Privacy Policy

    1. Data Protection Overview

    General Information

    The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

    2. Data Controller

    The data controller for this website is:
    Cypriot Tails (Private Initiative)
    Arch. Makarios III Avenue 235
    Limassol 3106, Cyprus
    Email: [email protected]

    3. Data Collection on This Website

    Cookies and Storage in Your Browser

    Our website stores only what its functions need, and only in your browser: the language you chose (a cookie), your answer to the consent banner and the cats you mark as favourites (local storage), the catalogue filters of your current visit and, if you sign in, your login session. This storage is necessary for these functions and needs no consent (§ 25(2) no. 2 TDDDG). We do not use it to recognise or track you, and you can delete it at any time in your browser settings.

    With your consent, which you give with "Accept" in the banner, Sentry also measures how quickly our pages load and records how they are used (Session Replay, see section 6); for the recording it keeps an identifier in your browser's session storage. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you click "Decline", neither happens, and the website works just the same. You can change your choice at any time with "Privacy settings" at the bottom of every page; withdrawing consent does not affect the processing carried out before.

    Server Log Files

    The website provider automatically collects and stores information in server log files that your browser automatically transmits to us. These include:

    • Browser type and version
    • Operating system used
    • Referrer URL
    • Hostname of the accessing computer
    • Time of the server request
    • IP address

    This data is not merged with other data sources. Data processing is based on Art. 6(1)(f) GDPR: we have a legitimate interest in presenting our website without technical errors and in keeping it secure, and the server log files are needed for both.

    Adoption, Foster and Flight Buddy Forms

    When you send us one of our forms, we receive what you enter in it:

    • Adoption application: your name, email address, phone number, country, city and postcode, and your answers about your home and household — the type of housing, whether you own or rent it (and your landlord's permission), a balcony or garden and how it is secured, the adults and children living with you, other pets, allergies — as well as your confirmations about the costs, collecting the cat and giving it time to settle in. The application names the cat you apply for.
    • Foster application: your name, email address, phone number, city and country, the type of housing, whether you have other pets, and your experience with cats.
    • Flight Buddy offer: your name, email address, departure date and airport, destination city and airline.

    We process this data to handle your request and, if it goes ahead, to arrange the adoption, the foster placement or the flight with you. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into an agreement).

    To protect our forms against spam and automated abuse, Cloudflare Turnstile checks every submission (see section 6), and we count submissions per IP address. For this we store a one-way hash of your IP address instead of the address itself. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in forms that are not abused.

    We do not pass this data on without your consent, except to the service providers named in section 6 that run this website for us.

    4. Your Rights

    You have the following rights regarding your personal data:

    • Right to information: You have the right to receive information about your personal data stored by us.
    • Right to rectification: You have the right to request the correction of incorrect personal data.
    • Right to deletion: You have the right to request the deletion of your personal data.
    • Right to restriction: You have the right to request restriction of processing.
    • Right to data portability: You have the right to receive your data in a structured, commonly used format.
    • Right to object: You have the right to object to the processing of your personal data.
    • Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.

    5. Data Security

    We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.

    6. Hosting and Third-Party Services

    We use the following services to run this website. When your browser contacts them, they receive your IP address and the technical data it sends with every request:

    • Vercel (Vercel Inc., USA) hosts the website and delivers its pages.
    • Cloudflare (Cloudflare, Inc., USA) routes all traffic to the website, speeds up its delivery and protects it against attacks. Cloudflare Web Analytics counts page views and measures loading times without cookies; Cloudflare Turnstile checks our forms for bots.
    • Supabase (Supabase Inc., USA; data stored in Zurich, Switzerland) stores our database, the photos of our cats and the data you send us through our forms, and manages user accounts (email address and password) if you register.
    • Sentry (Functional Software, Inc., USA; data stored in the EU) receives error reports (the error, the page, your browser and operating system) so that we can find and fix problems. Only with your consent (see section 3) does it also receive loading times and, in 10% of visits and whenever an error occurs, a recording of how the page was used (Session Replay: clicks, scrolling, page changes); these recordings mask all text, form entries and images.
    • wsrv.nl resizes the photos of our cats; your browser loads them from there.
    • On cat pages with a video, the preview image is loaded from the servers of YouTube (Google Ireland Limited, Ireland; Google LLC, USA). The video player itself only loads when you click play; from then on, YouTube's privacy policy applies and YouTube may set cookies.

    The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in a secure, fast and reliable website that shows our cats in photos and videos. This also covers Sentry's error reports and Cloudflare Web Analytics, neither of which stores anything on your device. Sentry's loading times and Session Replay run only with your consent (Art. 6(1)(a) GDPR, see section 3).

    Several of these providers are based in the USA, so personal data may be processed there. According to their own information, they safeguard such transfers through the EU–US Data Privacy Framework or the EU standard contractual clauses.

    For details, please refer to the privacy policies of these providers.

    7. Storage Periods

    We keep personal data only as long as we need it for the purpose we collected it for:

    • Adoption and foster applications: deleted automatically 12 months after you sent them.
    • Flight Buddy offers: deleted automatically 3 months after the departure date.
    • Adopters' contact details, which we keep with the cat's record to stay in touch about the cat: deleted once that follow-up has ended.
    • Hashed IP addresses from the form protection: deleted automatically after 24 hours.
    • User accounts: kept until you ask us to delete yours.
    • Records of the changes our team makes in the admin area (who changed what, and when): deleted automatically after 12 months.
    • Emails you send us: kept as long as we need them to deal with your request.
    • Server log files: deleted automatically by our hosting provider after 30 days at the latest.
    • Error reports and Session Replay recordings (Sentry): deleted automatically after 90 days at the latest.
    • Backups of our database: kept for up to 180 days, so data we have deleted can remain in a backup for that long.

    Our database carries out these deletions once a week, so applications, Flight Buddy offers, change records and IP hashes can stay up to seven days beyond their periods.

    We keep data for longer only where the law requires us to.

    8. Changes to This Privacy Policy

    We reserve the right to update this privacy policy to reflect changes in our data processing practices or legal requirements. The current version is always available on this page.

    Last updated: 01/10/2026