1. What This Policy Covers

This Privacy Policy applies only to data collected through:

• Blog reading activity

• Blog comment posting

• Blog Platform login using your Natty Hatty Customer App credentials

• Interactions with blog content

This policy does not apply to:

• Natty Hatty Platform (Business Center)

• Natty Hatty Customer App

• Signature product

• nattyhatty.com marketing website

• Payment pages or program pages

• Organization-created content

Those have separate privacy policies.

2. Information We Collect

We collect only the limited data required to support login, comments, analytics, and safety.

2.1 Information You Provide

• Name (from your Customer App account)

• Email address (from your Customer App account)

• Profile image (if you have one on your Natty Hatty account)

• Blog comments and replies

• Likes or reactions (if enabled)

• Reports or flags on comments

• Any voluntary information included in your comment text

Note: Do not include sensitive information (health data, ID numbers, payment data, or minors’ private information) in comments. Comments are public.

2.2 Information Collected Automatically

We may collect:

• IP address

• Device type

• Browser type

• Operating system

• Date and time of page visits

• Pages viewed

• Referral links

• Comment posting timestamps

• Login events (for security only)

2.3 Cookies & Tracking Technologies

The Blog Platform uses:

• Essential cookies (authentication)

• Analytics cookies (Google Analytics 4)

No advertising cookies are used.

Cookies help keep you logged in and measure page performance. See the Website Cookie Policy for details.

2.4 Information from Natty Hatty Customer App

When logging into the Blog Platform, we may access:

• Your verified user ID

• Basic profile data (name, email)

• Account status (active or suspended)

We do not access your:

• Payment data

• Rosters

• Program registrations

• Signatures

• Documents

• Organizations

• Minor profiles

• Private platform activity

Only minimal identity information is shared for login and comment attribution.

3. How We Use Information

We use collected data to:

• Authenticate your login to the Blog Platform

• Attribute comments to the correct user

• Display usernames and profile images (if enabled)

• Moderate comments for safety and abuse

• Detect spam, misuse, or harmful activity

• Respond to reports or safety violations

• Improve the quality of blog content

• Maintain security and performance of the Blog Platform

• Comply with legal obligations

We do not use Blog Platform data for marketing without consent.

We do not use Blog Platform data for AI or machine learning.

4. How Comments Work (Public Content)

Comments you post on blog articles are:

• Publicly visible to anyone

• Displayed with your name (and profile image if enabled)

• Permanently stored unless deleted by you or a moderator

Do not include:

• Personal data of minors

• Sensitive information

• Payment or financial information

• Contact details

• Confidential details

• Abuse or harassment

Violation of comment rules may result in removal or account suspension.

5. Sharing & Disclosure

Natty Hatty may share data with:

5.1 Service Providers (Subprocessors)

Your Blog Platform data may be processed by:

• AWS (hosting, infrastructure)

• Cloudflare (security & CDN)

• Google Analytics (analytics)

• SendGrid / Twilio (email notifications, if applicable)

These service providers process data strictly to support the Blog Platform.

Natty Hatty is PCI-DSS compliant via SAQ-A using Stripe (PCI Level 1 Service Provider) — however, no payment processing occurs on the Blog Platform.

5.2 Legal & Safety-Related Disclosures

We may disclose data when necessary:

• To comply with law enforcement requests

• To protect minors

• To address safety threats

• To prevent abuse, harassment, or fraud

• To comply with legal obligations

6. Children’s Privacy

Because Natty Hatty involves youth sports, minors may have accounts.

However:

• The Blog Platform is not intended for minors to post comments

• Only adults and verified guardians should engage with commenting features

If a minor posts a comment:

• We may delete it for safety reasons

• We may notify their guardian

• We may restrict their commenting ability

We comply with COPPA and child safety requirements.

7. Data Retention

We retain Blog Platform data as follows:

8. Your Rights

Depending on your location, you may have rights under:

• CPRA / CCPA

• GDPR

• UK GDPR

• Other applicable privacy laws

Rights may include:

• Access

• Correction

• Deletion

• Export / portability

• Opt-out of data sharing

• Restriction

Submit requests at:

9. “Do Not Sell or Share” (CPRA)

Natty Hatty:

• Does not sell personal data

• Does not share data for cross-context behavioral advertising

• Honors Global Privacy Control (GPC) signals

10. Security

We implement:

• TLS 1.2+ encryption

• AES-256 encrypted storage (AWS)

• Firewall and CDN protection (Cloudflare)

• Role-based access control

• Audit logging of login and comment activity

• Spam and abuse detection

No system is 100% secure, but we take reasonable steps to protect your data.

11. International Transfers

Your data may be stored in:

• AWS U.S. regions

• Cloudflare global edge network

We use:

• Standard Contractual Clauses (SCCs)

• Appropriate safeguards under GDPR

12. Changes to This Policy

We may update this Privacy Policy periodically.

The “Effective Date” reflects the most recent version.

13. Contact

For privacy concerns: