Last updated 21 August 2026
Privacy
CATCH20Two holds a record of your company's equipment and the people who use it. This page says exactly what that means, who else touches it, and how to take it away.
The short version
- There is no tracking on this product. No analytics script, no advertising pixel, no tag manager, no session recorder, on the marketing site or inside the application.
- We never sell or share your data, and it is not used to train anything.
- You can export everything to CSV at any time, including after a trial ends and including while a subscription is unpaid.
What we store
About you
Your name and email address, taken from the Google or Microsoft account you sign in with, and which of the two you used. We never receive or store your password.
About your workspace
The name you chose, your timezone and currency, a contact email for alerts, and your subscription status. The workspace name appears on printed QR labels and on the page a stranger sees if they scan one, which is the only place any of this leaves the product without you sending it.
The records you put in
Assets, the people you assign them to, and your locations, including names, email addresses, teams, serial numbers, purchase costs and dates, and anything you type into a notes field.
A history of changes
Every change to an asset is recorded with what changed, when, and which account did it. This is deliberate and it is not optional: an asset register you cannot audit is not an asset register. It is deleted with the workspace and not before.
What we do not store
No files, photos, attachments or documents. The product accepts no uploads of any kind. No IP address logs beyond the transient counters described below. No payment card details ever reach us; see Payments.
Cookies and local storage
- A session cookie, set when you sign in, so the next page knows who you are. Strictly necessary, and there is no other cookie to consent to.
- Your light or dark preference, kept in your browser’s local storage. It never reaches us.
Who else processes it
These are the only third parties involved, and each is doing one job:
- MongoDB Atlas stores the database.
- Google, and Microsoft if your company uses it, for sign-in only. They confirm who you are; we never see your credentials.
- Resend sends the alert and invite emails, and therefore handles the recipient address and the message.
- Dodo Payments takes payment as Merchant of Record. Card details go to them and never to us.
- Our hosting provider runs the application and keeps standard server logs.
If you connect Slack, the alerts you have enabled are posted to the channel you chose. That is your integration and you can remove it in Settings at any time.
Rate limiting
Pages that anyone with a link can reach (a scanned QR code, an equipment link) count requests against the requesting address for a minute at a time, so that a public page cannot be hammered. Those counters expire automatically and are not used for anything else.
How long we keep it
- While your workspace exists, we keep your records. Deleting an asset hides it and keeps its history, so it can be restored.
- When a trial ends without payment, nothing is deleted. The workspace becomes read-only and export keeps working.
- Demo workspaces are removed automatically, along with everything in them, within 24 hours.
- When you delete your workspace, its records are removed. Backups roll off on their own schedule.
Your rights
You can export everything yourself, from Settings, without asking us. To correct, restrict or delete anything else, or to ask what we hold, write to the address below and we will answer within 30 days.
People named in your workspace are your records rather than ours: you are the controller and we are the processor. If somebody in your company asks us directly, we will point them to you.
Children
This is a tool for businesses. It is not intended for anyone under 16.
Changes
If this page changes in a way that matters, we will email the workspace contact rather than change the date quietly and hope nobody notices.