Catch Privacy Policy

Last updated: April 23, 2026

Effective date: April 23, 2026

Version: 3.0

View version history →

This Privacy Policy explains how Catch (“Catch,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects information when you use our service. It applies to www.usecatch.io, app.usecatch.io, and any other Catch product or website that links to this policy.

Catch is operated by Viralzy LLC (DBA Catch), a Wyoming limited liability company.

This policy distinguishes between controls that are in place today and capabilities that are in active development. Where a control is on our roadmap rather than fully deployed, we say so explicitly. We do not claim controls we have not implemented.


Quick summary

If you only read one section, read this:

  • What we collect: account information you give us, plus communication and CRM data from integrations you connect (email, calendar, Slack, CRM, call transcripts).
  • What we use it for: extracting commitments your sales team makes to customers, surfacing execution gaps, and providing the audit and subscription products you signed up for.
  • Who we share it with: named subprocessors required to deliver the service (Section 9). We never sell your data, never share it with advertisers, and never use it to train generalized AI models.
  • Where it lives: all customer data is currently processed in the United States.
  • Your rights: you can access, correct, export, or delete your data at any time. Email privacy@usecatch.io.
  • How long we keep it: while your account is active, plus a defined retention window after deletion (Section 10).
  • Who owns it: you do (Section 5).

1. Who this policy applies to

This policy applies to:

  • Workspace administrators and users who create or use a Catch workspace.
  • Visitors to our marketing website (usecatch.io).
  • Individuals whose data passes through a Catch workspace as part of connected integrations (for example, customers a sales rep emails).

If you are an individual whose data is being processed because your business contacts use Catch, the workspace customer is the data controller and Catch is the data processor. Contact the workspace administrator to exercise your rights, or contact us directly at privacy@usecatch.io and we will route the request appropriately.


2. Information we collect

We collect three categories of information.

2.1 Information you give us directly

  • Account information: name, email address, company name, role, password (hashed via bcrypt or equivalent, never stored in plaintext).
  • Profile information: profile photo, time zone, communication preferences.
  • Workspace configuration: team structure, role assignments, integration choices, sales rep roster.
  • Billing information: processed by Stripe. We receive transaction metadata (last four digits of card, billing address, transaction ID). We do not store full card numbers or CVV codes.
  • Communications with us: support requests, feedback, sales conversations.

2.2 Information from connected integrations

When you authorize Catch to connect to a third-party service via OAuth, we receive data from that service. Specifically:

  • Email integrations (Gmail, Microsoft Outlook): email subject lines, bodies, sender and recipient addresses, timestamps, thread structure, attachment metadata. We read this content to extract commitments. We are in the process of reducing our Gmail OAuth scope set to read-only access; automated email send capability is disabled in the user interface during our early-access window and the reduced scope set is pending deployment and Google OAuth verification.
  • Calendar integrations (Google Calendar, Microsoft Calendar): event titles, descriptions, attendees, start and end times, location.
  • CRM integrations (HubSpot, Salesforce): account, contact, deal, opportunity, activity records.
  • Communication platforms (Slack): messages from channels you authorize, sender identity, timestamps, channel metadata.
  • Call and meeting platforms (Zoom, Gong, when connected): transcripts, participant lists, meeting metadata.

We collect only the OAuth scopes required to deliver the product. Our current scope set for each integration is published and maintained at usecatch.io/security.

2.3 Information collected automatically

  • Usage data: pages visited, features used, time spent, action sequences. Used to improve the product. Stored in our own first-party event database; we do not currently use third-party behavioral analytics tools (PostHog, Mixpanel, Amplitude, etc.).
  • Device and connection data: IP address, browser type and version, operating system, referring URL, time zone.
  • Cookies and similar technologies: session cookies for authentication, functional cookies for preferences. We do not use advertising cookies, third-party tracking pixels, or behavioral targeting tools. See Section 15.
  • Error and performance data: stack traces, request identifiers, performance metrics, captured by our error monitoring subprocessor (Sentry). PII scrubbing on this pipeline is in active development as part of our published security roadmap; until completed, we treat error payloads as potentially containing PII and restrict access accordingly.

