Effective Date and Last Updated

Effective Date: September 7, 2026

Last Updated: September 7, 2026

This Privacy Policy is effective as of the date above and will remain in effect except to the extent that we may amend it from time to time as described in the "Privacy Policy Changes" section below.

Company and Data Controller

This Privacy Policy is published by Catebox (hereinafter "we", "us", or "our"), the operator of the Services. We act as the data controller for personal information collected through the Services, and our service providers act as data processors on our behalf.

Company Name: Catebox

Website: https://catebox.com/

Contact Email: [email protected]

Data Protection Officer (DPO): Available upon request at the contact email above.

Information We Collect

We collect only the information needed to provide, secure, and improve the Services. Depending on how you use the Services, this may include:

• Account information: your email address, authentication details, and account identifiers when you create or sign in to an account.
• Usage and diagnostic information: pages or features used, timestamps, referring pages, error reports, performance data, and settings needed to remember your preferences.
• Browser extension data: when you use our browser extension to save content, we collect the URL, title, and content of the pages.
• Device and browser information: browser type and version, operating system, device type, screen resolution, and language preferences.
• Sync data: if you enable synchronization, we collect your preferences to sync them across your devices.
• Third-party login information: if you sign in using a third-party provider (such as Google or Apple), we may receive your name, email address, and profile information from that provider.
• Payment information: if you subscribe to a paid plan, we collect payment method details through our payment processor (we do not store full credit card numbers on our servers).

We do not intentionally collect sensitive personal information, payment card numbers, precise location data, or the contents of private communications unless you voluntarily provide them. Please do not submit information that the Services does not require.

Consent

By using our Services, you hereby consent to our Privacy Policy and agree to its terms. Where required by applicable law (for example, the EU General Data Protection Regulation, "GDPR"), we will obtain your explicit consent before processing your personal information for purposes that are not strictly necessary to provide the Services, such as analytics or non-essential cookies.

Legal Basis for Processing

Where required by applicable law, we process your personal information on one or more of the following legal bases:

• Performance of a contract: to provide the Services you have requested and to fulfill our contractual obligations to you.
• Consent: where you have given consent for a specific purpose, which you may withdraw at any time.
• Legitimate interests: to operate, secure, and improve the Services in ways that do not override your rights and freedoms.
• Legal obligation: to comply with applicable laws, regulations, court orders, and legal processes.
• Vital interests: in rare circumstances, to protect the vital interests of you or another person.

How We Process Your Information

We use the information we collect in various ways, including to:

• Provide, operate, and maintain our Services.
• Improve, personalize, and expand our Services.
• Understand and analyze how you use our Services.
• Develop new products, services, features, and functionality.
• Authenticate users, provide support, and send service-related notices.
• Detect, investigate, and prevent security incidents, abuse, fraud, and violations of our terms.
• Comply with legal obligations and enforce our agreements.

Where applicable, we process information to perform our contract with you, with your consent, to comply with legal obligations, or for our legitimate interests in operating and securing the Services. We will not use your saved content to display targeted advertising.

How We Store and Retain Your Information

Your information may be stored on our servers and on infrastructure operated by service providers that help us run the Services. We retain account information and synchronized content while your account is active or for as long as needed to provide the Services. We retain logs, diagnostics, and support records only for the period reasonably necessary for security, troubleshooting, business records, or legal compliance.

When you delete content or close your account, we will delete or anonymize it within a reasonable period, unless we must retain specific information to comply with law, resolve disputes, prevent abuse, or protect the security of the Services. Backups may retain deleted information for a limited period before being overwritten.

Retention Periods:

• Account and content data: retained for the duration of your account and deleted within 30 days of account closure or deletion request, subject to legal hold requirements.
• Security and access logs: retained for up to 12 months for security monitoring and incident investigation.
• Support records: retained for up to 24 months after the last interaction, for quality and dispute resolution purposes.
• Analytics data: retained in aggregated or pseudonymized form for up to 26 months, in line with common analytics retention standards.
• Payment and billing records: retained as required by applicable tax and accounting laws (typically 5–7 years).

