Legal

Privacy Policy

1.Scope and Our Two Roles

Catalyst acts in two different capacities, and this Policy covers both:

• As a business (controller) for information about website visitors, prospects, Catalyst Card users, and the people at our client companies with whom we work. Sections 2 through 5, 7, and 9 through 13 describe this.
• As a service provider (processor) for the contacts, leads, customers, and other records that our clients store in their own Catalyst CRM accounts. Section 6 describes this. If you are a customer, patient, or contact of one of our clients and have questions about how that client handles your information, please contact that client directly; we will refer requests we receive to the relevant client.

2.Information We Collect

Information you give us

• Contact and inquiry details when you submit a form, request a quote, ask for login help, email us, or message us: name, business name, email address, phone number, website, and anything you include in your message.
• Self-assessment and estimate inputs when you use the diagnostic scan or cost-estimate tools on our website: your answers, the resulting scores, and inputs such as industry, team size, lead volume, locations, and current systems. If you ask us to send you a report, we keep these with your contact details.
• Booking details when you schedule a Strategy Audit or other call: name, email, phone, the time you choose, and notes you add. Bookings are made through our scheduling calendar, which runs on the Catalyst CRM platform, and create a contact record in our CRM.
• Client and onboarding information when you become a client: business profile details, addresses, brand assets, team member names and emails for user accounts, and the details needed to configure your systems.
• Testimonials when you provide a client story: your name, title, company, quote, and photo, which we store and publish only as described in Section 7.
• Billing information: billing contact and address, and payment details, which are collected and stored by our payment processors (such as Stripe or PayPal). We do not store full card numbers on our systems.
• Communications with us by email, phone, SMS, chat, or video call, including call notes or recordings where we tell you a call is recorded.

Information collected automatically

• Device and usage data such as IP address, browser type, device identifiers, pages viewed, referring URLs, and timestamps, collected through server logs, our hosting provider, and the privacy-focused web analytics and cookies described in Section 9.
• Campaign attribution data such as UTM parameters and the landing page you arrived on, when you reach us from an ad, email, or link.

Information from other sources

• Publicly available business information (for example, your company website, business listing, or professional profile) that we may use to prepare for a conversation you requested or to research businesses that may benefit from our Services.
• Referral partners who introduce you to us, and service providers such as payment processors and scheduling tools that confirm transactions or bookings.

3.How We Use Information

• Respond to your inquiries, schedule and conduct calls, and prepare proposals.
• Set up, deliver, maintain, support, and secure the Services and your account.
• Process payments, send invoices and receipts, and manage billing.
• Send service notices, account updates, onboarding materials, and reminders.
• Send marketing communications about our Services where permitted, with the ability to opt out at any time.
• Measure and improve our website, marketing, and Services, including understanding which campaigns and pages lead people to contact us.
• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations, enforce our agreements, and protect our rights and the rights of others.

We do not use personal information for automated decisions that produce legal or similarly significant effects about you.

4.SMS, Calls, and Email Consent

Calls. We may call the number you provide to follow up on a request you made. Where you have consented, we may use automated dialing or AI-assisted voice systems and will tell you when you are interacting with one.

Email. Marketing emails include an unsubscribe link. Unsubscribing from marketing does not stop transactional emails about your account, billing, or services.

5.How We Share Information

We do not sell personal information, and we do not share it with third parties for their own marketing. We share information only as follows:

6.Client Data in Catalyst CRM

Our clients use Catalyst CRM to store and communicate with their own contacts, leads, and customers (“Client Data”). For Client Data, the client is the business responsible for the information and Catalyst is a service provider acting on the client’s instructions. In that role:

• Clients own their Client Data. We process it only to provide, support, secure, and improve the Services for that client, to comply with law, and as the client directs. We do not sell Client Data and do not use one client’s contacts for the benefit of another client or for our own marketing.
• Accounts are segregated. Each client operates in a separate account. We do not move or route data between client accounts.
• Clients are responsible for consent and compliance. Clients must have a lawful basis to collect Client Data and to send messages through the Services, must honor opt-outs, and must not submit regulated data described in Section 8.
• Aggregate data. We may use de-identified, aggregated usage and performance data that does not identify any client or individual to operate and improve the Services.
• Retention and return. We retain Client Data for the duration of the client’s subscription and make it available for export for thirty (30) days afterward, after which it may be deleted from active systems in the ordinary course, subject to backups and legal holds.

7.Testimonials and Client Stories

We publish client testimonials only with the client’s permission. When you provide one, we store your name, title, company, quote, and photo in a restricted database that only our staff can access, and we publish only the elements you approved. You can ask us to edit or remove a published testimonial at any time using the contact details in Section 17, and we will remove it from the website and from materials we control within a reasonable time. Testimonials shown on the site are from real clients; we do not publish fabricated reviews.

