Privacy Policy

This policy explains how Catalizo Global Solutions ("we", "us") handles personal data in Catz Connect. It covers the website catzconnect.com, the admin panel, the API and SDKs, the Catz Mail webmail (mail.catzconnect.com), the Catz Mail mobile app, our mail, calendar and contact servers (SMTP, IMAP, POP3, CalDAV, CardDAV) and in-app calls — together, the "Service".

Use of the Service is also governed by our Terms of Service. Words such as "organization" and "customer" mean the business that holds a Catz Connect account.

We are the controller for data about the people who hold panel accounts, for billing records, for security and abuse-prevention records, and for visits to our website.

We are a processor for "Customer Data": the mail, messages, mailboxes, contacts, recipient lists, device tokens and call participants that an organization sends, receives or stores through the Service. The organization is the controller of that data. We process it only to provide the Service, following the organization's settings and instructions and our Terms.

If you received a message sent through Catz Connect, use a mailbox an organization created for you, or use an app that relies on Catz Connect, please contact that organization first about your data. If you write to us instead, we will pass your request on to the organization where we can identify it, and help it respond.

Panel accounts

• Your email address and full name, and your interface language.
• Sign-in records: the one-time codes we email you (stored only as a hash), your two-factor authenticator secret (encrypted), hashed backup codes, the IP address and browser (user agent) of each sign-in, and the time of your last sign-in.
• Your memberships and roles in organizations, invitations, notifications and any feedback you send us.

Organizations

• The organization's name, its domains and DNS settings, DKIM signing keys (encrypted), API keys (encrypted, and looked up only by a keyed hash), webhooks, templates and settings.
• Credentials for the providers an organization connects — for example WhatsApp, SMS, push or voice providers (encrypted).
• An activity (audit) log of administrative actions: who acted, what was done, when, and the IP address and user agent used.

Billing

Payments are handled by Stripe. We give Stripe the account's email address to create a customer record, and we store the Stripe customer and subscription identifiers, the plan, invoice status and usage counts needed to bill overage. We never receive or store full card numbers.

Mailboxes (Catz Mail)

• Mailbox name and address, the password (stored only as a hash), an optional recovery email address, the two-factor secret (encrypted) and hashed backup codes.
• The mail itself — subjects, previews, bodies and attachments, which are encrypted at rest — plus folders, labels, filters, signatures, auto-replies, contacts, calendars and address books.
• A keyed ("blind") search index, so mail can be searched without storing readable words.
• Sessions (IP address, user agent, times) and, for the mobile app, the devices registered for notifications (an encrypted Firebase Cloud Messaging token, platform, app version, device name and whether lock-screen previews are shown).

Messages an organization sends or receives

Recipient email addresses and phone numbers, message content and metadata, delivery events (sent, delivered, bounced, complained), opt-outs and suppression lists, replies and inbound messages (for example WhatsApp conversations or an SMS "STOP"), webhook deliveries, push messages with the device tokens and user ids the organization's app supplies, and call records (participants as identified by the organization's app, start and end times, duration). This is Customer Data.

Technical and security data

We use IP addresses to rate-limit requests, lock out repeated failed sign-ins and prevent abuse. Our server error logs can contain IP addresses; they are rotated by size (by default seven files of up to 50 MiB each), so older entries are overwritten.

We do not use Customer Data for advertising and do not sell it.

Open and click tracking is optional and is switched off on the platform unless we enable it. Where it is enabled, each organization decides — for the whole organization, per sending domain or per message — whether opens and clicks are recorded. By default only marketing (bulk) email is tracked; transactional email such as receipts and sign-in codes is not, and mail that people write from their mailboxes is never tracked.

An open is recorded when an invisible image in the message is loaded; a click is recorded when a link that passes through our tracking address is followed. We record the recipient address, the kind of event, the time and, for clicks, the link's destination. We do not store the recipient's IP address with these events.

Marketing email carries a one-click unsubscribe header (List-Unsubscribe), which mail apps show as an "Unsubscribe" button, and organizations can add a link to their preference page, where recipients can leave individual topics or all of the organization's email. Opt-outs are added to the organization's suppression list and are checked before every send. Recipients can also contact the sending organization.

Organizations connect their own provider accounts — for example the Meta WhatsApp Business Platform, SMS gateways (such as Twilio, Vonage, Plivo, Sinch, Infobip, Telnyx or Amazon SNS), their own Firebase project for push notifications, and voice or video providers. When an organization sends through one of these, the recipient's phone number or device token and the message content are passed to that provider, which handles them under its own terms and privacy policy and its contract with the organization.

Organizations are responsible for having a lawful basis, and where required consent, for every message they send: in particular for marketing, for WhatsApp messages (which require the recipient's opt-in under WhatsApp's policies) and for SMS. The Service records opt-outs — an SMS or WhatsApp "STOP" reply, WhatsApp's "Stop promotions" button, unsubscribe links and opt-outs entered in the panel — and blocks further messages to that number or address on that channel.

With the Catz Connect call engine, audio and video travel directly between participants (peer-to-peer) where the network allows, or through our relay (TURN) server when it does not. The media is encrypted by WebRTC end to end between the devices; the relay only forwards it and cannot read it. Calls are not recorded, and call audio and video are not stored.

In-call chat and data messages go directly between participants where possible; when they pass through our signaling server instead, their content is relayed but never stored or logged.

We keep a call record (who took part, as identified by the organization's app, and when and how long) for the organization's call history and for billing. If an organization chooses a third-party video or phone provider instead, that provider carries the call under its own terms, including any recording the organization configures with it.

