FetchKat — Privacy Notice
Effective date: November 14, 2026. This notice describes FetchKat during its restricted development stage. It does not authorize real client financial-record uploads.
Operator and privacy contact: Alexander Estrela, operating as FetchKat, an Ontario-registered sole proprietorship (not an incorporated company).
Location: Ontario, Canada.
Privacy, support and deletion requests: fetchkat@outlook.com.
Service: FetchKat (fetchkat.com); the current application is a restricted development/staging service.
Effective date: November 14, 2026.
1. Summary and current service status
FetchKat provides bookkeeping firms with client document checklists, file submissions, review statuses, due dates, and document-related questions and replies. A firm chooses its clients and the documents it asks for; a client accesses only the portal associated with that firm's account. FetchKat does not itself provide accounting, bookkeeping, tax, legal or financial advice.
Currently, public registration and general real-client financial-data use have not been authorized. The hosted service has used controlled real-inbox tests and fictional financial data. This notice explains the intended service and the current verified staging arrangements; any approved real-data pilot must operate consistently with the notice as published.
2. Information handled
Depending on how the service is used, the application may process:
- Firm and client identity: firm or business name, email address, client name and contact email, and related account identifiers.
- Accounts and security: password hashes (not plaintext account passwords), session and security-token records, invitation and email-verification status, password recovery records and authentication-related activity.
- Bookkeeping workflow: requested-document names and descriptions, deadlines, checklist and review status, messages, replies, firm-only notes, document history and activity records.
- Files: submitted file content, filenames, upload metadata, private storage references, and records of authorized access and downloads.
- Support and operations: messages sent to support, requests for access/export/correction/deletion, troubleshooting and incident records, deletion-queue records, and records associated with backups or restoration.
- Technical information: information involved in service requests and hosting or email-provider operations, potentially including IP addresses, timestamps, error and delivery records. Detailed provider log-retention settings still require verification.
Because bookkeeping records may be sensitive, only information the participating firm and its clients have authority to share should be submitted. Real customer financial records must not be uploaded while the site remains development-only.
3. Why the information is used
Information is processed to create and secure accounts; authenticate firms and clients; deliver invitations and password-reset or verification messages; manage requested documents, checklists, reviews and conversations; process uploads and downloads; help with support and privacy requests; address suspected misuse or incidents; and maintain, back up and recover the service when feasible.
The firm decides what it asks its clients to provide and must identify its own purposes and obtain any necessary authority or consent. An end-client may need to contact their bookkeeping firm regarding the firm's particular collection and use of information. We do not currently use uploaded document content for third-party advertising or marketing. Any materially new purpose would require appropriate disclosure and, where applicable, consent.
4. Access and third-party providers
Access within the application is intended to be limited to the appropriate authenticated firm and its assigned clients. The operator may access information to maintain the service, investigate a problem, or act on an authorized support or privacy request. The service also depends on these providers:
| Provider | Role | Location and known limitation |
|---|---|---|
| Render | Hosts the application | The verified staging web service is in Oregon, United States. Other environments may differ. |
| Supabase | Database and private uploaded-file storage | The verified staging project is in AWS us-east-1 (Northern Virginia, United States). |
| Resend | Sends invitations, verification and recovery emails | Sender onboarding@fetchkat.com and controlled-inbox delivery were tested. The provider's full processing and storage locations have not been independently verified. |
| Google Drive | Stores independently encrypted offsite backup copies | An encrypted staging backup and isolated restore were verified. The physical storage location is not established, and automatic backup expiry has not been enforced. |
| GitHub Actions | Runs the scheduled backup workflow on hosted runners | Backup exports are handled temporarily by the workflow before encryption and offsite transfer. Scheduled execution succeeded at least once, but newer runs have been blocked by GitHub account Actions usage/billing restrictions. |
| Microsoft Outlook | Hosts fetchkat@outlook.com for support and privacy email |
Specific processing/storage locations are not independently established. |
| Stripe | Payment integration under test mode | No live paid subscriptions have been authorized; payment-related disclosures must be updated before any live billing. |
Information may be processed outside Canada, including in the United States, and may be subject to the laws of those locations. Provider contracts, sub-processors and final production locations should be reviewed before authorizing sensitive real-customer data.
5. Cookies and browser storage
The application uses necessary, protected browser session cookies for firm and client sign-in. A firm session cookie may last up to seven days unless invalidated earlier. Some browser storage is used for interface settings, independent firm sessions in separate tabs, and client message-notification read status. The reviewed application pages do not include a third-party advertising-pixel or analytics-script integration, but hosting and other providers may maintain operational logs. These arrangements should be rechecked when the live service changes.
6. Access, correction, export and deletion
Authorized firms can export certain account, client and workflow metadata and retrieve private files through the application's export features. A firm can remove a client using a confirmed deletion flow. The development application also has a firm-account closure flow. These actions remove relevant active application records and arrange cleanup of associated private uploaded files; file deletion may be queued and completed later, not instantaneously. The functions are not a guarantee that all historical provider records or backups are erased at the same moment.
For access, correction, an additional export, deletion, account closure or a privacy complaint, email fetchkat@outlook.com. We will first verify identity and authority. Requests involving a firm's end-client may require coordination with that firm. Information may need to be retained where law requires or permits it, or while a legitimate request is assessed.
7. Retention and backups
Active account and workflow information is generally kept while needed to operate the account and for applicable legal or operational purposes. Following an authorized deletion or closure, active records can be removed, but related files may remain in cleanup queues until removal succeeds. Some information may remain in limited support, security or audit records and encrypted backup copies.
There is currently no verified automatic expiry/deletion deadline for encrypted offsite backups. A 30-day retention approach has been considered but is not enforced, and no promise of removal within 30 days is made. Scheduled encrypted backups have succeeded, but subsequent scheduled runs were prevented from starting by a GitHub Actions account restriction; reliable continued scheduling is not yet established. The intended data-retention/deletion rules and actual backup lifecycle must be verified before a real-data pilot. We will not describe old backups as already erased when they have not been verified as deleted.
8. Security and incidents
The application uses account authentication, access controls intended to separate firms and clients, private file storage, and controlled session handling. These measures reduce some risks but do not guarantee absolute security. Suspected unauthorized access or a privacy concern can be reported to fetchkat@outlook.com. Do not send passwords, reset links, API keys or sensitive financial documents in ordinary support email.
9. Questions, complaints and changes
Contact Alexander Estrela, operating as FetchKat, at fetchkat@outlook.com with a privacy question or complaint. We will assess the request and explain an appropriate response, including any verified remaining retention exceptions. If a material practice changes, this notice will be updated and further notice or consent will be sought where required.