3. Data classification and sensitivity handling

We classify information into tiers and apply controls based on sensitivity.

TierExamplesControls in place today
Customer contentEmail bodies, message contents, transcripts, evidence excerptsEncrypted in transit (TLS 1.2+), encrypted at rest by Supabase and Railway, workspace-isolated at the application layer, excluded from product analytics
OAuth credentialsAccess tokens, refresh tokens for connected integrationsApplication-layer encrypted using Fernet symmetric encryption with a key separate from the database, in addition to underlying at-rest encryption
Account and authentication dataPasswords, MFA secrets, session tokensPasswords hashed (never stored in plaintext), session tokens scoped and time-limited
Workspace metadataRoster, role assignments, configurationEncrypted in transit and at rest, workspace-isolated
Billing dataTransaction metadata, billing addressProcessed by Stripe; we never store full card numbers or CVV
Operational metadataTimestamps, identifiers, structural dataEncrypted in transit and at rest
Anonymized aggregate dataCross-customer benchmarks meeting minimum sample-size thresholdsStripped of identifiers; cannot be linked back to any individual or workspace

Logs and error reports are reviewed against this classification before being routed to monitoring tools. Hardening of automated PII scrubbing in error payloads is in active development.


4. How we use your information

We use information for the following purposes, with the legal bases noted for users in jurisdictions that require them (GDPR, UK GDPR).

PurposeExamplesLegal basis (GDPR)
Provide the serviceRun extraction; generate audit reports; surface findingsPerformance of contract
Maintain and improve the serviceCalibrate extraction accuracy on your workspace data; debug; product analyticsLegitimate interests
Communicate with youService notifications, support, account updatesPerformance of contract
Marketing communicationsProduct announcements, newslettersConsent (you can opt out anytime)
Billing and payment processingProcess subscription and audit payments through StripePerformance of contract
Security and fraud preventionDetect and prevent unauthorized access, abuse, security incidentsLegitimate interests, legal obligation
Comply with legal obligationsRespond to lawful requests, maintain required recordsLegal obligation

We do not engage in automated decision-making that produces legal or similarly significant effects on individuals.


5. Customer data ownership

You own all data you provide to Catch and all data Catch processes from your connected integrations. Catch holds no ownership rights to customer data.

Catch’s rights are limited to processing customer data for the sole purpose of providing the contracted service. We have no right to use customer data for any other purpose, including but not limited to:

  • Selling or licensing customer data to any third party
  • Disclosing customer data for advertising or marketing
  • Training or improving generalized AI/ML models
  • Using customer data to benefit any other Catch customer

These restrictions apply both to Catch and contractually to every subprocessor we use (Section 9).

If your account is closed, you retain ownership of your data through the deletion windows described in Section 10. After deletion, only anonymized aggregate data that cannot be linked to you or your workspace may be retained.


6. AI and machine learning use

Catch uses artificial intelligence to extract commitments from communication data. The constraints below apply to every AI subprocessor, not only Anthropic.

  • Per-workspace AI processing: We send the content of emails, messages, transcripts, and calendar entries from your workspace to Anthropic’s Claude API to extract structured commitment data. Anthropic processes this data to return the API response. Per Anthropic’s standard API terms, Anthropic does not retain customer API inputs to train their foundation models.
  • No training on customer data — across all subprocessors: Every subprocessor that processes customer data is contractually prohibited from using that data to train or improve any generalized AI/ML models. This applies to Anthropic, Supabase, Railway, Vercel, Sentry, Stripe, and any future AI subprocessor we onboard.
  • Workspace-scoped calibration: Corrections and feedback from users in your workspace improve extraction accuracy for that workspace only. Your data does not influence models, calibration, or behavior in any other workspace.
  • Aggregate benchmarks (with opt-out): We may produce statistical benchmarks (such as average commitment volume per sales rep across the customer base) using anonymized aggregate data. These aggregates require minimum sample-size thresholds to ensure no individual workspace’s data is identifiable, and contain no content from emails, messages, or transcripts. Workspace administrators may opt out of contribution to aggregate benchmarks by emailing privacy@usecatch.io.
  • Limited Use commitment for Google API data: Data accessed via restricted Google API scopes is used only to provide the user-facing Catch product. We do not use this data for advertising. We do not sell it. We do not use it to train or improve any generalized AI/ML models. We do not allow humans to read this data except (a) with your explicit permission, (b) for security investigations, or (c) to comply with applicable law.

