Privacy Policy

Effective and last updated: September 12, 2026.

Phat Cat's treats privacy as an operating rule, not a marketing slogan. This policy explains what the Phat Cats website collects, why we collect it, who can access it, how long ordinary technical records and backups are retained, and what you can ask us to do with your information.

Our privacy commitments

• We do not sell personal information.
• We do not rent mailing lists.
• We do not use personal information for cross-site behavioral advertising.
• We do not currently run Google Analytics, Meta/Facebook Pixel, Hotjar, advertising pixels, or comparable third-party behavioral trackers on the public site.
• We do not ask applicants or members to provide passwords, government ID numbers, bank-account numbers, credit-card numbers, medical records, or other unnecessary sensitive real-world information through ordinary public forms.
• Employee, merchant and contact submissions are not public website content. They are intended for authorized operational review.
• We do not publish private Second Life IMs or real-world personal information merely because someone has interacted with the venue.

1. Scope

This policy applies to phatcatssl.com and the information Phat Cat's controls through its website accounts, membership forms, newsletter, employee and merchant applications, contact forms, staff systems, and associated web/mail infrastructure. It does not govern Linden Lab, Second Life itself, a merchant's separate store, a performer's separate site, or another third-party service you choose to visit.

2. Information we collect

Membership and account information

When you create a website membership, we may collect your website username, email address, Second Life username, optional display name, newsletter preference, account status, and account timestamps. Passwords are not stored in readable form; the site uses Django password hashing. Authorized staff cannot retrieve your original password from the stored hash.

Newsletter information

Newsletter records may include your email address, optional name, optional Second Life username, confirmation status, unsubscribe status, confirmation token, and timestamps. Subscription requires confirmation before ordinary newsletter delivery. Every subscriber can unsubscribe.

Employee / staff applications

An employee or staff application may include the role requested, Second Life username, optional display name, email address, time zone, availability, experience, role-specific answers, sample or portfolio URL, references, agreement to venue rules, application status, staff review notes, and submission/update timestamps.

Merchant applications

A merchant application may include brand name, Second Life username, email address, category, Marketplace or portfolio URL, store/product description, requested space, agreement to venue rules, application status, staff notes, and submission timestamp.

Contact messages

The contact form may collect the name you provide, email address, optional Second Life username, subject, message, message status, and timestamp.

Staff operational records

For people who actually work with Phat Cat's, operational records may include staff account information, notices, assigned role, scheduled shifts, application decisions, staff notes, login/security records, and administrative audit information reasonably needed to operate the venue and protect the systems.

Technical and security information

Like most web servers, our infrastructure can record technical information such as IP address, request date/time, requested path, HTTP status, referrer information when a browser sends it, browser/user-agent information, and security/rate-limit events. We use this information for site operation, troubleshooting, abuse prevention, security, and incident investigation—not to build advertising profiles.

3. Cookies

The site uses cookies and browser storage that are necessary for core functions such as login sessions, CSRF protection, and secure form handling. Session cookies are configured as Secure and HttpOnly where appropriate, and the site requires HTTPS. We do not currently use advertising cookies or third-party behavioral-tracking cookies on the public website.

Because the current public site uses only operational/security cookies rather than advertising or cross-site profiling cookies, we do not display a fake "accept tracking" banner for trackers we do not use. If we later add a non-essential tracking technology, this policy must be updated and any consent mechanism required by applicable law must be implemented before relying on it.

4. Why we use information

We use personal information only for legitimate venue and website purposes, including to:

• Create, authenticate, secure, and administer accounts.
• Provide requested membership and community features.
• Send newsletters or event communications you requested and confirmed.
• Review employee, performer, DJ, host, manager, security, or merchant applications.
• Respond to contact requests and provide support.
• Schedule staff and operate events.
• Prevent fraud, spam, harassment, malicious access, credential abuse, and technical attacks.
• Investigate serious conduct, safety, moderation, or security incidents.
• Maintain backups, logs, reliability, and business continuity.
• Comply with valid legal obligations and protect legal rights.

Where a jurisdiction requires a formal legal basis for processing, the applicable basis may include your consent, steps you asked us to take, performance of an agreement, legitimate operational/security interests, or compliance with law, depending on the specific activity.

5. What we do not do

Phat Cat's does not sell personal information, does not rent its mailing list, does not intentionally combine website records with unrelated data-broker profiles, and does not use public-site data to follow you across unrelated websites for behavioral advertising. We do not intentionally expose applicant, contact, or account records in public search results.

6. When information may be shared

Personal information may be shared only when reasonably necessary with:

• Authorized Phat Cat's staff who need the information for the role they are performing.
• Infrastructure/service providers that host, transmit, back up, secure, or otherwise process data for the website and mail systems, subject to the access inherent in providing those services.
• Professional advisers or legal authorities when reasonably necessary to obtain advice, respond to valid legal process, comply with law, investigate fraud/abuse, or protect people, property, systems, or legal rights.
• A successor operator if the venue or website is legitimately transferred, provided the data remains subject to applicable privacy obligations.

