United States.
OpenAI (OpenAI OpCo, LLC, United States): writes the playbook from the text of what is said in the video.
Supadata (Dumpling Software UG, Germany): gets the text of what is said in a video; receives the video's link.
Resend (Plus Five Five, Inc., United States): sends our emails; receives your email address and the email.
Polar (Polar Software, Inc., United States): sells reads by card as merchant of record and takes the payment.
NOWPayments (FD Transfers LLC, Saint Vincent and the Grenadines): takes crypto payments.
Cloudflare (Cloudflare, Inc., United States): runs our domain's DNS and the redirect from www.

Your AI assistant (Claude, ChatGPT, Perplexity, Grok or another) receives your playbooks when you connect it; that is your choice, and the assistant's own policy applies to what it does with them.

8. Where your data goes

We are in the Dominican Republic and most of the companies above are in the United States, so your data is processed outside your country. We chose providers whose terms commit them to protect the data they process for us, and we send each only what its job needs.

9. How long we keep it

Your account, playbooks, links and reads: until you delete your account.
Sign-in sessions: until the session ends or you delete your account.
Payment records: as long as accounting and tax law require, also after you delete your account, without your name, email or address.
What is said in a video: only while the playbook is being written.
Technical logs: Google Cloud keeps request logs for 30 days.
Emails: our email provider keeps a record of each email it sent under its own terms.

10. How we protect it

Every connection to Cat & Paste is encrypted (HTTPS). The database is not reachable from the internet; our service reaches it through an encrypted tunnel. Access tokens are stored only as hashes, each person can only see their own data, and only the people who run the service can reach the systems. No system is perfectly safe; if a breach affects you, we will tell you and the authorities as the law requires.

11. Your rights

You can ask us to:

show you the data we have about you, and give you a copy (access and portability);
correct it (rectification);
delete it (cancellation or erasure); you can also do this yourself, see delete your data;
stop or limit using it where we rely on legitimate interests (opposition and restriction).

Write to hello@catandpaste.app from the email of your account. We answer within 30 days. You can also complain to the data protection authority where you live.

California residents: we do not sell or share your personal information, and we do not use it for targeted advertising.