Privacy Policy

Who We Are

Catapult Labs Limited (trading as "Catapult") is the provider of an AI assistant that unifies work context across third party technologies for search, drafting, brainstorming and decision making. We respect your privacy and are committed to protecting your Personal Data when you visit our Website, download our App and use our products and Services (as defined below) as set out in this privacy policy (“Policy”).

By visiting https://www.catapult.xyz/, downloading our App, using our Services and/or engaging with us you accept and consent to the practices described in this Policy, as amended from time to time by updating this page. Any queries related to this Policy should be directed to help@catapultlabs.xyz or 241 Southwark Bridge Road, London, England, SE1 6FP.

Catapult is the Controller for Account Data and other direct user data, and acts as Processor for Workspace Data processed on your instructions. Where Catapult acts as a Processor of Workspace Data, the customer remains the Controller of that Workspace Data and is responsible for determining the purposes and means of processing such data.

Defined Terms

Unless defined in this Policy, defined terms shall have the meaning given to them in the Data Protection Legislation.

"Account Data" means Personal Data relating to the creation and administration of a Catapult user account, including authentication details and permissions.

"App" means the app made available by Catapult in connection with the Website and Services.

"Aggregated Data" has the meaning given in the Collected Information section.

"Catapult", "we", "our" or "us" means Catapult Labs Limited (trading as "Catapult").

"Controller", "Processor", "Personal Data", "Processing" and "Supervisory Authority" have the meanings given in Data Protection Legislation.

"Data Protection Legislation" means all applicable data protection and privacy legislation, including but not limited to the UK General Data Protection Regulation (“UK GDPR”), UK Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and, where applicable, the EU General Data Protection Regulation (EU GDPR) (together “Data Protection Legislation”).

"Services" means the services made available by Catapult from time to time including the Website and App (as defined and further described in the Terms at www.catapult.xyz/terms.html).

"Website" means the website available at www.catapult.xyz.

"Workspace Data" means data made available to Catapult from third-party services connected by a customer, as described in this Policy.

Collected Information

Personal Data, or personal information, means any information about an individual from which that person can be identified. It does not include anonymous data, where an individual’s identity has been removed.

We may collect, use, store and transfer different kinds of Personal Data about you depending on how you interact with our Services, such as:

• Identity Data – including company details (if applicable), first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender and job title;
• Contact Data – including billing address, delivery address, email address and telephone numbers;
• Profile Data – including your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;
• Registration Data – including newsletter requests, event/seminar registrations, dietary preferences (excluding special categories of data), subscriptions, and downloads;
• Customer Service Data – including Personal Data received from customers in respect of employees, your customers or other individuals known to customers, invoicing details and payment history, and customer feedback;
• Technical Data – including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website;
• Financial Data – including bank account and payment card details;
• Transaction Data – including details about payments to and from you and other details of services or products you have purchased from us;
• Compliance Data – Government identifiers, passports or other identification documents, dates of birth, beneficial ownership data and due diligence data;
• Usage Data – including information about how you use our website, products and services as time spent on site, your general location, device type and browser information; and
• Marketing and Communications Data – including your preferences in receiving marketing from us and our third parties and your communication preferences.

We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your Personal Data but is not considered Personal Data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this Policy.

We do not intentionally collect Special Categories of Personal Data. However, Workspace Data may include special categories of Personal Data depending on the content made available to the Services by or on behalf of the customer. The customer is responsible for ensuring that it has a lawful basis for processing such data and for making it available to Catapult. This website is not intended for children, and we do not knowingly collect data relating to children.

Workspace and Ingested Data

Workspace Data is ingested via application programming interfaces (APIs), event listeners or similar technical means and is stored and processed within our systems. Workspace Data from connected third-party services (e.g., Gmail, Slack, Google Calendar, documents, call transcripts) may incidentally include special categories of personal data under Data Protection Legislation, such as data revealing racial or ethnic origin, data concerning health (including medical appointments, conditions, or treatments), or other sensitive information. Catapult does not request, require, or intentionally collect such data to provide the Services, and the Services are not designed for processing health or medical data. As Processor, we process Workspace Data solely on your instructions as Controller. You must ensure you have a valid lawful basis under Data Protection Legislation and, where applicable, for any special category data (e.g. explicit consent) included in Workspace Data before connecting services. We implement technical and organizational measures to limit access and processing to what is necessary for the Services, but cannot prevent ingestion of all such data due to the nature of connected APIs.

As part of providing the Services, Workspace Data may be:

• indexed and organised;
• converted into alternative formats (such as text or markdown);
• broken into smaller segments or "chunks";
• analysed to generate vector embeddings;
• processed to extract factual information or relationships; and
• used to generate statistical insights to improve search and retrieval.

These processes are automated and are necessary to provide the core functionality of the Services.

If at any point you choose to provide us with a third party’s Personal Data (such as name, email, and phone number), you represent that you have the third party’s permission to do so and are responsible for such disclosure of that Personal Data. Examples include forwarding reference or marketing material or sending job referrals. Third parties may unsubscribe at any time from any future communication by emailing help@catapultlabs.xyz.

Catapult’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Catapult does not use Google Workspace data for advertising purposes and does not sell such data to third parties.

Using Aggregated Data and Anonymised Data

We do not use identifiable Workspace Data to train or fine-tune general-purpose AI models unless you have explicitly opted in via your account settings.

However, we may create, use, disclose and retain Aggregated Data, anonymised data, de-identified data, statistical data, usage insights, telemetry data, model outputs, embeddings, derived data and other data that does not identify any individual (De-Identified Data) for our own business purposes.

These purposes may include:

• training, testing, improving and validating artificial intelligence and machine-learning models (including foundation models and internal or third-party hosted models);
• improving search, retrieval, ranking, drafting and reasoning capabilities;
• developing new products, features and services;
• benchmarking and analytics; and
• security monitoring and fraud prevention.

De-Identified Data will not identify you or any individual and will not be re-identified by Catapult except as required to validate anonymisation processes or comply with law.

Failure to Provide Personal Data

If you fail to provide Personal Data to us that is required by law or under the terms of contract between us and you, we may not be able to perform the contract we have or are trying to enter into with you.

Authentication and Access Credentials

When you connect to third-party services, we store authentication credentials such as OAuth access tokens, refresh tokens and permissions metadata to enable ongoing access to those services. These credentials are stored securely and used solely to provide the Services in accordance with your instructions. You may revoke access at any time via the relevant third-party service or within the Services.

Method of Data Collection

Data may be collected through any of the below channels:

• Direct interactions – you may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide when you apply for our Services, fill out a new enquiry form on our website, subscribe to our service or publications, request marketing to be sent to you, enter a competition, promotion or survey and/or give us some feedback.
• Personalised feedback you may give us different types of Personal Data as you interact with the Services, for example in the context of communicating with the AI tools built into the App.
• Automated technologies or interactions – as you interact with our Website or download our App, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this Personal Data by using cookies, server logs and other similar technologies.
• Third parties or publicly available sources – we may receive Personal Data about you from various third parties and public sources such as:
  • Technical Data from analytics providers such as Google based outside the EU and/or search information providers based inside or outside of the EU;
  • Contact, Financial and Transactional Data from providers of technical, payment and delivery services based inside the UK/EU; and
  • Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register based inside the UK/EU and third party enrichment databases such as Apollo and Clay.

How We Use Your Data

The law requires us to have a legal basis for collecting and using your Personal Data. We rely on one or more of the following legal bases:

• Performance of a contract with you, where processing is necessary to provide the Services, including creating accounts, authenticating users and ingesting Workspace Data;
• Legitimate interests, where processing is necessary to operate, secure and improve the Services, provided those interests are not overridden by your rights and freedoms;
• Legal obligation, where processing is necessary for compliance with applicable laws; and
• Consent, where we have obtained your active agreement to specific processing activities (for example, optional marketing communications).

We may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Automated Processing and AI

Catapult uses automated systems, including artificial intelligence and machine-learning techniques, to analyse and organise Workspace Data in order to provide the Services.

We process Personal Data for automated processing and profiling only to the extent necessary to deliver the Services (e.g., personalised responses or drafting suggestions). Catapult does not make solely automated decisions that produce legal effects or similarly significant effects concerning individuals.

Third Party Transfer

We do not sell your Personal Data; however, we may share your Personal Data with third parties such as:

• IT and system administration service providers acting as processors;
• Service providers who assist and support Catapult with running our Website, App or other IT services;
• Analytics service providers acting as processors relating to usage patterns, device information, and interaction with our Website or App;
• Payment services providers;
• Professional advisors including lawyers, bankers, auditors and insurers assisting with legitimate business matters;
• HMRC, regulators and other authorities who require information to protect our legal rights and those of our customers; and
• Third parties in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or to another company. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Policy.

In addition, where applicable, you will be requested to check a box if you consent to us transferring some of your Personal Data to third party service providers. This is not compulsory and if you do not check the box, we will not transfer your Personal Data to such third parties. If you do check the box, you are consenting to the transfer of your Personal Data to such third parties in accordance with this Policy so that those third parties may share information with you about their products or services. You can subsequently unsubscribe from mailing lists by clicking the ‘unsubscribe’ link on the relevant email.

International Transfers

Your Personal Data may be transferred to, stored or processed in countries outside the United Kingdom or the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place to protect your Personal Data in accordance with Data Protection Legislation.

These safeguards may include one or more of the following:

• transferring your Personal Data to countries that have been deemed to provide an adequate level of protection for Personal Data under Data Protection Legislation, including pursuant to adequacy decisions recognised under Data Protection Legislation;
• using standard contractual clauses or other approved transfer mechanisms recognised under Data Protection Legislation, which require the recipient to protect your Personal Data to the same standard required under Data Protection Legislation for example the International Data Transfer Agreement; and
• implementing additional technical and organisational measures where required to ensure an essentially equivalent level of protection.

You may contact us for further information about the specific safeguards we use when transferring your Personal Data outside the UK or EEA.

Data transfers from the EU/EEA to the UK are currently covered by the European Commission’s adequacy decision.

In exceptional circumstances, where no other transfer mechanism is available under Data Protection Legislation, we may rely on your explicit consent to transfer your Personal Data outside the UK or EEA. Where this occurs, we will inform you of the possible risks of such transfers.

Data Retention

Personal Data will be retained for as long as we need to in order to use it as described above, and/or for as long as we have your permission to keep it. The purposes include satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we collect or process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Workspace Data is retained in accordance with the customer’s instructions and may be deleted or disconnected by the customer at any time, subject to reasonable technical limitations and legal obligations.

If you disconnect third-party integrations, delete the App, or cease active use of the Services but continue to maintain a paid subscription for the App, we will retain Workspace Data and Account Data for the duration of the active subscription period unless you instruct us to delete such data.

Data will only be deleted following:

• expiry or termination of the subscription; or
• a verified deletion request made in accordance with this Policy,

subject in each case to applicable legal, regulatory and backup retention requirements.

In some circumstances we may irreversibly anonymise or de-identify Personal Data and Workspace Data so that it can no longer reasonably be associated with an identified or identifiable individual.

Once anonymised, such data may be used, retained, transferred and disclosed indefinitely for lawful business purposes including product improvement, AI model training, analytics, research, benchmarking, service optimisation and security.

Data Security

We have implemented appropriate physical, administrative, and technical security measures to protect your Personal Data from unauthorised access, use, or disclosure. Notwithstanding the measures Catapult takes to protect your Personal Data, it does not guarantee the security of any Personal Data you provide to us or third parties.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Third Party Websites

If you access a third party website via our Website we are no longer responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Policy. We encourage you to review the privacy statements posted on those websites (and all websites) you visit.

Marketing and Opting Out

We may use your Identity, Contact, Technical, Usage and Profile Data to establish relevant marketing that may be of interest to you. You will receive marketing communications from us if you have requested information from us, purchased goods or services from us, signed up to our newsletters or blogs, provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing. You have the right to withdraw consent to marketing at any time by contacting us or clicking the unsubscribe link. Where you opt out of receiving these marketing messages, this will not apply to Personal Data provided to us as a result of a service purchase, service experience or other transactions.

Your Rights

As a data subject, you have the following rights under Data Protection Legislation, which this Policy and our use of Personal Data have been designed to uphold:

• the right to be informed about our collection and use of Personal Data;
• the right of access to the Personal Data we hold about you;
• the right to rectification if any Personal Data we hold about you is inaccurate or incomplete;
• the right to be forgotten – i.e. the right to ask us to delete any Personal Data we hold about you;
• the right to restrict the processing of your Personal Data;
• the right to data portability – i.e. obtaining a copy of your Personal Data to re-use with another service or organisation;
• the right to object to us using your Personal Data for particular purposes (including direct marketing and processing based on legitimate interests); and
• rights with respect to automated decision making and profiling including the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions).

If you wish to exercise any of these rights, please contact us. Please note that we may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data or to exercise any of your other rights. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

By using our Website, App, engaging in our Services or otherwise providing Personal Data to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use.

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Cookies

We use cookies and similar technologies on our Website and App. These tools enable the website and App to function properly, provide analytics insights, help us improve the usability, performance, and effectiveness of our Services, and tailor your experience. For full details, including the specific cookies we use, their purposes, durations, and how to manage your preferences, please see our separate Cookie Policy at www.catapult.xyz/cookies.html.

Feedback

If you have any questions, feedback or complaints about our use of your Personal Data, please contact us and we will do our best to solve the problem for you. If we are unable to help, you also have the right to lodge a complaint with the relevant supervisory authority: in the UK the Information Commissioner’s Office (www.ico.org.uk) or for the EU/EEA your national data protection authority in the EU/EEA (list available at edpb.europa.eu).