Privacy Policy

Privacy at a glance

We build AI agents that work inside our clients' systems, so we are trusted with data that matters. This summary sets out the essentials in plain language. The full policy follows below.

This privacy policy explains how Catalect Pvt. Ltd. ("Catalect", "we", "us" or "our") collects, uses, shares and protects personal information, whether you are visiting our website, working with us as a client, applying for a role, or interacting with an AI agent that Catalect has built or operates.

• Who we are: Catalect Pvt. Ltd., an AI engineering partner with offices in Karachi, Pakistan and London, United Kingdom.
• What we collect: Contact and business details you share with us, information about how you use our website, and, when we build or run AI systems for clients, the data those clients instruct us to process.
• Our two roles: For our own business purposes we decide how your data is used. For data our clients give us to build or run AI systems, the client decides and we act on their instructions.
• Your data and AI: We do not use client data to train general-purpose AI models, and we do not use one client's data for the benefit of another client.
• Selling data: We do not sell personal information.
• Your rights: You can ask to access, correct or delete your data, and exercise other rights described below, by emailing privacy@catalect.io.

1. Introduction

This privacy policy explains how Catalect Pvt. Ltd. ("Catalect", "we", "us" or "our") collects, uses, shares and protects personal information, whether you are visiting our website, working with us as a client, applying for a role, or interacting with an AI agent that Catalect has built or operates.

‍Personal information means any information that can be used, on its own or combined with other information, to identify, contact or locate a person, or to identify an individual in context.

Catalect is an AI engineering partner. We design, integrate and deploy AI agents and workflow automation into our clients' existing systems, and we build and operate ConvoIQ, our AI agent platform that brings voice, WhatsApp and email into one conversation. This policy covers: our website at www.catalect.io, including our website assistant, Aira; our services: AI Strategy and Consulting, AI Proof of Concept, AI Agent Development, Data and System Integration, AI Workflow Automation, and AI Governance and Readiness; the ConvoIQ platform, available at www.convoiq.co; and our marketing, events and recruitment activities.

2. Our role: controller and processor

Catalect acts in two different roles depending on the data involved. Knowing which role applies tells you who is responsible for your data and who to contact.

2.1 When Catalect is the controller

We are the controller, meaning we decide how and why personal information is used, when we process it for our own business purposes. This includes: running our website, Aira, newsletters, events and marketing; managing our relationships with clients, prospective clients, partners and suppliers, such as the business contact details of the people we work with, correspondence, proposals, contracts and invoicing; recruitment; and meeting our own legal, accounting and regulatory obligations.

2.2 When Catalect is a processor

When a client engages us to build, test or run an AI system, including a ConvoIQ deployment, any personal information the client provides or makes available to us for that work is controlled by the client. We process it on the client's behalf and only in line with the client's documented instructions and the terms of our agreement with that client.

If you are a customer of one of our clients (for example, someone speaking to a client's AI agent on WhatsApp or by phone), the client's own privacy policy explains how your information is used, and requests about your data should be made to that client. If you contact us instead, we may refer you to the relevant client, and we will assist our clients with such requests in line with our contractual obligations to them.

The same client may therefore have some data handled by us as a controller (for example, the contact details of their staff we correspond with) and other data handled by us as a processor (for example, customer records used to build an AI agent).

3. What personal information do we collect?

3.1 From website visitors

• Name, email address, phone number, company, job title and message content when you book a discovery call, fill out a form, subscribe to our newsletter or download a resource.
• Conversations with Aira, our website AI assistant, including any details you choose to share.
• Technical information such as IP address, browser type, device, pages visited, referring source and time on site, collected through cookies and similar technologies (see Section 11).

3.2 From clients and prospective clients

• Business contact details of the people we work with, meeting notes, correspondence, proposals, contracts, invoicing and payment details.
• Information shared during discovery workshops, strategy engagements and AI readiness assessments.

3.3 Data we process on behalf of clients

To design and deploy AI agents, a client may give us access to its systems and data. Depending on the engagement, this can include:

• Customer records, CRM and ERP data, transaction logs, and operational data.
• Documents and knowledge bases used to ground AI agents in the client's own information.
• Sample or historical data used to validate a Proof of Concept on the client's own data.

We aim to access only what the engagement requires, and we encourage the use of anonymised, pseudonymised or synthetic data wherever it can do the job.

3.4 Through ConvoIQ

When a client deploys ConvoIQ, we process the following on the client's behalf about people who contact that client:

• Names, phone numbers, email addresses and WhatsApp profile information.
• Message content, email content, voice call recordings and transcripts.
• Conversation metadata such as timestamps, channel, handoff history and outcome,
• Any account or order details the client connects to ConvoIQ, such as an order number or support ticket.

3.5 From job applicants

• CVs, cover letters, portfolio links, interview notes and references.

