Back
Privacy
Natty Hatty — Website Privacy Policy
Effective Date: November 15, 2025
Version: v1.1
This Privacy Policy describes how Natty Hatty, Inc. (“Natty Hatty,” “we,” “our,” or “us”) collects, uses, stores, and protects information through our public-facing website and publicly accessible pages hosted by Natty Hatty, including:
nattyhatty.com and all marketing/product pages
Demo request, contact, and support forms
Public program/event pages created by Organizations
Public registration and transactional pages
Public-facing Natty Hatty Signature pages accessed via link or QR code
This Policy does not apply to the Natty Hatty Business Center, Customer App, or authenticated platform functions.
Those are covered under the Natty Hatty Platform Privacy Policy.
By using the Natty Hatty website or any publicly hosted Natty Hatty page, you agree to this Privacy Policy.
1. Information We Collect
1.1 Information You Provide Directly
When you interact with our public website or public organizational pages, you may provide:
Name
Email address
Phone number
Organization name
Job title
Form submissions (demo, contact, support)
Messages and inquiries
Information entered into organization-created program pages (ex: child’s name, parent info)
For transactional pages (registrations, events, payments), you may also provide:
Parent/guardian details
The minor’s name (entered voluntarily by the parent)
Program selections
Billing information
Payment details (processed by Stripe)
Natty Hatty does not knowingly collect data directly from children.
1.2 Information Collected Automatically
We collect limited analytics and performance data:
IP address (anonymous or truncated when possible)
Browser and device information
Operating system
Pages visited
Time spent on page
Referring website
Interactions with elements
General geolocation (city-level)
Crash logs & performance data
This is standard for SaaS and marketing websites.
1.3 Cookies & Tracking Technologies
We use cookies for:
Website performance and uptime
Analytics
Demo/contact form persistence
Payment and security support (Stripe cookies)
Fraud prevention
Session continuity when transitioning into login pages
We do not use:
Behavioral advertising cookies
Retargeting campaigns
Cross-site tracking
Cookies that “sell” or “share” personal data under CPRA definitions
See the Cookie Policy for details.
1.4 Information Collected on Natty Hatty Signature Pages
Organizations use Natty Hatty Signature to obtain legally binding digital signatures from customers.
These signature pages are hosted on Natty Hatty’s website and are accessible via:
Direct links
Emails
Text messages
QR codes
When you sign a document on a Natty Hatty Signature page, we collect:
Name and email (as entered on the form)
Any additional fields required by the Organization
Signature (typed, drawn, acknowledged, or uploaded)
IP address
Device metadata (browser, OS, device type)
Timestamps of all signature events
Document hash (tamper-evident integrity value)
Authentication method (if used)
Minors’ information may appear only when provided by the parent/guardian.
Legality & Compliance
Natty Hatty Signature is fully compliant with:
ESIGN Act (U.S.)
UETA
eIDAS (EU)
Once a signature is submitted, the document and audit trail become part of the Natty Hatty platform and are governed by the Natty Hatty Platform Privacy Policy.
Below is a fully polished, legally compliant section you can insert directly into the Natty Hatty Website Privacy Policy.
It covers:
Automatic account creation
Lawful basis
Data use
Temporary credentials
Security
User rights
CPRA/GDPR compliance
Transparency at checkout
1.5 Automatic Account Creation After Checkout
Automatic Creation of a Natty Hatty Customer Account
When a user completes any transaction on the Natty Hatty website (including payments for programs, events, bookings, memberships, or signature-required documents), Natty Hatty automatically creates a Natty Hatty Customer App account on the user’s behalf.
This account is created to:
Provide access to order receipts and transaction history
Enable viewing, editing, or downloading signed documents
Allow management of participant information
Support refund processing, if applicable
Maintain compliance with e-signature, payment, and record-keeping requirements
Ensure secure, authenticated access to sensitive transaction records
Information Used to Create the Account
To generate this account, Natty Hatty uses the information voluntarily provided during checkout, including:
Name
Email address
Phone number (if provided)
Order and payment details (non-card data only)
Any participant information added during checkout (e.g., athlete details)
Natty Hatty does not store full payment card numbers. All payment data is handled by Stripe (PCI-DSS Level 1).