We do not treat "someone is curious" as a valid reason to disclose another person's private account, application, email, contact-message, or real-world information.

7. Second Life identities and private communications

A Second Life username or display name may already be visible inworld, but that does not make every piece of information connected to that identity public. Phat Cat's will not intentionally publish your email address, application materials, private website account information, or real-world information simply because your Second Life identity is public.

Private IMs, incident reports, screenshots, and moderation records are treated as sensitive operational material. They may be reviewed or disclosed when reasonably necessary for a legitimate moderation, safety, fraud, legal, or security purpose, but they should not be republished for gossip, retaliation, humiliation, or entertainment.

8. Security

Phat Cat's uses technical and operational safeguards appropriate to the current site, including HTTPS, HSTS, secure cookies, CSRF protection, password hashing using strong Django-supported algorithms, access controls, rate limiting on sensitive public forms, restricted staff interfaces, system backups, and server/security logging. Sensitive infrastructure credentials are not intentionally exposed in public pages.

No website can promise absolute security. If we discover a breach affecting personal information, we will investigate, contain it where reasonably possible, preserve evidence as appropriate, and provide legally required notice when applicable.

9. Retention

We do not want to keep personal information forever merely because it was once submitted. Retention depends on the reason the information exists:

• Ordinary Nginx web access/error logs are configured for daily rotation with 14 rotations under the current server policy.
• Normal automated server/database backups are currently retained for approximately 14 days before automated deletion. A deleted live record may therefore remain temporarily inside a protected backup until that backup expires in the normal rotation.
• Newsletter records are retained while needed to provide the subscription and may retain a minimal suppression/unsubscribe record so we do not accidentally resubscribe someone who opted out.
• Membership records are retained while the account is active and for a reasonable period afterward when necessary for security, fraud prevention, dispute handling, or legal obligations.
• Applications, contact messages, staff records, moderation records, and business records are retained only as long as reasonably necessary for the operational, safety, contractual, recordkeeping, dispute, or legal purpose for which they are kept.

We may retain information longer when required by law, needed to investigate serious abuse/fraud, preserve security evidence, resolve a dispute, or establish/defend legal claims.

10. Your privacy choices and rights

Phat Cat's will extend the following practical privacy requests to users even where a particular jurisdiction may not require every one of them. Subject to identity verification, security needs, legal obligations, and legitimate third-party rights, you may ask us to:

• Tell you whether we hold identifiable website information about you.
• Provide a reasonable copy or summary of the identifiable information you submitted.
• Correct inaccurate account or application information.
• Delete or anonymize information that no longer needs to be retained.
• Close a website account.
• Stop newsletter delivery by using the unsubscribe link or contacting us.
• Withdraw consent where consent is the basis for an optional use.
• Object to an optional use of information or raise a privacy complaint.

We may need enough information to verify that the requester is actually the person whose data is involved. We will not disclose account data merely because someone knows an avatar name or email address.

11. Children and younger users

The Phat Cats website and venue-connected services are not directed to children under 16. Do not submit personal information through the membership, newsletter, application, or contact systems if you are below the age permitted for the applicable service. Inworld access is also subject to Second Life's current age and maturity restrictions. If we learn that we collected personal information from a person who was not eligible to provide it, we will take reasonable steps to remove or restrict the information as appropriate.

12. Links and third-party services

The site may link to Second Life, Marketplace pages, performer sites, merchant sites, portfolios, social networks, or other external services. Following an external link means that service's privacy practices apply to its collection and use of information. Phat Cat's does not control an external site's cookies, logs, account systems, or privacy practices merely because we link to it.

13. Email privacy

Newsletter subscriptions use confirmation. Unsubscribe requests are honored by marking the subscription unsubscribed. Operational emails such as account activation, security, application, or service messages may still be sent when necessary to complete a transaction you requested or protect an account/system. Do not forward activation links, reset links, confirmation tokens, or other private account links to other people.

14. Changes to this policy

We may update this policy when the website, data practices, infrastructure, platform rules, or law changes. Material changes will be posted on this page with a new effective/updated date. If a future change introduces materially different optional tracking or advertising practices, the policy and any legally required consent controls must be updated before that practice is relied upon.

15. Contact and privacy requests

Privacy questions, access/correction/deletion requests, concerns about unauthorized disclosure, and suspected privacy incidents may be sent through the contact page or to info@phatcatssl.com. Please do not include passwords or unnecessary sensitive information in the request.

Where applicable law gives you stronger privacy rights than this policy describes, those legal rights control. This policy describes Phat Cat's current website practices; it does not govern Linden Lab or other independent third parties.