Data Processing

Roles

For the data of your customers (orders, addresses, messages, payments of your store), you are the controller and Noviantis Inc is the processor: it processes that data to run your store, on your instructions, and for nothing else. For the data of your own account, Noviantis Inc is the controller, as described in the privacy policy.

Our providers

The companies that process data for Katching are named, with their country, their role and what each one receives, on the subprocessor page. That page carries the date of its last change, and Katching gives thirty days of notice before it adds one.

The Katching site sends its visits to no analytics tool. The administration of a store can use PostHog for the events of that store, and PostHog is named on the subprocessor page. If you connect an analytics or advertising tool to your own storefront, that tool is your provider, not ours.

Payment providers, on both rails

Stripe and PayPal are the payment providers of Katching on both rails. When you connect your own account, your customers' payment data goes to the provider you chose, under the agreement you have with it; Katching never sees a card number.

On the Katching Payments rail, when you activate it, the data you provide to open your connected account, which is your identity, your business and your bank details, is transmitted to the processor for the verification the law requires of a payment provider, and the payments of your store are processed on the platform account of Katching with that processor. The detail is in the Katching Payments Terms.

Transfers

Everything is processed in the United States, by Noviantis Inc and by the providers named on the subprocessor page. If your customers are in the European Union or elsewhere, their data leaves their country to be processed there. Noviantis Inc has not signed standard contractual clauses at this date; if you need a data processing agreement with specific clauses for your business, write to hello@katching.ai before you open your store.

What we do to protect it

Every connection is encrypted (HTTPS everywhere, with HSTS for one year). Passwords are stored as hashes, sessions as hashes of their token, and the secrets of a store (its payment keys, its admin password) are encrypted at rest. Each store has its own backend, its own database and its own cache. Access to the production systems is restricted to the people who operate the service. The detail is on the security page.

If something goes wrong

If we learn of a breach that affects the data of your store or of your customers, we notify you by email within 72 hours of learning of it, with what we know, what it affects and what we are doing about it. Where a payment account is involved, Katching also notifies its payment processor.

When you leave

On written request, you receive a full copy of the data of your store within five business days. When the store is destroyed, its database and its services are deleted; the host's automated backups of the shared database instance still hold a copy until they expire, within seven days. Our providers delete what they hold under their own retention terms.

Version history