3.6 Special category data

We do not seek to collect special category data (such as information about health, racial or ethnic origin, religious beliefs, sexual orientation, or biometric or genetic data) or information about criminal offences for our own business purposes. Please do not share this kind of information with us through our website forms or Aira.

Where a client asks us to process such data as part of an engagement, the client, as controller, is responsible for establishing a lawful basis and satisfying any additional legal conditions that apply. A contract with Catalect does not by itself authorise this processing. We will only process such data where the client has confirmed that these requirements are met and appropriate additional safeguards have been agreed with us in writing.

4. When do we collect information?

We collect information when you visit our website, book a discovery call, fill out a form, chat with Aira, subscribe to our newsletter, download a resource, attend an event or webinar, respond to a survey, apply for a job, or enter into an engagement with us. We also receive information from clients when they give us access to their systems, and through ConvoIQ when people interact with a client's AI agent.

5. How do we use your information?

When acting as a controller, we use personal information to:

• Respond to enquiries, run discovery calls and prepare proposals.
• Deliver and manage our services and client relationships, including contracts and invoicing.
• Operate, maintain, secure and improve our website, Aira and ConvoIQ.
• Send newsletters, resources and event invitations where you have agreed or where the law permits.
• Ask for feedback and, with your permission, feature testimonials or case studies.
• Assess job applications; and meet legal, regulatory, tax and security obligations and protect our rights.

When acting as a processor, we use client data only to provide the services the client has engaged us for, in line with the client's instructions.

6. Why we process data: our legal bases

Where data protection laws such as the UK GDPR require a legal basis for processing we carry out as a controller, we rely on:

• Contract: to deliver services you or your organisation have engaged us for, or to take steps at your request before entering into a contract.
• Legitimate interests: to run and grow our business, secure our systems and communicate with business contacts, where these interests are not overridden by your rights.
• Consent: for certain marketing and, where required, for cookies. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or disclose information.

7. How we handle data in AI systems

As an AI engineering partner, we believe building agents is only the start. Running them responsibly in production is where the real work begins. This section explains our approach.

7.1 Our architecture and providers

Our AI systems, including ConvoIQ, are built on serverless cloud services. Depending on the solution, personal information may be processed by the following categories of third-party providers:

• AI model providers: OpenAI, Anthropic and AI services available through Microsoft Azure, which provide the language and AI models that power our agents.
• Cloud infrastructure: Microsoft Azure and other serverless cloud services that host and run our applications.
• Voice and telephony: Twilio, which enables phone calls and voice interactions.
• Messaging: Meta, through the WhatsApp Business Platform, which enables WhatsApp conversations.
• other service providers that support email delivery, analytics and business operations.

The specific providers used in a client solution depend on its design and are agreed with the client. Clients can request details of the providers used in their solution.

7.2 How providers handle data

We review the data-use terms of the AI and cloud providers we work with and, where available, choose settings and service options that limit how long submitted data is retained and prevent it from being used to train their models. Each provider handles data under its own terms and data processing commitments, which may differ between providers and services.

7.3 Our commitments

• No training on client data for others: we do not use client data or ConvoIQ conversation data to train general-purpose AI models, and we never use one client's data for the benefit of another client.
• Data minimisation: we design agents to access only the systems and information they need, and where practical we mask, redact or pseudonymise personal information before it is sent to an AI model.
• Human oversight: our agents are designed to support guided handoffs, so a person can review, take over or override a conversation or action.
• Logging: we may keep records of agent activity to support accuracy, troubleshooting and audit.

7.4 The client's role in how AI is used

When we build or run an AI system for a client, the client decides how that system is used, what it is used for and how it is configured in its own operations. If a client uses an AI system to make decisions that have legal or similarly significant effects on individuals, the client, as controller, is responsible for ensuring there is appropriate human oversight, a lawful basis, and transparency towards the people affected. As part of our AI Governance and Readiness work, we can advise clients on these requirements, and we encourage clients to tell their customers when they are interacting with an AI agent.

8. How do we protect your information?

We use reasonable technical and organisational measures to protect personal information from unauthorised or unlawful access, loss, destruction, use, modification or disclosure. Depending on the service, these include:

• Encryption of data in transit and, through our cloud providers, at rest.
• Access controls and authentication for our team, with access limited to people who need it.
• Use of established cloud providers for hosting and processing.
• Separation of client data and environments.
• Confidentiality obligations for everyone who handles personal information.
• A process for responding to security incidents, including notifying affected clients where required.

8.1 Website-specific security and data handling

Our website is served over an encrypted connection (HTTPS). Information submitted through website forms or Aira is stored in systems that only authorised team members can access. We do not collect payment card details through our website.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. Where we deploy into a client's own environment, the client is responsible for the security of that environment, and responsibilities are agreed with the client in advance.

