Privacy Policy

1. Controller Information

The controller responsible for your personal data is:

CODEGENIX LTD.
Academy House 11 Dunraven Place, Bridgend, Mid Glamorgan, United Kingdom, CF31 1JF
Company Number: 16808123
Email: support@catalystai.expert

This Privacy Policy explains how we collect, use, and protect your personal data in compliance with the UK GDPR, the EU General Data Protection Regulation (GDPR) where it applies, and other applicable data protection laws.

2. Information We Collect

2.1 What We Collect

This is everything we collect, when we collect it and why. We collect nothing else.

2.2 How We Collect Data

We collect personal data through:

• Direct interactions when you create an account, purchase credits, or contact us
• Necessary cookies (listed in our Cookie Policy)
• Our payment processor, which tells us whether a payment succeeded

3. Lawful Basis for Processing

We process your personal data based on the following lawful bases under GDPR:

• Contract Performance: To provide services you've purchased (Art. 6(1)(b) GDPR)
• Legal Obligation: To comply with our legal and accounting obligations (Art. 6(1)(c) GDPR)
• Legitimate Interests: To improve our services, prevent fraud, and ensure security (Art. 6(1)(f) GDPR)

4. How We Use Your Information

We use your personal data to:

• Provide and maintain our platform and services
• Process credit purchases and transactions
• Manage your account and provide customer support
• Send service-related communications
• Improve platform functionality and user experience
• Prevent fraud and ensure platform security
• Comply with legal and regulatory requirements

5. Data Sharing and Recipients

We do not sell your personal data. We may share data with:

• Service Providers: our payment processor and the hosting and database providers named below
• Specialists: Necessary information to fulfill your service requests
• Legal Authorities: When required by law or to protect our legal rights
• Professional Advisors: Lawyers, auditors, insurers

The providers that process your data for us:

• Hosting provider: runs the website and stores the files you upload.
• Database hosting provider: hosts our database, on servers in the United States.
• Payment processor: takes card payments.
• Email delivery provider: sends account, receipt and project emails.
• AI model provider: reads the brief you write to suggest matching specialists.
• Messaging app provider: only for specialists who link a messaging app for task notifications.
• We do not use a third-party analytics service.

All third parties are required to keep your data secure and process it only as we instruct them.

6. International Data Transfers

Your personal data is transferred to and processed in countries outside the United Kingdom and the European Economic Area (EEA), including the United States. Where we transfer data outside the UK or the EEA, we ensure appropriate safeguards are in place:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Binding Corporate Rules where applicable

7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Account Data: For as long as your account is open. Deleting your account erases it immediately (see below)
• Transaction Data: 7 years for our legal and accounting obligations
• Specialist identity details and documents: 5 years after the relationship ends, if the specialist has done paid work; otherwise erased with the account
• Technical/Usage Data: 12 months unless required for security

Records kept for a legal obligation are not deleted automatically when their period ends: once it has passed, write to support@catalystai.expert and we will delete them.

Self-service deletion (Settings → Data & Privacy → Delete Account) permanently deletes your account. If it has no purchases, paid projects or paid specialist work, everything is erased at once, including a specialist application and its identity documents. If it has financial history, your personal details (name, email, password, sign-in methods, messaging-app link) are erased immediately, while the transaction and invoice records and the identity-verification status we are required to keep are retained under an anonymous account for the periods above (see AML Policy §8). A specialist's identity details and documents are kept for the same reason. You can export your own copy first (Settings → Export My Data).

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your national supervisory authority

Access and portability: download a full export of your data yourself anytime from Settings → Data & Privacy → Export My Data. Erasure: delete your account yourself anytime from Settings → Data & Privacy → Delete Account (see §7 above for what this does to transaction records). For rectification, restriction, objection, or any request you can't complete yourself, contact us at support@catalystai.expert - we will respond within one month.

Supervisory Authority: You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data properly: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in the EU, your national authority, listed at edpb.europa.eu.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (HTTPS)
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response procedures

In the event of a data breach that poses a high risk to your rights, we will notify you and the relevant supervisory authority within 72 hours.

10. Cookies and Tracking

We use only necessary cookies, for sign-in, security and your chosen currency. We set no analytics or marketing cookies. For the full list, see our Cookie Policy.

The "Manage Cookies" link in the footer of any page shows the cookies we set. You can also control cookies through your browser settings.

11. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@catalystai.expert and we will delete it promptly.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on our platform at least 30 days before taking effect. Continued use after changes constitutes acceptance.