Draft, not yet in force. The highlighted [blanks] are still being completed.
Privacy policy
Who we are. Big Cat is a service of Aliya Akhmetkereeva EI (details in the Legal notice), who is responsible for your personal data. Contact: contact@bigcat.website.
What we collect, and why:
| What | Why | Legal basis | Kept |
|---|---|---|---|
| Your email address | To sign you in: a one-time code or link by email, or Google, or a password if you create one | Contract | While you have an account, then 30 days (NEW 2026-10-29, for approval) |
| Your words (name, what you do, story, offers, contact) | To build your site | Contract | Until you delete them or your account |
| Your photos | To show them on your site | Contract | Until you delete them or your account |
| The design you love | We keep only its link or a note; we read its colours and mood only | Contract | Until you delete your site |
| Your free first look, before you sign up (your words and the picture of the design you love) | To write and design your first page with AI | Steps you ask for before a contract | Not kept by us; our AI provider deletes it within 30 days |
| What you ask the cat designer | To answer you and change your site | Contract | Not kept by us (the chat stays in your browser); our AI provider deletes it within 30 days |
| Your plan (Stripe's reference, paid or not, until when) | To turn your plan on and off | Contract | While you have an account |
| Your invoices (name, email, amount, date) | Accounting | Legal obligation | 10 years (French accounting law) |
| Technical logs (IP address, time, errors) | Security and preventing abuse | Legitimate interest | 30 days |
| The safety check (your site's words, the photos you upload and the links on your site) | To keep illegal and banned content off Big Cat, and report the worst to the authorities | Legitimate interest; legal obligation for reports to the authorities | Our AI provider deletes it within 30 days; we keep a fingerprint of what was checked, its answer and, if something is held or blocked, a short record, for 1 year (NEW 2026-10-29, for approval) |
| Your email, if you ask to stay updated about a coming plan | To send you one email when it opens | Your consent | Until you unsubscribe (a link in that email), and at most 3 years (NEW 2026-10-29, for approval) |
| Your emails to us (name, email, message) | To answer you | Contract, legal obligation or legitimate interest | 3 years after our last exchange; 5 years if it is about a contract or a disagreement (NEW 2026-10-29, for approval) |
Signing in. By default, we email you a one-time code or link: no password needed. If you choose "Continue with Google", Google sends us your email address, and also your name and profile picture, which we don't use; your Google account itself is covered by Google's privacy policy. If you create a password in My account, only a scrambled version of it (a hash) is stored, by Supabase: nobody, not even Big Cat, can read it. (NEW 2026-10-29, for approval)
Staying updated. If you leave your email under a coming plan ("Stay updated"), it goes only to Big Cat's own list at MailerLite, kept apart from any other list. We send you one email when that plan opens, nothing else, with a link to unsubscribe. (NEW 2026-10-29, for approval)
Your free first look. Before you sign up, your draft stays in your browser. It moves into your account when you sign up, and is erased if you choose "Forget this draft on this device" or leave it untouched for 30 days. To write your first page, our server sends your business name and your description to our AI provider, Anthropic (Claude), plus the words of your own web page if you paste its link. To read the feeling of the design you love, it also sends that design's picture: the screenshot you drop, or the page or picture behind the link you paste. Your own photos are not sent to the AI at this step. We keep none of this: it is used once, for your answer. (NEW 2026-10-29, for approval)
What we never do. We never sell your data, never share it with other clients, never use it to train AI, and never add advertising trackers to your site or to ours. We use no analytics cookies.
Your photos. Before a photo can appear on your site, we remove its hidden data (like the GPS location and the camera details) and save a fresh copy. The original stays private: only you can see it. From the moment you upload them, your photos also go through the safety check below. (NEW 2026-10-29, for approval)
The safety check. When you upload a photo, before your site or a change goes live, and every 3 days while your site is online, our AI provider, Anthropic (Claude), reads your site's words and the photos you uploaded, only to check them against the law and our terms. It works for us as a processor: it may not train on them, and it deletes them within 30 days; if something breaks its usage policy, it may keep that for up to 2 years. Google Web Risk receives only the addresses of the links on your site, to check them against its list of dangerous pages. We also use Cloudflare's tool, which compares photos on published sites with fingerprints of known child-abuse images (lists from NCMEC, the US child-protection centre) and reports any match. So that the same thing is not checked twice, we remember a fingerprint of what was checked (a code that identifies it, not the words or the picture) and its answer. If something is held or blocked, we also keep a short record: your account, the site, the time, the categories, a short reason and which photo it was. A held photo is kept as a private, cleaned copy (only you and a person at Big Cat can see it) until that person decides. For suspected child sexual abuse material, we keep only your account, the time, the category and the photo's fingerprint: no copy of the image, no site, no words; and a person at Big Cat reports it to the authorities (in France: PHAROS). Anything held is looked at by a person at Big Cat before it can go live, and you can always ask a person to look again at a decision. Legal basis: our legitimate interest in keeping illegal and banned content off Big Cat and protecting people; and, for reports, our legal obligation (French law LCEN, art. 6, and the EU Digital Services Act, art. 18). Fingerprints and records are deleted 1 year after the check or the decision, or kept longer only if the authorities or a court need them; a decision made by a person is kept with its fingerprint, so the same thing is not held again. (NEW 2026-10-29, for approval)
Who helps us (processors): Supabase (database, sign-in and files; EU, Frankfurt); Vercel (runs this website); Cloudflare (published client sites and their files, and our encrypted daily backups, all stored in the EU; it also checks photos on published sites against known child-abuse images); Google (Web Risk: checks the addresses of the links on client sites against its list of dangerous pages); Resend (sign-in emails, sent from Ireland); Anthropic (the AI, Claude, which also runs the safety check: it deletes what we send within 30 days, or within 2 years if it is flagged for misuse, and may not train on it); Stripe (payments, through Stripe Payments Europe in Ireland: Stripe handles your card; Big Cat never sees it); MailerLite (the "Stay updated" list only: a European company, your email stays in the EU). Vercel, Cloudflare, Google, Resend, Anthropic and Stripe are US companies or part of US groups; transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Supabase is a company from Singapore and the US: your data stays in Frankfurt, and any access from outside the EU (for example by its support team) is covered by the Standard Contractual Clauses. Any new helper is listed here before it is used. (NEW 2026-10-29, for approval)
Counting visits, and why people leave. To see where people stop, we count each day how many visits reach each step (the home page, the steps of your first look, asking for the sign-in code, publishing, opening a payment link), split only by language, by phone or computer, by country, and by where the visit came from in one word (like Google, Instagram or a link typed in); on the home page we also count how far down people read. No cookie, no identifier, no IP address: only these totals, kept 25 months at most. When you cancel your plan or delete your account, we may ask why: answering is optional, and your answer (and your note, if you write one) is kept without your name, email or account, for 25 months at most. Legal basis: our legitimate interest in making Big Cat better. (NEW 2026-10-29, for approval)
Your rights. You can see, correct, download or delete your data at any time, object to or restrict its use, and complain to the CNIL (cnil.fr). In your account: "Download my data" gives you everything we hold about you in one file; "Delete my account" deletes it all 30 days after you ask (you can change your mind during those 30 days), and our backups roll over within 7 days after that. Invoices are the exception: the law makes us keep them for 10 years. You can also write to contact@bigcat.website; we answer within one month.
Proof of what you accepted. We keep a record of which version of these texts you accepted and when, and whether you switched AI help on or off. No IP address, no device details. (NEW 2026-10-02, for approval)
AI help. Before you sign up, your free first look uses AI, as explained above. In your account, your words and what you ask the cat designer go to our AI provider only while "AI help" is on, and you can switch it off at any time. Our AI provider is Anthropic (Claude); it may not use your data to train its models. (NEW 2026-10-02, for approval) The safety check is the one exception: it always runs, because nothing goes live or stays online without it. (NEW 2026-10-29, for approval)
Reports about a site. If you report a site hosted by Big Cat, we keep your name, e-mail and report to handle it, for 1 year. (NEW 2026-10-02, for approval)
Age. Big Cat is for people aged 18 and over.