8.Regulated Data and Health Information

The Services are not designed or certified for HIPAA, HITECH, or similar regulatory regimes. We do not act as a Business Associate and we ask clients and users not to submit protected health information (PHI), government identification numbers, full payment card numbers, or other specially regulated data through the Services. If we become aware that such information has been submitted in violation of this Policy, we may delete it or take other appropriate action. Catalyst works with healthcare and other regulated businesses only for non-regulated operational data such as scheduling, general inquiries, and business contact information.

9.Cookies and Analytics

We and our providers use cookies, local storage, pixels, and similar technologies to keep the website working, remember your preferences, protect against abuse, understand how visitors use the site, and measure the performance of our marketing. These may include:

• Strictly necessary cookies set by our hosting and security provider to deliver the site and protect it from automated abuse.
• Analytics. We run our own first-party analytics on this website. It records the pages you view, how long the page is open and how far you scroll, your referring site and campaign tags, your browser, device type and operating system, your approximate location (city, region, country and network) derived from your IP address, and technical errors you encounter. It uses a random identifier stored in your browser’s session storage that is deleted when you close the tab; it does not set cookies, does not store your IP address, and is not shared with advertising networks. We also use these signals to tell real visitors apart from automated traffic. We keep this data for 90 days. If your browser sends a Global Privacy Control signal, this analytics does not run. Where we also use Google Analytics, it collects usage statistics such as pages visited, time on page, and approximate location derived from IP address.
• Advertising and attribution technologies, where we run paid campaigns, that record which campaign or ad brought you to the site so we can measure results.

You can control cookies through your browser settings, including blocking or deleting them; some features may not work if cookies are disabled. Where an advertising platform offers opt-out tools, you may also use those. Our website does not currently respond to browser “Do Not Track” signals, but we honor opt-out preference signals where required by law, as described in Section 13.

10.Data Retention

We keep personal information for as long as needed for the purposes described in this Policy, including to maintain the client relationship, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. As a general guide: inquiry and prospect records are retained while there is an active conversation and for a reasonable period afterward; client account and billing records are retained for the life of the relationship and for seven (7) years after it ends for tax and accounting purposes; and website logs are retained for a limited period for security purposes. When information is no longer needed, we delete or de-identify it.

11.Security

We use administrative, technical, and physical safeguards appropriate to the nature of the information, including encryption in transit, access controls, role-based permissions, segregated client accounts, and reputable infrastructure providers with their own security programs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you as required by applicable law.

12.Your Choices and Rights

• Access, correction, and deletion. You may ask us to confirm whether we hold personal information about you, to provide a copy, to correct inaccuracies, or to delete it, subject to legal exceptions.
• Marketing opt-out. Unsubscribe from marketing emails using the link in any message, reply STOP to text messages, or contact us.
• Catalyst Card. You may edit or remove the information displayed on your Catalyst Card page at any time by contacting us.
• Account information. Clients may review and update account information through their account or by contacting us.

To exercise any right, contact us using Section 17. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. We will not discriminate against you for exercising your rights. If we receive a request about Client Data, we will forward it to the relevant client.

13.U.S. State Privacy Rights

Residents of California, Colorado, Connecticut, Florida, Oregon, Texas, Virginia, and other states with comprehensive privacy laws may have additional rights, including the right to know what personal information is collected and how it is used and shared; to access, correct, or delete it; to receive it in a portable format; to opt out of the sale or sharing of personal information, targeted advertising, and certain profiling; and to appeal a denied request. We do not sell personal information. To the extent our use of advertising cookies is considered “sharing” or targeted advertising under any such law, you may opt out by adjusting your cookie settings, using a recognized opt-out preference signal such as Global Privacy Control, or contacting us. Authorized agents may submit requests on your behalf with proof of authorization. Where a state law does not apply to us because of thresholds in that law, we will still consider requests in good faith.

California residents may also obtain, once per calendar year, a notice of the categories of personal information disclosed to third parties for their direct marketing purposes; we do not make such disclosures.

14.Children

The Services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

15.Where Data Is Processed

Catalyst is based in the United States and processes information in the United States, where privacy laws may differ from those of your jurisdiction. Our providers may process data in other countries under appropriate safeguards. By using the Services you understand that your information will be transferred to and processed in the United States.

16.Changes to This Policy

We may update this Policy from time to time. The “Last updated” date at the top reflects the current version. For material changes we will post a notice on our website or notify active clients by email. Your continued use of the Services after a change takes effect means you accept the updated Policy.

17.Contact Us

Questions, requests, and complaints about this Policy or our handling of personal information may be sent to: