Catchwise Privacy Policy

1. Scope of This Policy

This Policy applies to: (a) Catchwise account owners and authorized users; (b) business customers using Catchwise; (c) individuals who submit information through Catchwise-hosted or embedded forms; (d) individuals whose information is routed into Catchwise through email forwarding, SMS/text capture, missed-call capture, manual entry, bulk manual entry, or other capture paths; and (e) visitors to Catchwise websites or pages.

2. Catchwise's Role as Data Controller and Processor

Where applicable under U.S. privacy laws, with respect to account, billing, website, support, product, and business-operations information, Catchwise acts as a data controller and determines how that information is used. With respect to lead information submitted to a business customer's workspace, Catchwise generally acts as a data processor, processing that information solely to provide the service to that business customer. The business customer is the data controller responsible for how it collects, uses, contacts, and follows up with its own leads and customers. Customers are solely responsible for providing legally adequate privacy notices to their own leads and individuals submitting information through hosted or embedded forms.

3. Information We Collect

Catchwise may collect the following categories of information:

Account and User Information: names, email addresses, phone numbers where provided, login and authentication information, role, permissions, business association, account status, and timestamps. Authorized users may access workspace data.

Business Information: business name, business slug or public form identifier, industry or business type, primary contact, notification settings, capture-path settings, intake email settings, auto-response settings, messaging compliance status, subscription status, trial status, cancellation and reactivation status, and related setup information.

Lead Information: lead name, email address, phone number, message or request details, lead source, lead status, follow-up details, created and updated timestamps, and lead event history. Catchwise is not designed to collect sensitive personal information unless necessary and lawful for the customer's use case.

Form and Intake Data: Public forms may collect name, email address, phone number, request details, form source, business slug or workspace destination, timestamp, and IP-related or technical data used for rate limiting, abuse prevention, security, and troubleshooting. Email intake may process sender and recipient details, subject line, email body, headers, metadata, attachments if supported or received, provider event identifiers, timestamps, and parsed lead information.

Phone and SMS Data: Where phone or SMS features are enabled, Catchwise may collect caller or sender number, Catchwise-provided recipient number, SMS/text body, call status, provider message or call identifiers, timestamps, carrier and provider metadata, and related lead event history.

Support and Operations Data: issue type, severity, descriptions, related account, business, capture-path, lead, provider-event, diagnostic, and application-error context, ticket status, internal notes, resolution notes, support history, AI-assisted triage summaries, logs, rate-limit events, IP-related metadata, browser, device, and request metadata, authentication events, usage data, security data, and fraud-prevention data.

Billing and Tax Data: subscription status, plan information, trial dates, promotional eligibility, invoice and payment status, customer and subscription identifiers from payment providers, billing contact information, tax calculation and collection details, and customer location or tax information required for tax calculations. Catchwise does not store full payment card numbers directly; payment information is handled by the payment provider.

Marketing Attribution and Cookies: Catchwise may use cookies, pixels, analytics, browser storage, or similar technologies to collect signup attribution and website activity data, such as UTM source, medium, campaign, content, landing page, referrer, and signup conversion timestamp. Users may control cookies through their browser settings, though some essential cookies and storage may be necessary for login, security, and basic operation and cannot be fully disabled.

4. How We Use Information

Catchwise may use information to: provide and operate the service; create and manage accounts; capture, organize, display, and update leads; route form submissions and forwarded emails; process SMS/text inquiries and missed-call events where enabled; send notifications and digests; support manual and bulk manual lead entry; assist customers in setting up and testing capture paths; provide support; classify, summarize, or triage support requests; monitor reliability, system health, provider events, errors, and abuse; prevent fraud, spam, misuse, unauthorized access, and security incidents; process billing, taxes, subscriptions, trials, cancellations, and reactivations; improve onboarding, product design, support, and customer experience; measure marketing attribution and product adoption; and comply with applicable legal, tax, accounting, provider, carrier, and operational requirements. Catchwise may use deidentified or aggregated data for product improvement, analytics, and business reporting. Catchwise will not use deidentified or aggregated data to attempt to identify a specific lead or customer.

5. How We Share Information

Catchwise does not sell customer lead data for money or share it for cross-context behavioral advertising, as those terms may be defined under applicable state privacy laws. Catchwise may share information with: (a) service providers that assist in operating Catchwise; (b) payment processors; (c) hosting, database, authentication, email, phone and SMS, AI, monitoring, support, security, analytics, and operational providers; (d) authorized users within the customer's workspace; (e) support or operational personnel assisting in issue resolution; (f) professional advisors; (g) governmental authorities, regulators, courts, or other parties when required by law or necessary to protect rights, safety, security, or the service; and (h) parties involved in a merger, acquisition, financing, reorganization, asset sale, or similar business transfer.

6. Third-Party Providers and AI-Assisted Processing

Catchwise engages third-party service providers, including but not limited to Supabase, Vercel, Resend, Twilio, Stripe, OpenAI, and Google Workspace, for operational, security, analytics, and infrastructure purposes. This provider list is subject to change. Third-party providers may maintain their own logs, metadata, backups, and records under their own terms. Catchwise may utilize AI tools for support triage, classification, summarization, diagnostics, and internal workflows. Catchwise does not use AI outputs as legal or compliance advice and uses AI only for operational and support purposes unless otherwise disclosed. Catchwise takes reasonable steps to limit AI processing to data strictly necessary for resolving the specific support issue. You acknowledge that AI-generated outputs may be inaccurate or incomplete and require independent verification.

7. Customer Responsibilities for Lead Data

Business customers are solely responsible for: (a) informing their own customers or website visitors how their information is collected and used; (b) updating their website privacy policy or disclosures as necessary; (c) ensuring they have the legal right to collect, forward, store, call, text, email, or respond to leads; (d) refraining from submitting unnecessary sensitive information to Catchwise; and (e) handling customer requests, opt-outs, consent issues, and follow-up obligations applicable to their own business.

8. Security and Incident Notice

Catchwise implements reasonable technical and organizational measures designed to protect information, including authentication, access controls, database security features, provider verification, rate limiting, logging, and operational monitoring. However, no system or transmission over the internet can be guaranteed to be 100% secure. You are responsible for safeguarding your account credentials and limiting access to authorized users only. In the event of a security incident that compromises your data, Catchwise will notify you as required by applicable law.

9. Data Retention and Deletion

Catchwise retains information for as long as reasonably necessary to provide the service, support customers, maintain business records, resolve disputes, troubleshoot issues, prevent abuse, comply with legal or provider obligations, and operate the business. Different categories of information may be retained for different periods. Some information may remain in backups, logs, provider systems, or archives for a limited period after deletion from active systems. Catchwise may retain deidentified or aggregated information after account deletion, provided such information cannot reasonably be used to identify a specific lead or customer. See the Data Retention Policy for additional detail.

10. Privacy Choices, Requests, and State Law Scalability

You may contact Catchwise to request access, correction, export, or deletion of certain information. Catchwise may require verification of your identity or authority before acting on a request. Certain requests may be limited by legal, security, billing, tax, fraud-prevention, backup, provider, operational, or recordkeeping requirements. If you are an individual whose information was submitted to Catchwise by a business customer, Catchwise may direct your request to that business customer or coordinate with that business customer to respond. Catchwise may not be able to respond directly to individuals where the business customer controls the lead relationship. If Catchwise becomes subject to additional state privacy laws in the future, Catchwise may provide supplemental privacy disclosures or mechanisms as required by those laws.

11. Children's Data

Catchwise is a business-to-business service and is not directed to children under the age of 13. Catchwise does not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we may delete it.

12. Communications, Policy Updates, and Contact

Account, support, security, billing, and transactional or service-related communications may be necessary for the provision of Catchwise and may not be fully opt-out-able while the account is active. Owner notifications and digests may be controlled through product settings where available. For SMS/text messaging, applicable opt-out and consent rules apply. Catchwise may update this Policy from time to time. Privacy questions or requests may be directed to: support@catchwise.app.