7. Internal access to customer data

Access to customer data is limited and controlled.

7.1 Who has access today

  • Catch’s founder has administrative access to production systems for purposes of operating the service.
  • Future named team members may be granted production access on a least-privilege basis as Catch grows. Each such grant is documented.
  • Subprocessors access only the data necessary to perform their contracted function (Section 9).
  • No one else has access to customer data. We do not have customer-facing support staff with production data access.

7.2 Conditions for access

Catch personnel access customer data only for the following reasons:

  • Operating, maintaining, or repairing the service (for example, debugging an extraction issue affecting a specific workspace)
  • Responding to a customer support request from the workspace administrator, where access is necessary to resolve the request
  • Investigating a security incident
  • Complying with applicable law

We do not access customer data for marketing, product development informed by individual customer content, or any purpose unrelated to operating the service.

7.3 Logging of access

Access to production systems is logged at the infrastructure level by our hosting providers (Vercel, Railway, Supabase). We are in active development on a dedicated privileged-access audit log that will record every customer-data read by Catch personnel, the time, the actor identity, the workspace accessed, and a reason code. This control is published in our security roadmap at usecatch.io/security/changelog. Until that audit log is live, infrastructure-level logs serve as the access record.

7.4 MFA and credential controls

All Catch personnel with production access are required to use multi-factor authentication. Production credentials are rotated on personnel changes.


8. How we share information

We share information in the following limited circumstances, and never for advertising or data sale.

8.1 Within your organization

Information in your Catch workspace is visible to other authorized members of your workspace based on their role. Workspace administrators control role assignments. We do not share data between separate workspaces.

8.2 With subprocessors

We use third-party service providers (subprocessors) to deliver the service. Each subprocessor is contractually bound to handle data only as needed to perform their service for us, and is contractually prohibited from using customer data to train or improve generalized AI/ML models or for any purpose other than serving Catch (Section 6 and Section 9).

8.3 For legal reasons

We may disclose information when required by valid legal process or to protect the rights, property, or safety of Catch, our users, or others. See Section 14 for our government request policy, including our customer notification commitment.

8.4 In a business transfer

If Catch is acquired, merges with another company, or sells substantially all of its assets, your information may transfer to the acquirer. We will notify you and provide options before any such transfer takes effect.

8.5 With your consent

Any other sharing requires your explicit consent.


9. Subprocessors

We rely on the following subprocessors. We update this list when we add, remove, or change subprocessors. Material changes are communicated to workspace administrators with 30 days’ notice when feasible.

SubprocessorPurposeData locationData accessed
SupabaseAuthentication, application databaseUSAccount data, workspace configuration, OAuth tokens (encrypted)
RailwayBackend API hosting, operational databaseUSAll workspace data including extracted communication content
VercelFrontend hosting, edge functionsGlobal edge (primary functions in US)Request metadata, no persistent storage of customer content
AnthropicAI processing for commitment extractionUSEmail, message, transcript, calendar content sent for extraction; not retained for training
StripePayment processingGlobalBilling information, transaction metadata
SentryError monitoring and performanceUSError payloads, request metadata; PII scrubbing in active hardening
Google WorkspaceInternal email and calendar (Catch’s own corporate use, not customer data processing)GlobalCatch internal communications only
1PasswordSecrets management (Catch internal use only)GlobalCatch operational secrets only

Every subprocessor in this table operates under a written agreement that prohibits using customer data to train or improve generalized AI/ML models or for any purpose other than providing service to Catch.