Temporary Login Credentials
After the account is created:
Natty Hatty sends the user an email containing temporary login information
The user is prompted to reset their password upon first login
Until password reset, the account remains protected by token-based authentication and email validation
Why This Is Required
Automatic account creation is necessary to:
Deliver purchased services
Provide access to transaction records
Comply with e-signature retention laws
Comply with PCI, audit, and refund requirements
Ensure secure access to minor-related data (for youth sports compliance)
Prevent unauthorized access to sensitive documents
Legal Basis (GDPR / UK GDPR)
For users in the EU/UK, automatic account creation is processed under:
Article 6(1)(b) — Contractual necessity
Article 6(1)(c) — Legal obligation (records, signatures, payments)
Article 6(1)(f) — Legitimate interests (security, fraud prevention, customer access)
CPRA / CCPA Notice
Under California privacy law:
This data is not sold or shared for cross-context advertising
Creating an account is considered a “service-level processing activity”
Users may request deletion (subject to legal retention obligations)
User Rights & Controls
Users may:
Log in to update their information
Change their password at any time
Request correction or deletion of their Customer App account
Request deletion of comments, signature data, or non-mandatory records
Opt out of promotional emails (transactional emails cannot be opted out)
Requests may be submitted to:
Data Retention
Order and signature records must be retained as required by:
E-signature laws (ESIGN, UETA)
Payment dispute requirements
Legal, audit, and compliance standards
After these periods expire, data is securely deleted.
2. Payment Information (Transactional Pages)
When a customer pays through a Natty Hatty-hosted payment page:
Payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor
Natty Hatty never stores full card numbers or CVV codes
Stripe may place cookies to support fraud detection
Billing details and payment metadata are passed to the Organization that created the program
Payment data falls under Stripe’s Privacy Policy as well.
Signatures Without Payment
If you’re only signing a document, no payment info is collected.
Signatures With Payment (Combined Flow)
When signature + checkout happen together:
Signature flows through Natty Hatty Signature
Payment is processed entirely by Stripe
The two systems remain logically separate
3. How We Use Information
We use website and public-page information to:
Respond to demo or contact requests
Facilitate documents and signatures
Support program/event registrations
Process payments (via Stripe)
Improve website performance and security
Provide customer service
Detect fraud or suspicious activity
Maintain legal compliance
Improve marketing effectiveness (opt-in only)
We do not:
Sell personal information
Share data for targeted advertising
Use AI/ML models to train on customer data
Create behavioral profiles
4. How We Share Information
Natty Hatty does not sell or share personal information for advertising.
We may share information only with:
4.1 Service Providers (Categories Only)
Website hosting providers
Analytics vendors
Email/SMS communication services
Cloud infrastructure providers
Customer support systems
Stripe (for payments)
These providers act under strict contracts and process data only as needed.
4.2 Organizations Using Natty Hatty
If you sign or register through a page hosted for an Organization, we share:
Registration details
Payment information needed to fulfill the transaction
Signed documents and audit trails
Parent/guardian information
Minor data (provided by parent)
Natty Hatty is not responsible for how Organizations use this data.
4.3 Legal Requirements
We may disclose information to:
Law enforcement
State or federal agencies
As required by law, subpoena, or court order
We follow our Law Enforcement Guidelines.
5. Do Not Sell or Share My Personal Information (CPRA/CCPA)
Natty Hatty:
Does not sell personal information
Does not share data for cross-context behavioral advertising
Honors Global Privacy Control (GPC) signals
Provides a “Do Not Sell or Share” page for California residents
6. Security
Natty Hatty uses enterprise-grade security controls:
TLS 1.2+ encryption in transit
AES-256 encryption at rest
AWS-hosted infrastructure
Firewall/WAF protections
Rate-limiting & anti-bot controls
Fraud detection (login, payment, signature)
Immutable audit trails for signatures
Regular security monitoring
We never use signature, payment, or minor data for AI or model training.
7. Data Retention
We retain website visitor data only as necessary to:
Fulfill your requests
Assist Organizations
Maintain signature validity
Meet legal requirements
Improve website performance
Signature documents and audit trails are retained according to:
Legal compliance
Organization requirements
Natty Hatty Signature retention policies
Payment data follows Stripe’s retention rules.
8. Children’s Privacy
The Natty Hatty website and public pages:
Are not directed to children under 13
Do not knowingly collect data directly from children
Only receive minor information when submitted by a parent/guardian on registration or signature pages
Minors’ data becomes protected under the Natty Hatty Platform Privacy Policy and COPPA requirements once submitted.
9. Your Privacy Rights
Depending on your location, you may have the right to:
Access your personal data
Correct inaccuracies
Request deletion
Opt out of marketing
Opt out of sale/share (we do not sell/share)
Limit sensitive data use
Withdraw consent
Submit requests to:
Natty Hatty honors GPC signals automatically.
10. Third-Party Links
The website may contain links to third-party sites.
Natty Hatty is not responsible for those sites’ privacy practices.
11. Updates to This Policy
We may update this Privacy Policy periodically.
The “Effective Date” will reflect the latest version.
If material changes occur, we will notify users where appropriate.