Our websites and apps use no advertising, analytics or tracking cookies and no third-party tracking scripts. We only use the cookies and browser storage needed to remember your language and to keep you securely signed in:

The panel and webmail also keep the browser half of that encryption key pair and your light or dark theme choice in your browser's local storage, and the panel keeps an unfinished sign-in for up to 10 minutes in session storage. None of this is shared with anyone.

Our pages load fonts from Google Fonts. To deliver them, your browser connects to Google's servers, which receive your IP address and browser details; see Google's privacy policy at policies.google.com/privacy.

Catz Mail is the mail app for mailboxes hosted on Catz Connect. Mailbox accounts are created by your organization; the app does not let anyone sign up on their own.

• On your device: the session token and encryption keys of each signed-in mailbox are kept in the system's secure storage (iOS Keychain / Android Keystore). Mail is fetched from our servers over an encrypted connection. Attachments you download and messages you export are saved in the app's own storage and are deleted when you sign out of that mailbox or remove it from the app.
• Notifications: if you allow them, the app registers a Firebase Cloud Messaging (FCM) token, which we store encrypted. New-mail notifications are delivered through Google's FCM service. They can show the sender and subject on your lock screen; you can turn previews off for each account in the app's notification settings, and then they say only that new mail has arrived.
• Permissions: internet access and, if you allow it, notifications. The app only reads the files, photos or videos you pick yourself to attach; on iOS it asks for access to the photo library, camera or microphone only when you choose to attach a photo or video that way.
• No ads or analytics: the app contains no advertising, analytics or tracking SDKs, and it does not access your location or contacts.

Deleting your account and data

• Signing out of a mailbox in the app removes its session, keys and saved files from the device and unregisters the device from notifications. Uninstalling the app removes all of its data from the device.
• Your mailbox account belongs to your organization. To delete the mailbox and its mail, ask your organization's administrator: administrators can delete a mailbox together with all of its stored mail from the admin panel.
• You can also email developers@catalizo.com from your mailbox address (or tell us the address) and ask for the account and its data to be deleted. We will verify the request and carry it out together with your organization; some records may be kept where the law requires it, as described under How long we keep data.

• Service providers that help us run the Service: Stripe (payments), Google (Firebase Cloud Messaging for Catz Mail notifications, and Google Fonts), and the hosting and infrastructure providers that run our servers. They may use the data only to provide their services to us.
• The providers an organization connects (WhatsApp, SMS, push, voice or video), as described above, under that organization's instructions.
• Recipients' mail servers and networks: delivering an email, SMS or WhatsApp message necessarily passes it to the recipient's provider.
• Authorities and advisers where the law requires it, to protect people's safety or our rights, or to enforce our Terms; and our professional advisers under confidentiality.
• A successor if our business or the Service is transferred, in which case this policy continues to apply to the data transferred.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined in California law.

We keep data for as long as needed for the purposes above. These are the default periods:

When an organization is deleted, it is removed from the Service and its owner can have its stored mail files deleted at the same time; a minimal record (for example the activity log and billing records) is kept for security, audit and legal purposes. To have remaining personal data erased, contact us.

• Connections to the Service use TLS, and requests between our apps and our API are additionally encrypted end to end.
• Mail bodies, attachments and subjects, provider credentials, signing keys, API keys and two-factor secrets are encrypted at rest (XChaCha20-Poly1305 with keys derived per purpose). Session tokens are stored only as keyed hashes; passwords and backup codes only as hashes.
• Two-factor sign-in is required for the admin panel, and is available for mailboxes. Repeated failed sign-ins are locked out, and requests are rate-limited.
• Administrative actions are recorded in an activity log that organization owners can review.

No system is perfectly secure. If we learn of a security incident affecting your personal data, we will notify you and the authorities as the law requires.

Everyone

You can ask us for a copy of your personal data, and ask us to correct, export or delete it. Email developers@catalizo.com. We will confirm your identity (for example by replying to the address on the account) and answer within one month, or within the time your local law sets.

EEA, UK and Switzerland (GDPR / UK GDPR)

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (including to processing based on our legitimate interests), and the right to withdraw consent at any time. You may also complain to your local data protection authority.

California and other US states (CCPA/CPRA and similar laws)

You have the right to know what personal information we collect and how we use and disclose it, and to access, correct and delete it. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you, so there is nothing to opt out of. You may use an authorized agent, and we will not discriminate against you for using your rights. The categories we collect are those described in Information we collect: identifiers (name, email address, phone number, IP address), account and security records, commercial information (plan and billing records), electronic communications that you or your organization send through the Service, and technical information.

Data handled for an organization

For Customer Data, the organization decides and should be your first contact. The panel gives organizations tools to answer such requests: export or erase all data about one person (matched by email address, phone number or app user id), export the whole organization, and delete mailboxes with their mail.

We are based in the United States, and we and our service providers may process personal data in the United States and other countries whose data protection laws differ from yours. Where the law requires it — for example for transfers out of the EEA, the UK or Switzerland — we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. Organizations that need a data processing agreement with us can request one at developers@catalizo.com.

The Service is meant for businesses and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the Service changes. We will post the new version here with a new "last updated" date, and tell account holders by email or in the panel before a material change takes effect.

Catalizo Global Solutions, United States — privacy and legal questions: developers@catalizo.com.

This policy is available in several languages. If a translation differs from the English version, the English version governs.