Privacy Policy

FatCat & Co. · fatcatandco.com · last updated 29 August 2026

FatCat & Co. produces a paid marketing score for a business owner about their own business. Everything in this policy follows from one principle: we process a customer's data to write that customer's own report, and for nothing else. We do not sell data, we do not share it with advertisers, we do not build profiles of anyone, and we do not use it to contact anybody.

The service is operated by IAHNH Rental Solutions Private Limited, the legal entity behind FatCat & Co.

1 · What we collect

From you directly: your email address (to sign you in), the answers you type into the questionnaire, any files you upload, the numbers you record in trackers, and the reports we generate from all of it. We also record which questions you viewed or skipped, and any feedback you leave on a report section.

From your public surfaces, at your request: your website, your YouTube channel statistics, your Google Business listing including its public rating and review text, your Apple App Store listing including its public reviews, your LinkedIn company page and its public posts, the LinkedIn profile you paste as the founder's (headline, follower count, public posts), and, when the account is not connected, your public Instagram profile and its latest posts. These are read when you ask for a score, and only for the surfaces you gave us. LinkedIn and Instagram are read through Apify, a data provider, at the addresses you gave; we never search for you by name, and a founder profile we did not get from you is read only when your own site links to it and it names your business.

From accounts you connect: see section 3.

2 · What we do with it

Your answers are scored by our own deterministic engine. Extracts are sent to Anthropic's Claude API to grade open-text answers and to write the narrative sections of your report. Uploaded documents and images may be read by the same models so we can tell you what is in them and how relevant each file was. Anthropic processes this as a service provider and does not train models on it.

We do not use your data, or data about anyone else that reaches us through your accounts, for advertising, for building or enriching any profile, for resale, or for any purpose other than producing and improving your own report.

3 · Meta Platform Data

If you connect Meta, we read the following from the accounts you tick for a specific business, strictly read-only:

• Instagram professional account: follower count, posts published, reach, saves, shares, likes and comment counts, the caption of your best performing post, a small number of comments left on your posts, and your own replies to them.
• Facebook Page: follower count, posts published, Page reach, recent post text, and comments left on your posts.
• Ad accounts: spend, impressions, clicks, click-through rate, cost per click, conversion actions and their reported value.

What we never do with Meta Platform Data. We never publish, post, comment, reply, message, or change anything on your accounts, and our application holds no permission that would allow it. We never use Platform Data for advertising or ad targeting, never build user profiles from it, never transfer or sell it, and never use it to contact any person. It is used solely to describe and analyse your own accounts inside your own report.

Comments and other people's words. A comment on your post was written by someone else. When one appears in your report it appears as a short quote attributed to the surface it came from, so you can see how people talk about your business. We do not store the commenter's profile, we do not attempt to identify them, and we never contact them.

Retention and revocation. Tokens are stored server-side and used only to read the accounts you ticked. Disconnecting in Settings deletes the token, deletes every stored asset record, and revokes the permission with Meta itself. You can also remove us from Facebook's own app settings at any time. Rows already rendered into a score you generated stay attached to that report until you delete the score or your account.

Data deletion requests can also be made at fatcatandco.com/data-deletion.

4 · Where it lives, and who processes it

Data is stored with Supabase (PostgreSQL and file storage) in the United States (N. Virginia), and the application runs on Vercel. Model processing is by Anthropic. Public-surface reads use Google APIs (YouTube and Places) and Apple's public store endpoints. Payments, when enabled, are processed by Dodo Payments; we never see or store your card details.

If you are in the EU or UK, transfers are covered by standard contractual clauses under our processors' data processing agreements.

5 · Who can see it

You. Every table is protected by row-level security scoped to your account, and connection tokens are readable only by our server. If you create a share link, anyone holding that link can read the rendered report only, never your answers, and you can revoke it at any time.

6 · Deleting your data

Settings → Delete everything removes your projects, answers, uploads, reports, share links, tracker entries, connected-account records and feedback, immediately and irreversibly. This is the full right to erasure, built into the product rather than handled by email. Deleting your account also ends any Meta connection and revokes it at Meta.

7 · Your rights

You may access, correct, export or delete your data, and you may withdraw consent for any connected account at any time by disconnecting it. If you are in the EU or UK you may also complain to your local supervisory authority. Requests reach us at the contact address in section 11 and are answered within 30 days.

We do not delete your data on a timer. It stays until you delete it, or until you delete your account, whichever comes first.

8 · Requests from public authorities

We have never received a request from a government body, a court or a law enforcement agency for customer data, and we have never disclosed any. If one arrives, this is what happens, every time:

• We check that it is lawful. Every request is reviewed against the law it claims to be issued under before anything is disclosed. A request that names no valid legal basis, or that is not properly served, is refused.
• We challenge it if it is not. Where a request looks unlawful, overbroad or improperly issued, we object to it, and contest it where that is available to us, rather than complying with it.
• We disclose the minimum. Only the specific records the request actually reaches are produced. Never a whole account, and never Meta Platform Data the request does not cover.
• We write it down. Each request, who made it, the legal basis claimed, our reasoning, and exactly what we did or did not hand over, is recorded and kept.
• We tell you. We notify the affected customer, unless the law forbids it, in which case we notify them as soon as that restriction lifts.

9 · Children

The service is for businesses and is not directed at anyone under 18.

10 · Changes

When what we collect changes, this page changes on the same day, and the date at the top moves with it. Material changes are announced in the product.

11 · Contact

ishan718@gmail.com