9. How long we keep information

We keep personal information only for as long as it is needed for the purpose it was collected, to meet legal, accounting or regulatory obligations, or to establish, exercise or defend legal claims. When it is no longer needed, we delete it or anonymise it. In practice:

• Website enquiries are kept while we are in contact with you and for a reasonable period afterwards, unless you become a client.
• Client records are kept for the duration of the engagement and afterwards for as long as needed to meet contractual, tax and legal requirements.
• Client data used to build or run AI systems is kept, returned or deleted in line with our agreement with the client and the client's instructions.
• ConvoIQ conversation data is retained according to the client's configuration and our agreement with the client.
• Aira chat logs are retained only for as long as reasonably necessary to provide, maintain and improve the assistant, support security and troubleshooting, and meet applicable legal obligations.
• Job applications are kept for as long as needed for the recruitment process, and longer only if you agree.
• Marketing contact details are kept until you unsubscribe or object.

We review the information we hold periodically and delete what is no longer needed.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Ask us to delete your information.
• Restrict or object to certain processing, including direct marketing.
• Receive your information in a portable format.
• Withdraw consent where we rely on it.

To exercise any of these rights, email privacy@catalect.io. We will respond within the time required by applicable law. Under the UK GDPR, this is one month, which can be extended by up to two further months for complex or numerous requests. We may need to verify your identity before acting on a request.

If your information is processed through a client's AI agent or ConvoIQ deployment, please contact that organisation directly, as described in Section 2.2.

To exercise any of these rights, email privacy@catalect.io. We will respond within the time required by applicable law. Under the UK GDPR, this is one month, which can be extended by up to two fuIf you are in the United Kingdom, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at https://ico.org.uk/make-a-complaint/. We would appreciate the chance to address your concern first.rther months for complex or numerous requests. We may need to verify your identity before acting on a request.

11. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies are small files placed on your device that help a website recognise your browser and remember certain information. We use them to keep the website working properly, remember your preferences, understand how visitors use our website so we can improve it, and, where you consent, measure the effectiveness of our marketing.

Some of these technologies are provided by third parties, who may collect information about your use of our website under their own privacy policies. Where required by applicable law, we obtain your consent before using non-essential cookies or similar technologies. You can manage your cookie preferences through our cookie settings or your browser settings. If you block certain cookies, some parts of the website may not work as intended.

12. How we share information

We do not sell personal information or provide personal information to third parties for their own independent marketing purposes. We share personal information only as described below:

• Service providers and sub-processors: providers that help us operate our business and services, including the AI, cloud, voice, messaging and other providers described in Section 7.1. They may only use the information to provide services to us or our clients, under contractual obligations to protect it.
• Analytics and advertising technologies: where you consent to analytics or advertising technologies on our website, providers of these technologies may collect limited information about how you use our website, such as device and browser information, pages visited and interactions, as described in Section 11.
• Our clients: where we process data on their behalf.
• Professional advisers: such as lawyers, accountants, auditors and insurers.
• Authorities: where required by law or to protect rights, property or safety.
• Business transfers: if Catalect is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

13. International data transfersre information

Catalect operates from Pakistan and the United Kingdom and serves clients in the GCC, the United Kingdom, the United States and elsewhere. Our service providers may also process data in other countries. As a result, your information may be transferred to and processed in countries other than your own, which may have different data protection laws.

Where we transfer personal information from the United Kingdom or the European Economic Area, we use appropriate safeguards recognised under applicable law, such as the UK International Data Transfer Agreement or Standard Contractual Clauses. Where a client or regulation requires data to be kept in a particular country or region, this is agreed in the client contract.

14. Third-party links

Our website may link to other websites, including www.convoiq.co, LinkedIn and partner websites. Websites we do not operate have their own privacy policies, and we are not responsible for their content or practices.

15. Marketing communications

We may use your email address to respond to enquiries, deliver services and, where you have agreed or the law allows, send our newsletter, resources, event invitations and relevant updates. In line with the UK Privacy and Electronic Communications Regulations, the US CAN-SPAM Act and similar laws, we will:

• Not use false or misleading subject lines or sender details.
• Clearly identify marketing messages.
• Include our business address in marketing emails.
• Include an unsubscribe link in every marketing email; and honour opt-out requests promptly.

You can unsubscribe at any time using the link in any marketing email or by emailing privacy@catalect.io.

16. Children's privacy

Our website and services are designed for businesses and are not directed at children. We do not knowingly collect personal information from children for our own business purposes. If you believe a child has provided us with personal information, please contact us and we will delete it. Where a client deploys an AI agent that may interact with children, the client is responsible for determining and meeting the applicable legal requirements, including any requirements relating to age, consent, transparency and safeguarding.

17. Changes to this policy

As AI technology and regulation evolve, we may update this policy. We will post any changes on this page and update the "Last updated" date. Where changes are significant, we will take reasonable steps to let clients and subscribers know.

18. Contact us

If you have any questions about this privacy policy or how we handle personal information, please contact us:

Catalect Pvt. Ltd.

Offices in Karachi, Pakistan and London, United Kingdom

Email: privacy@catalect.io

Website: www.catalect.io