After the applicable retention period, information is deleted or anonymized unless a longer retention is required by law.

How We Share Your Information

We do not sell your personal information. We may share information only in the following circumstances:

• Service providers: with hosting, storage, authentication, analytics, email, customer-support, security, and other vendors that process information on our behalf and under appropriate confidentiality and security obligations.
• Legal and safety purposes: when reasonably necessary to comply with a law, court order, or legal process; protect the rights and safety of users, the public; or investigate fraud, abuse, or security issues.
• Business transfers: if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.
• With your direction: when you choose to publish, export, share, or connect the Services with another service.

Service providers may use information only to perform the services they provide to us and may not use it for their own unrelated advertising purposes.

Third-Party Recipients of Your Data

We share your personal information with the following categories of third-party recipients, each for the specific purposes listed below:

• Cloud hosting and infrastructure providers (e.g., Amazon Web Services, Google Cloud, or similar): to host our servers, store your account data, and provide compute resources. Data shared: account information, sync data, and usage logs.
• Authentication providers (e.g., Google, Apple, Microsoft, or Auth0): to enable single sign-on. Data shared: email address, name, and profile information you authorize to be shared.
• Payment processors (e.g., Stripe, PayPal): to process subscription payments and refunds. Data shared: billing address, payment method tokens, and transaction history. We do not receive or store full credit card numbers.
• Analytics providers (e.g., Google Analytics, Mixpanel, or PostHog): to measure usage patterns and improve the Services. Data shared: pseudonymized usage data, page views, and feature interactions.
• Email and notification services (e.g., SendGrid, Mailgun, or Amazon SES): to send transactional emails such as password resets, receipts, and service notices. Data shared: email address and account status.
• Customer support platforms (e.g., Zendesk, Intercom, or Help Scout): to handle support tickets. Data shared: account information and the content of your support requests.
• Security and monitoring tools (e.g., Datadog, Sentry, or Cloudflare): to detect and respond to security incidents and performance issues. Data shared: IP addresses, error reports, and diagnostic logs.
• Legal and regulatory authorities: when required by law, court order, or to protect the rights and safety of users or the public. Data shared: as narrowly required by the applicable legal process.
• Business transaction counterparties: in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. Data shared: your account and usage information, subject to applicable law.
• Third-party services you connect: when you choose to export, share, or integrate the Services with another service (e.g., Notion, Evernote, Slack, or Zapier). Data shared: the specific content you choose to share.

Each service provider is bound by a data processing agreement that restricts them to processing your information only for the purposes we have specified and prohibits them from using your information for their own unrelated purposes, including advertising.

International Data Transfers

Our service providers or servers may be located in countries other than the country where you live, including the United States, the European Union, and other jurisdictions. Where information is transferred across borders, we take reasonable steps to protect it and use legally recognized transfer mechanisms where required by applicable law, including:

• Standard Contractual Clauses (SCCs): the European Commission's approved contractual clauses for transfers of personal data from the European Economic Area to third countries.
• Binding Corporate Rules (BCR): where applicable within our corporate group.
• Adequacy decisions: transfers to countries recognized by the European Commission as providing an adequate level of protection.
• Supplementary measures: additional technical and organizational safeguards such as encryption, pseudonymization, and access controls to ensure an essentially equivalent level of protection.

Where required, we will notify you of the specific transfer mechanism in place for your data and provide a copy of the relevant safeguards upon request.

Data Processing Agreements

Where we engage service providers to process personal information on our behalf, we enter into written data processing agreements (DPAs) that comply with applicable law, including GDPR Article 28. These agreements require our service providers to:

• Process personal information only on our documented instructions.
• Ensure that personnel authorized to process the information have committed themselves to confidentiality.
• Implement appropriate technical and organizational security measures.
• Assist us in responding to data subject requests and data protection impact assessments.
• Notify us without undue delay upon becoming aware of a personal data breach.
• Delete or return all personal information at the end of the service provision, unless law requires otherwise.
• Make available all information necessary to demonstrate compliance and allow for audits.

Log Files

Our services follow a standard procedure of using log files. These files log visitors when they visit our Services. All hosting companies do this as part of hosting services' analytics. The information collected by log files includes internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable.

