Privacy Policy

Last updated: 14 August 2026

CatchLeak is operated by Luis Cristian Aurrecoechea Di Giacomo, a sole trader registered in the United Kingdom (“we”, “us”). Contact: hello@catchleak.com. Postal address: 6 Southgate Drive, Towcester, Northamptonshire, NN12 6JQ.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration reference ZC220305. You can check it on the ICO’s public register at ico.org.uk.

This policy explains what personal data we collect on catchleak.com, why, and your rights under UK GDPR and the Data Protection Act 2018.

What we collect

• Your email address — only if you choose to enter it to receive your scan results.
• The workflow you paste — analyzed and then deleted (see below). We never store it.
• A summary of your scan (findings and score), not the original workflow.
• Payment data — handled entirely by Polar; we never see or store card details.

Lawful basis

• Providing the scan and delivering your report — performance of a contract / your request.
• Sending your results and support — your request / legitimate interests.
• Any marketing email — your consent, which you can withdraw at any time. (Our analytics is cookieless and needs no consent.)

Marketing email and how to stop it

We only send you promotional email (like “the guide is out”) if you ticked the separate, not pre-ticked box when you asked for your diagnosis. We record whether you ticked it and when, so we can show it. The diagnosis you asked for is not marketing — you requested it — and it arrives either way.

Every promotional email carries a one-click unsubscribe link, and we keep your address on a suppression list so it stays unsubscribed even if you scan again later. You can also just email hello@catchleak.comand we’ll do it by hand the same day.

Your workflow — we don’t keep it

The workflow you paste is analyzed in memory to produce your report and then deleted. We do not store it, and we do not connect to or access your n8n/Make account. Please don’t paste live secrets (API keys, passwords, tokens) — remove them first.

How long we keep data

• Workflow content: deleted right after the scan.
• Lead email: deleted 24 months after your scan, automatically — or sooner if you ask us.
• Unsubscribe list: kept indefinitely — it is the only way to keep not emailing you.
• Customer and transaction records: kept around 7 years (UK tax law).
• Technical logs: short retention; never the workflow content.

Processors

Polar (payments, Merchant of Record), Google Cloud (hosting and compute), Anthropic (the AI model behind AutoFix) and Microsoft 365 (email). Some process data outside the UK under appropriate safeguards (UK IDTA / SCCs / adequacy). We don’t sell your data, and we use no advertising or profiling providers.

Anthropic only ever sees a workflow you sent to AutoFix, and only with your credentials already replaced by placeholders in your own browser. The free scan uses no AI and never reaches them. AutoFix suggests a repair to a file — it makes no decision about you or anyone in your data, and nothing is decided about a person by automated means. You review every change before applying it, and you can always ask a human instead: write to hello@catchleak.com. Full terms for data you upload are in our Data Processing Agreement.

Your rights

You can access, correct, delete (right to be forgotten), restrict or object to processing, withdraw consent, and request portability. Email hello@catchleak.com — we answer within one month, free of charge. To stop marketing you don’t need to write at all: every promotional email has a one-click unsubscribe link.

Complaints — come to us first

If you are unhappy with how we handle your data, tell us: email hello@catchleak.comwith “data complaint” in the subject. We will acknowledge it within 30 days and answer without undue delay. You do not have to complain to us first, but it is usually faster. If you are still unhappy you can complain to the UK ICO (ico.org.uk), which can also be contacted at any time.

Cookies and browser storage

We set no tracking cookies. The law here covers anything stored on your device, not just cookies, so here is exactly what we keep in your browser:

• Your licence key — so your Pro unlock survives a page reload.
• Your language choice — so the site opens in the language you picked.

Both stay in your browser and you can clear them at any time from your browser settings. Because each is strictly necessary to deliver something you asked for, no consent banner is required. We run no analytics at all — no Google Analytics, no pixels, nothing that counts you. We use no advertising, tracking or profiling technology; if that ever changes, we will ask for your consent first where the law requires it.