Privacy Policy

We act in different roles depending on the information involved. Privacy law distinguishes between an organization that decides why and how personal information is used (often called a “controller” or, under the California Consumer Privacy Act, a “business”) and an organization that processes information only on another organization's instructions (a “processor” or “service provider”). Catalystium wears different hats:

This section describes information we collect when you interact with our website, sales, marketing, and support, and as an account administrator or billing contact. (Job-applicant information is described separately in Section 12. Personnel data processed inside the platform is covered in Section 6 and is not collected by us as a controller.)

As a controller, we use the information described in Section 2 to:

• Provide, operate, secure, and support the website and the Service, and provision and administer subscriptions;
• Respond to your demos, inquiries, and support requests, and communicate with you about your account or transactions;
• Send marketing and product communications consistent with your preferences and applicable law, and measure and improve those communications (you can opt out at any time — see Section 8);
• Process payments and maintain billing and tax records;
• Understand and improve how our website and Service are used, including through analytics;
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
• Comply with law and enforce our agreements.

We do not make decisions that produce legal or similarly significant effects about website visitors or prospects through solely automated processing.

Our website is intentionally light on tracking. We use only the limited, strictly necessary cookies and browser storage needed to operate the site securely and to remember a privacy choice if you make one, together with privacy-preserving, cookieless analytics. We do not use advertising or marketing cookies, and we do not track you across other websites. Details about what the website sets, and the choices you have, are in our Cookie Policy (rhenari.com/trust/cookies), which is incorporated into this policy by reference.

Opt-out preference signals (Global Privacy Control). Our website is designed to recognize a Global Privacy Control (GPC) signal. Because we do not sell or share personal information, there is nothing to suppress; as a courtesy, we honor a GPC signal and do not treat your visit as consent to any non-essential cookie.

We share personal information only as described here:

• Service providers and subprocessors. We share information with vendors that perform services for us — such as cloud hosting and infrastructure, payment processing (Stripe), website analytics, email and communications, and customer support — under contracts that require them to protect the information and use it only to provide services to us.
• Marketplaces. Where you transact through the Microsoft, Google, or Slack marketplaces, we exchange the information necessary to provision and manage your subscription.
• Legal and safety. We may disclose information where required by law or legal process, to protect rights, safety, and property, or in connection with an investigation of fraud or abuse.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your direction or consent. We share information at your direction or with your consent.

We do not sell your personal information. We do not sell personal information for money, and we do not disclose De-Identified Data in a manner that identifies the source customer without that customer's consent, except as required by law.

For the personnel data analyzed inside Rhenari, your employer — not Catalystium — is the controller. We process that data as a processor, on the customer's documented instructions, as set out in our customer agreement and DPA. We provide the following description for transparency; it does not make Catalystium a controller of this data. If you are a member of a customer's workforce, direct any questions or requests about this data to your employer.

The platform is built around the following data-handling practices:

• Ephemeral processing of content. Where a customer enables content analysis for specific sources or channels, message and item content is processed transiently in memory solely to produce structured outputs and is then discarded; the structured outputs are retained, but the underlying content that produced them is not stored by the Service. This practice is auditable through the Service's access logs, which are available to the customer's administrators on request.
• Aggregation and non-exposure of individual data. Outputs are presented at the team or department level only. Groups smaller than a configurable minimum size (default three) are suppressed, and the Service does not expose individual-level behavioral data to a customer's executives or managers.
• Pseudonymization. Individual identifiers are pseudonymized before use in persistent analytics where live identifiers are not required.
• Customer responsibility. Our customer is responsible for establishing the lawful basis for the processing and for providing all required notices to, and obtaining all required consents from, its personnel (including any works-council or employee-representative approvals). This is a contractual warranty the customer makes to us.

The governing terms for this processing are in the customer agreement and the Data Processing Agreement. Where this policy and the DPA differ as to personnel data, the DPA controls.

“De-Identified Data” means data derived from Customer Data or the operation of the Service that has been processed to remove or obscure identifiers such that it cannot reasonably be used, alone or in combination with other information reasonably available to Catalystium, to identify a natural person.

We create and use De-Identified Data, as a controller, in order to: (a) operate, maintain, secure, and improve the Service, including its scoring models, signals, insights, and alerts; and (b) conduct and publish research into organizational dynamics and cognitive sustainability in knowledge work, including the development and training of predictive models and algorithms. This includes research, conducted on a de-identified research dataset, into the diagnosis and intervention of prolonged cognitive stress in knowledge work.

Our public commitment. We do not attempt to re-identify De-Identified Data, and we do not re-identify any individual or disclose any individual's data to that individual's employer. Where we share De-Identified Data with service providers or other recipients, we require them to commit to the same no-re-identification standard. We maintain De-Identified Data as de-identified and do not attempt to derive a natural person's identity from it.

Source-specific limits (Google Workspace). Where Customer Data originates from a connected third-party platform whose terms restrict how data from it may be used, we honor those limits. In particular, for data obtained through the Google Workspace APIs and anything derived from it, we do not use, retain, or transfer that data to create, train, or improve any generalized or non-personalized machine-learning or artificial-intelligence model, consistent with the Google API Services User Data Policy, including its Limited Use requirements. This limit applies even after de-identification.

Depending on where you live and the role in which we hold your information, you may have some or all of the rights below. These rights apply to information for which we are the controller. For personnel data processed inside the platform (Section 6), please contact your employer, who controls that data.

We retain personal information for as long as needed for the purposes described in this policy — for example, to maintain your account or relationship with us, to provide the Service, to meet legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements — and then delete or de-identify it. De-Identified Data may be retained and used as described in Section 7.

We maintain administrative, technical, and physical safeguards designed to protect personal information appropriate to its sensitivity. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We currently offer the Service to organizations in the United States and Canada, and we process personal information in those regions and in the United States.

If you apply for a job with us, we collect the information you provide in your application (such as your name, contact details, résumé/CV, work history, and any information you choose to share) and use it to evaluate your candidacy, communicate with you, and manage our hiring process. We retain applicant information as needed for these purposes and as required by law.

The website and the Service are intended for businesses and for individuals who are at least the age of majority in their jurisdiction. They are not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us so we can delete it.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where required by law or where changes are material, provide additional notice. The version in effect at any time governs our handling of personal information at that time.

If you have questions about this policy or wish to exercise a privacy right, contact us at:

Catalystium is a Delaware corporation.