Cookies and Web Beacons

We may use cookies, local storage, and similar technologies to keep you signed in, remember preferences, maintain security, measure performance, and understand how the Services are used. We do not use these technologies to read unrelated browsing activity or to build advertising profiles. You can control cookies through your browser settings, but disabling essential cookies may prevent some features from working.

Your Choices and Privacy Rights

Depending on your location and applicable law, you may have the following rights with respect to your personal information:

• Right of Access: request a copy of the personal information we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): request deletion of your personal information where there is no compelling reason for continued processing.
• Right to Restrict Processing: request that we limit how we process your information in certain circumstances.
• Right to Object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability: receive your personal information in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Withdraw Consent: withdraw consent at any time where processing is based on consent; withdrawal will not affect the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: complain to your local data protection authority if you believe we have not handled your information in accordance with applicable law.

You may also unsubscribe from non-essential marketing messages at any time. Service-related messages may still be sent when necessary to operate or secure your account.

To make a request, contact us using the address below. We may ask for information needed to verify your identity and will respond within the time required by applicable law (typically within 30 days under GDPR). You can also delete content through available account controls or request account closure from support. We will not discriminate against you for exercising any of these rights.

Automated Decision Making and Profiling

We do not use solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you. Any personalization of the Services is based on your explicit preferences and usage patterns and can be adjusted or disabled through your account settings.

Data Breach Notification

We have procedures in place to respond to any suspected or confirmed data breach. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required by applicable law, notify the relevant supervisory authority within the statutory timeframes (for example, within 72 hours under GDPR). You will be informed of the nature of the breach, the categories of information affected, the measures taken or proposed to address it, and the steps you can take to protect yourself.

Breach Response Process:

• Detection and containment: we will immediately contain the breach and prevent further unauthorized access.
• Assessment: we will assess the nature, scope, and severity of the breach, including the categories and approximate number of data subjects and records affected.
• Notification to authorities: where required, we will notify the relevant supervisory authority within the statutory timeframe.
• Notification to affected users: where the breach poses a risk to your rights and freedoms, we will notify you directly by email or through the Services.
• Remediation: we will implement corrective measures to prevent recurrence and document the incident for future reference.

How to Exercise Your Rights

To exercise any of the rights described in the "Your Choices and Privacy Rights" section, please contact us using the information in the "Contact Information" section. To process your request, we may need to verify your identity. We will respond to your request within the timeframes required by applicable law (typically within 30 days under GDPR).

Ways to submit a request:

• Email: send a request to [email protected] with the subject line "Privacy Request".
• In-app: use the account settings to export or delete your data where available.
• Support ticket: contact our support team through the Services.

We will not charge a fee for responding to your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act. We will not discriminate against you for exercising your rights.

Third-Party Privacy Policies

This Privacy Policy does not apply to other advertisers or Services. Thus, we are advising you to consult the respective Privacy Policies of them for more detailed information. It may include their practices and instructions about how to opt-out of certain options.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, alteration, disclosure, or destruction. These measures may include access controls, encryption in transit, monitoring, and backups. No method of transmission over the Internet or electronic storage is completely secure, so we cannot guarantee absolute security.

Children's Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.

We do not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our Services, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.

Links to External Sites

Our Service may contain links to external sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy and terms of service of every site you visit.

We have no control over, and assume no responsibility for the content, Privacy Policies or practices of any third party sites, products or services.

Privacy Policy Changes

Although most changes are likely to be minor, we may change this Privacy Policy from time to time, and in our sole discretion. We encourage visitors to frequently check this page for any changes to its Privacy Policy. Your continued use of our Services after any change in this Privacy Policy will constitute your acceptance of such change. For material changes, we will provide notice through the Services or by email before the changes take effect.

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

• Company: Catebox
• Email: [email protected]
• Website: https://catebox.com/
• Data Protection Officer: Available upon request at the email above.

We will respond to verified requests within the timeframes required by applicable law. Please include sufficient detail and, where required, information to verify your identity so we can process your request efficiently.