The current subprocessor list is also published at usecatch.io/security.


10. How long we keep your information

We retain different categories of data for different periods. After the deletion windows below, data is irreversibly purged from primary systems and from backups.

Data typeRetention period
Active workspace dataWhile your account is active
Account information after closureSoft-deleted with 7-day recovery window, then hard-deleted from primary systems. Backup retention up to 30 days after hard-delete, then permanently purged.
Extracted commitments and findingsSoft-deleted with 7-day recovery window when the workspace is closed, then hard-deleted from primary systems. Backup retention up to 30 days after hard-delete, then permanently purged.
Source communication content (email bodies, messages, transcripts)Soft-deleted with 7-day recovery window when the workspace is closed, then hard-deleted from primary systems. Backup retention up to 30 days after hard-delete, then permanently purged.
OAuth tokensUntil you disconnect the integration; deleted immediately upon disconnect
Audit logs (security and access)Retained per hosting provider defaults; dedicated application-level audit log with 12-month retention is in active development per Section 12.2
Billing and tax records7 years (legal requirement)
Anonymized aggregate benchmarksIndefinite if no individual workspace remains identifiable; deleted on opt-out per Section 6
Marketing communications opt-out listsIndefinite (to honor your opt-out)

Deletion is verified by job completion logs. Where you have a legal requirement that your data be deleted faster than these defaults, contact privacy@usecatch.io and we will accommodate where feasible.


11. Your rights

You have rights regarding your personal information. The specific rights depend on your jurisdiction, but we extend most rights to all users globally as a matter of policy.

11.1 Rights available to all users

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Ask us to correct inaccurate information.
  • Deletion: Ask us to delete your personal information, subject to legal retention requirements.
  • Export: Receive your data in a portable, machine-readable format.
  • Opt out of marketing: Unsubscribe from marketing emails at any time.
  • Opt out of aggregate benchmarks: Email privacy@usecatch.io to remove your workspace from contribution to anonymized aggregate benchmarks.
  • Disconnect integrations: Revoke OAuth permissions at any time from your workspace settings or from the third-party service.

11.2 Additional rights for residents of the European Economic Area, United Kingdom, and Switzerland (GDPR)

  • Restrict processing
  • Object to processing based on legitimate interests
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with your local data protection authority

11.3 Additional rights for California residents (CCPA/CPRA)

  • Right to know what personal information we collect, use, and disclose
  • Right to delete personal information we collected from you
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising; this opt-out has no effect at Catch but the right exists)
  • Right to limit use of sensitive personal information
  • Right to non-discrimination for exercising your rights

We do not knowingly collect or sell the personal information of minors under 16.

11.4 Additional rights for residents of Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive privacy laws

You have substantially the rights described above. The procedure is the same: email privacy@usecatch.io.

11.5 How to exercise your rights

Email privacy@usecatch.io with a description of your request. We will verify your identity (typically by confirming control of the email address associated with your account) and respond within 30 days for GDPR requests and 45 days for CCPA requests, with possible extensions where allowed by law.

If we deny your request, we will explain why. You have the right to appeal denials by replying to our response.


12. Security

We protect customer data through multiple layers of controls. The descriptions below distinguish between controls in place today and capabilities in active development.

12.1 Controls in place today

  • Encryption in transit: All data transmitted to and from Catch uses TLS 1.2 or higher.
  • Encryption at rest: All databases use encryption at rest provided by Supabase and Railway. OAuth tokens are additionally encrypted at the application layer using Fernet symmetric encryption with a key separate from the database.
  • Tenant isolation: Workspace data is isolated by workspace identifier, enforced at the application layer through scoped query helpers and verified by continuous integration checks. Cross-tenant query attempts are blocked at code review.
  • Authentication: Multi-factor authentication is required for Catch personnel with production access.
  • Access scope: Production access is limited to named personnel on a least-privilege basis (Section 7).
  • Infrastructure access logging: Production system access is logged at the hosting-provider layer (Vercel, Railway, Supabase native logs).
  • Monitoring: Production systems are monitored for security events and anomalies through error-monitoring and uptime tooling.
  • Subprocessor controls: Every subprocessor is contractually bound to security and data-use restrictions before onboarding.
  • Vulnerability management: Dependency vulnerabilities are tracked and patched on a defined cadence.

12.2 Controls in active development

Catch publishes a security roadmap at usecatch.io/security/changelog. Items currently in active development include:

  • Database-layer Row Level Security expansion: Database-layer RLS is being expanded to all tenant-scoped tables to add a second enforcement layer beneath the application-layer isolation already in place.
  • Privileged access audit log: A dedicated audit log recording every customer-data access by Catch personnel, with reason codes and external immutable storage.
  • PII scrubbing in error monitoring: Automated redaction of PII from error payloads sent to Sentry.
  • Penetration testing: We have not yet completed an external penetration test. We plan to engage a qualified third-party assessor before our SOC 2 Type II engagement.
  • SOC 2 Type II: Planned for engagement when enterprise customer demand justifies the audit cost.

We commit to updating this section as items move from “in development” to “in place today.” Material changes are reflected in the policy version history at usecatch.io/privacy/changelog.

12.3 Limitations

No method of transmitting or storing data is 100% secure. While we use industry-standard practices, we cannot guarantee absolute security.

12.4 Security disclosures

To report a security vulnerability, email security@usecatch.io. We commit to acknowledging reports within 2 business days.


13. Incident response

In the event of a security incident affecting customer data:

  • Detection and triage: We assess the scope and severity of the incident.
  • Containment: We isolate affected systems and rotate compromised credentials.
  • Investigation: We determine the categories and quantity of data affected, the root cause, and the time window of exposure.
  • Notification: We notify affected workspaces of incidents that materially affect their data, and we notify applicable regulators per legal requirements (within 72 hours under GDPR for breaches involving personal data).
  • Remediation: We implement controls to prevent recurrence and document the incident in an internal post-mortem.

We have a documented incident response procedure. Engagement of external incident response counsel and forensic specialists is on standby for incidents exceeding our internal capacity.


14. Government and legal requests

Catch’s policy on government and legal requests for customer data:

  • We require valid legal process for any disclosure of customer data. We do not voluntarily disclose customer data to government agencies.
  • We notify affected customers of legal requests for their data unless we are legally prohibited from doing so (such as a non-disclosure order accompanying a subpoena). When prohibited from notifying immediately, we will notify as soon as legally permitted.
  • We challenge improper requests where we have a good-faith basis to do so, including overbroad requests, requests lacking proper legal authority, and requests inconsistent with applicable law.
  • We document and report government requests in transparency disclosures as our customer base and request volume grow.
  • We do not provide direct access to customer data systems to any government or third party.

If you are a government agency seeking customer data, contact legal@usecatch.io with valid legal process.


15. Cookies and tracking technologies

We use cookies and similar technologies for the following purposes:

  • Strictly necessary cookies: Required for authentication and core functionality. Cannot be disabled without breaking the service.
  • Functional cookies: Remember your preferences (time zone, display settings).
  • First-party usage analytics: Aggregate product usage analytics stored in our own database. We do not use third-party behavioral analytics tools (PostHog, Mixpanel, Amplitude) or third-party advertising trackers (Meta Pixel, Google Ads tag).

Where required by law (such as in the EEA), we present a cookie consent banner before setting non-essential cookies.

You can control cookies through your browser settings. Disabling necessary cookies will prevent the service from functioning correctly.


16. Data location and international transfers

All customer data is currently processed and stored in the United States. Specific data locations are listed in Section 9. EU-region data residency is on our enterprise roadmap; until available, EU-region customers’ data is processed in the US under the transfer mechanisms below.

For users in the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (the European Commission’s approved transfer mechanism) for cross-border data transfers from the EEA, UK, or Switzerland to the United States. We participate in the EU-US Data Privacy Framework where applicable. A copy of the relevant Standard Contractual Clauses is available on request to privacy@usecatch.io.


17. Service modes and data handling

Catch operates in two primary modes:

  • Audit mode: A one-time backfill ingestion of historical communication data, typically covering a defined lookback window (such as the prior 90 days). Used to deliver Pipeline Audit reports. Backfill ingestion volume is heavier than continuous mode for the duration of the backfill window only.
  • Continuous mode: Ongoing incremental ingestion of new communication data after audit completion. Used for subscription customers. Volume scales with the customer’s communication activity.

Data handling, security controls, retention, and your rights apply identically in both modes. Audit mode does not retain extracted data longer or apply different controls than continuous mode.


18. Data Processing Agreement (DPA) summary

For customers requiring a Data Processing Agreement under GDPR Article 28, our standard DPA includes:

  • Standard Contractual Clauses for international data transfers
  • Subprocessor obligations consistent with Article 28 requirements
  • Data deletion commitments consistent with Section 10 of this policy
  • Security controls consistent with Section 12 of this policy
  • Breach notification commitments consistent with Section 13 of this policy
  • Customer audit rights as required by Article 28
  • Defined controller and processor roles

To request a DPA, email privacy@usecatch.io. We provide a counter-signed DPA within 5 business days under our standard terms.


19. Children’s privacy

Catch is a business product and not intended for users under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@usecatch.io and we will delete it.


20. Marketing communications

If you receive marketing communications from us, you can opt out at any time by clicking the unsubscribe link in any marketing email or by emailing privacy@usecatch.io. Opting out of marketing does not affect transactional communications (security alerts, billing notices, important service updates).


21. Third-party links

Catch may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing them with your information.


22. Changes to this policy

We may update this policy. When we make material changes, we will:

  • Update the “Last updated” date at the top
  • Notify workspace administrators via email at least 30 days before material changes take effect
  • Request acknowledgment for changes that materially affect your rights

Non-material changes (typos, clarifications, structural reorganization) may be made without notice. The current version is always available at usecatch.io/privacy.

A history of material changes is maintained at usecatch.io/privacy/changelog.


23. Privacy oversight and contact

Privacy oversight at Catch is the responsibility of the company’s founder until a dedicated privacy or security role is hired. The founder serves as the point of contact for all privacy questions, requests, and complaints.

For privacy questions, requests, or complaints:

  • Email: privacy@usecatch.io
  • Mailing address:Viralzy LLC 1309 Coffeen Ave Ste 1200 Sheridan, WY 82801, US

For security disclosures: security@usecatch.io

For legal and government requests: legal@usecatch.io

For general support: hello@usecatch.io

We respond to privacy requests within 30 days (45 days for CCPA), with possible extensions where allowed by law.


24. Jurisdiction-specific information

European Economic Area, United Kingdom, Switzerland

The data controller for users in these regions is Viralzy LLC, with the contact information above. We do not currently have a designated EU representative under GDPR Article 27. We will appoint one when our processing volume in the EU triggers the Article 27 requirement.

California

This policy serves as our notice at collection under the CCPA. We collect the categories of personal information described in Section 2 for the purposes described in Section 4.

In the 12 months preceding the date of this policy, we collected the following categories of personal information from California residents: identifiers, professional or employment-related information, internet activity, geolocation data (general region only), and the customer data described in Section 2.2. We disclosed these categories to the subprocessors listed in Section 9 for the sole purpose of providing the service. We did not sell or share personal information for cross-context behavioral advertising.


25. Definitions

  • Personal information / personal data: Any information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household.
  • Processing: Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
  • Subprocessor: A third-party service provider that processes personal information on our behalf.
  • Workspace: A Catch tenant created by a customer organization.
  • Data controller: The entity that determines the purposes and means of processing personal data.
  • Data processor: The entity that processes personal data on behalf of a controller.

This policy was last reviewed by Catch leadership on April 23, 2026. The policy is intended to comply with the GDPR, UK GDPR, CCPA/CPRA, and other applicable privacy laws in jurisdictions where Catch operates. Customers requiring a Data Processing Agreement under GDPR Article 28 should email privacy@usecatch.io.