Natty Hatty, Inc. (“Natty Hatty”) takes user safety—especially the safety of minors—extremely seriously.

We cooperate with law enforcement agencies (“LEAs”) in accordance with:

• Applicable U.S. federal and state laws

• Privacy and data protection regulations

• COPPA

• The Stored Communications Act (18 U.S.C. §§ 2701–2712)

• Valid legal process requirements

These guidelines explain how Natty Hatty responds to law enforcement requests, what data may be available, and how requests must be submitted.

1. Contact for Law Enforcement

Law enforcement officers may contact Natty Hatty directly at:

Subject Line: Law Enforcement Request

For emergency requests, include the subject line:

URGENT: IMMINENT HARM / CHILD SAFETY

Natty Hatty responds only to requests submitted by authorized officers acting in an official capacity.

2. Natty Hatty’s General Approach

• Complies with valid, properly served legal requests

• Protects the privacy rights of users and minors

• Requires appropriate legal authority before disclosing data

• Evaluates all requests for legal sufficiency

• Maintains internal logs and audit trails for accuracy

• Provides only the minimal amount of data necessary

Natty Hatty does not provide legal advice to law enforcement or users.

3. Required Legal Process

Natty Hatty may disclose certain categories of data only upon receipt of valid legal process, which may include:

3.1 Subpoenas

May compel disclosure of:

• Basic subscriber information

• Registration information

• Names, emails, phone numbers

• Payment history summaries (not full financial details)

• Organization association information

3.2 Court Orders or 2703(d) Orders

May compel disclosure of limited non-content records, including:

• Login timestamps

• IP logs

• Device metadata

• Account activity logs

3.3 Search Warrants

Required for disclosure of:

• Communication content

• Files, documents, or uploaded media

• Signature audit trails

• Any content information protected under SCA

Warrants must be signed by a judge and supported by probable cause.

4. Emergency Requests (Imminent Harm / Child Safety)

For emergencies involving threats to life, child safety, abduction, exploitation, or serious physical harm, Natty Hatty may disclose limited information without standard legal process consistent with:

• 18 U.S.C. § 2702(b)(8)

• 18 U.S.C. § 2702(c)(4)

Emergency requests must:

• Come from a verified law enforcement agency

• Explain the nature of the emergency

• Document that the data is needed immediately to prevent harm

Natty Hatty will:

• Prioritize the request

• Provide only the information necessary to address the emergency

• Require formal legal process after-the-fact when applicable

Natty Hatty maintains a strict zero-tolerance policy for child endangerment and cooperates fully in such cases.

5. Categories of Data Potentially Available

The availability of data depends on:

• User type

• Platform usage

• Payment activity

• Signature workflows

• Legal process submitted

Natty Hatty may possess the following data types:

5.1 Basic Account / Subscriber Information

• Name

• Parent/guardian name

• Email address

• Phone number

• Organization affiliation

5.2 Technical Logs

• Login timestamps

• IP addresses

• Device fingerprints

• Browser & OS metadata

• Security events

5.3 Payment-Related Information

Natty Hatty does not store full card numbers.

Available data:

• Transaction timestamps

• Last 4 digits of card (Stripe)

• Payment method type

• Refund/dispute logs

• Organization payout logs

Stripe retains additional financial data, which may require separate legal process to Stripe.

5.4 Signature & Document Information

Natty Hatty Signature preserves:

• Document hash

• Signing timestamp

• IP address

• Device metadata

• Audit trail logs

Signed PDFs themselves may require a search warrant.

5.5 Communications

Messages between coaches, parents, org admins, or staff may be disclosed only with a search warrant (content data under SCA).

5.6 Organization-Level Data

• Rosters

• Team assignments

• Program participation

• Attendance logs

Disclosure may require organization notice unless prohibited by law.

6. Data That Cannot Be Provided

Natty Hatty cannot disclose:

• Data not stored by Natty Hatty

• Deleted content that no longer exists

• Content stored exclusively by Stripe (separate request needed)

• Passwords or access credentials

• Encrypted or hashed data that Natty Hatty cannot decrypt

• Private encryption keys

Natty Hatty does not store:

• Full card numbers

• CVV codes

• Bank account numbers (only Stripe tokens)

7. Preservation Requests

Under 18 U.S.C. § 2703(f), law enforcement may request data preservation.

Natty Hatty will:

• Preserve requested records for 90 days

• Extend for another 90 days upon formal request

• Not disclose the preserved data without proper legal process

Preservation is performed silently without notifying the user unless legally required.

8. Cross-Border Requests

Natty Hatty handles data requests from non-U.S. agencies only through proper U.S. legal channels, such as:

• MLAT (Mutual Legal Assistance Treaty)

• Letters rogatory

• Domestic agencies acting on behalf of foreign governments

Natty Hatty does not provide data directly to foreign governments outside U.S. legal frameworks.

9. User Notice

Natty Hatty will notify users of law enforcement requests unless:

• The request includes a non-disclosure order

• Notice is prohibited by law

• Notification would risk harm to a minor

• Notification would impede an ongoing investigation

• The matter involves imminent threats or child protection

10. Cost Reimbursement

Under federal law, Natty Hatty may seek reimbursement for:

• Excessive data compilation

• Engineering time

• Complex or large-volume requests

• Expedited emergency processing

Standard responses may be provided at no cost at Natty Hatty’s discretion.