Privacy Policy

This Privacy Policy explains how Katalyst ("we", "us") handles personal information when you use Katalyst: our website, the dashboard where businesses build AI chatbots, and the chat widgets those businesses put on their own websites.

We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).

Who is responsible

For your Katalyst account and our website, Katalyst is the controller of your personal information.

When you chat with an assistant on a business's website, that business decides what the chatbot asks and what happens with the conversation. The business is the controller of that information and we process it on its behalf, under our Data Processing Addendum. Questions about a conversation you had on another website are best sent to that business first.

Katalyst
(address of Katalyst)
E-mail: our support team

What we collect

When you use the dashboard

• Account details: your name, e-mail address, password (stored only as a secure hash) or the Google account you sign in with.
• Workspace content: the chatbots you build, their settings and branding, and the knowledge you add: files, web pages, and text you write.
• Billing details: your plan, invoices and payment status. Card details are handled by our payment provider; we never see or store full card numbers.
• Usage and technical data: pages you open, actions you take, IP address, browser type and error logs, used to run, secure and improve the service.
• Messages to us: what you send when you contact support.

When you talk to a chatbot

• Conversation content: the messages you type and the assistant's replies.
• Contact details you choose to share, such as your name, e-mail address or phone number, and other details the business asks for.
• Technical data: a random visitor ID kept in your browser, the page you chatted on, IP address (used for abuse protection and rate limiting) and the time of the conversation.

How we use it

• To provide the service: answer chat messages, train each chatbot on its owner's knowledge, deliver leads to the business, and send account e-mails.
• To bill subscriptions and top-ups.
• To keep the service secure, prevent abuse and fix problems.
• To improve the product, using aggregated usage information.
• To meet legal obligations, such as tax records.

We rely on performing our contract with you, our legitimate interest in running a safe and useful service, your consent where we ask for it, and our legal obligations.

We do not sell personal information, and we do not use your content or chat conversations to train AI models.

AI processing

To write replies, the relevant parts of a business's knowledge and the conversation are sent to our AI provider. Under its API terms our provider does not use this data to train its models. Replies are generated automatically and can be wrong; businesses can review and correct them.

Who we share it with

We share personal information only with service providers that help us run Katalyst, under contracts that require them to protect it:

• OpenAI: generates chatbot replies and the search index for knowledge.
• Cloudflare (through our file storage service): stores uploaded knowledge files privately.
• Our hosting provider: runs the application and database.
• Stripe: processes payments.
• Resend: sends account and notification e-mails.
• Google: only if you choose "Continue with Google".
• Integrations you connect, such as a CRM, receive the leads you choose to send them.

We may also disclose information when the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply.

International transfers

Some providers are located outside Switzerland and the EU/EEA, including in the United States. Where they are in a country without an adequate level of protection, we rely on safeguards such as the EU Standard Contractual Clauses (with the Swiss and UK amendments).

How long we keep it

• Account and workspace data: while your account is active, and up to 90 days after you close it, unless the law requires us to keep it longer.
• Chat conversations: for the retention period of the business's plan, after which they are deleted automatically. A business can also delete them sooner.
• Billing records: as long as accounting law requires (in Switzerland, ten years).

How we protect it

Connections are encrypted with HTTPS. Knowledge files are stored privately and opened only through short-lived links. Access to workspaces is limited to their members, and our staff can open a workspace only through a recorded support session. Secrets such as integration keys are stored encrypted.

Your rights

You can ask us to access, correct, delete or export your personal information, to restrict or object to how we use it, and to withdraw consent at any time. Write to our support team. If a business is the controller of your data, we will pass your request on to it.

You may also complain to a data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority where you live or work.

Cookies

We use only the cookies and browser storage the service needs. See our Cookie Policy.

Children

Katalyst is not meant for children under 16, and we do not knowingly collect their personal information.

Changes

We may update this policy. We show the date of the latest change at the top of this page and tell account holders by e-mail about important changes.