Privacy Policy

This policy explains what personal data Katalis collects when you use this website, chat with Katalis, or use our free business tools, how we use it, who we share it with, and the rights you have. We keep it plain — no legal fog.

MeetKatalis is a trading name of Curtis Ashley, a sole trader at 43 East Street, Farnham, Surrey, GU9 7SW, who is the data controller responsible for your information. We are registered with the UK Information Commissioner's Office (ICO): our registration number is ZC233247. If you have any questions about this policy or your data, email us at katalis@meetkatalis.com.

What we collect

We only collect what we need to help you:

• Enquiry details — when you fill in the contact form: your name, your email and your message, which come to our inbox. When you tick a free tool's box asking us to follow up or help: your email, your business's name and what you were checking. Anything you tell Katalis in the chat is covered under conversation content below.
• Conversation content — the messages you send Katalis in the on-site chat, and the answers you give in the free Business Score tool. We store these, linked to a random id for your browser (see Cookies below), so we can understand what visitors need — including when the same browser comes back — and improve the service and Katalis's answers over time. This id identifies a browser, not you personally, and we never use your IP address for it. Please don't share sensitive personal details in the chat.
• Basic usage data — anonymous, aggregated analytics about how the site is used, and standard server logs (such as your browser type and rough request info) needed to run the site securely. If you accept optional cookies, we also record anonymised session interactions (like page journeys, clicks and scrolling) to help us improve the site — you can decline this, and text you type is masked.
• Business Score tool — when you use our free business-analysis tool, we take the website or business name you enter and look it up in publicly-available sources (the website itself, web search results, and the Companies House register) to produce your score. The score asks nothing of you. The full report opens with a free account (your email and mobile, both verified), and we record which account opened which business's full report, kept for 12 months, so the reports can't quietly be used to target businesses. We only email you about it if you tick the box asking for follow-ups: then up to three short emails about your score, each with a one-click stop link.
• Other free tools — our ID-verification deadline checker, Tender Radar and AI-visibility checker work the same way as the Business Score: we look the business you enter up in public sources (the Companies House register, the government's Contracts Finder feed, the business's own website). The full detail (Tender Radar's full list, the AI-visibility fix plan) opens with your free account. We only follow up by email if you tick the box asking us to. The funding checker takes your email only if you ask us to help you apply. If you ask the ID checker to watch your company, we keep your email and company number so we can re-check the public register weekly and email you what changed, until 1 December 2026 (the last date in the timetable) or you stop the updates (every email has a one-click stop link).
• Developer accounts & payments — if you buy an API plan or membership, we collect your email and the details needed to run your subscription. Card payments are handled entirely by Stripe — we never see your card number. Developer sign-in uses passwordless email links plus a mobile phone number: developer accounts require SMS verification, so we collect and store your mobile number and send you a one-time code by text. We use the number only for account security and fraud prevention — never for marketing — and it's deleted with your account.
• API usage logs — when you call our APIs with your key, we record each call (which endpoint, its credit cost, and when) linked to your key. We use this to meter your plan, show you your own usage dashboard, and protect the service from abuse. Usage logs are kept for up to 12 months, then deleted.
• Marketing review uploads (members) — if you're a member and upload a screenshot of your own marketing or advertising dashboard for review, we send that image to our AI provider to read the figures and give you feedback. We don't keep the image after your review, we don't share it with anyone else, and it is never used to train AI models. Please only upload data you have the right to share.
• How you work with Katalis (members) — so that Katalis can learn how you like things done, we keep a record of the choices you make inside your account: which designs you keep or change, what you rewrite in your own words, which plan items and opportunities you act on or set aside, and the widgets you keep. When you're signed in and chat to Katalis, your side of that chat is kept against your account too, and standing facts you tell her about your business (opening hours, what you don't do) are picked out for you to confirm or remove. It all stays with your account, is never pooled with other members' choices or used to train AI models, and is deleted when you delete your account.
• Setting up with Katalis. If you choose to do the setup in your Katalis (free and paid accounts), it saves what you tell her about your business (what you sell, the areas you cover, your customers as a type, your busy times, how you like to sound), a short summary of what your own website says, read again each month, the month she plans for you, the name you'd like her to use, and your answer to whether she can email you. She uses it to help your business and to show you what a membership would do for it. You can see and remove what she knows in your Account, and deleting your account deletes all of it. She never asks for card details, passwords, your customers' details or anything personal.
• Keeping an eye on your business. For every account with a business, we check that its website is up each day and re-check its Business Score each month. That's your business's public website, never you as a person.

We do not ask for sensitive personal information, and you should not send us any through the chat.

How we use it

• To reply to your enquiry and arrange a conversation with our team.
• To power the Katalis chat and give you helpful, relevant answers.
• To understand what visitors need and improve the site and service.
• To run the Business Score tool and send you the report you ask for.
• To send follow-up emails from our free tools, only when you tick the box asking for them; each one has a one-click stop link, and stopping is immediate.
• On a free account, to email you what the checks on your business find, only if you said yes during setup; every email has a one-click stop link.
• To review marketing screenshots that members choose to upload.
• To keep the website secure, working properly, and protected from abuse or automated overuse of our public tools.

Our lawful bases under UK GDPR are: your consent (which you can withdraw at any time), our legitimate interest in running and improving our business, and taking steps at your request before entering into a contract.

Who we share it with

We never sell your data. We use a small number of trusted service providers who process data on our behalf, under contract:

• Vercel — website hosting, privacy-friendly analytics, and the AI gateway that routes chat messages.
• AI model providers (OpenAI, Anthropic) — provide the AI models that generate Katalis's replies, power the Business Score and document analysis, answer the AI-visibility checker's questions, and read any marketing screenshot a member uploads. Your content is processed to produce a response and is not used to train their models.
• Image model provider (Black Forest Labs) — when a member asks Katalis for a picture (a header image, say), the description is sent through the AI gateway to generate it. No personal details are included.
• Stripe — processes all card payments and subscription billing, and issues VAT invoices. Your card details go to Stripe directly and never touch our servers. If you delete your account, Stripe keeps its own record of your payments for as long as tax and accounting law requires; we keep no copy.
• Web search & page-reading providers — our free tools and the Business Score send the website or business name you enter to a search API (Tavily or Brave) and, when a page needs a browser to read, a page-reading service (Jina Reader), to gather publicly-available information about it. The website address also goes to Google PageSpeed Insights, to measure its speed. Your contact details are not sent to any of them.
• Supabase — securely stores our records (hosted in the EU, in Ireland): enquiry details, and for members their account, their businesses, the pieces and designs they make, their brand kit, the images they upload, a screenshot of their own homepage (taken only once they've shown the site is theirs), and their conversations with Katalis.
• Resend and Zoho Mail — deliver and receive our email.
• Twilio — delivers the SMS verification codes for every account, members and developers alike. Your mobile number is shared with Twilio solely to send those texts.
• Cloudflare (Turnstile) — checks that a request to our free tools comes from a person, not a bot. It sees your IP address and browser details for that check only.
• Microsoft Clarity — if you accept optional cookies, provides the anonymised session-recording and heatmap analytics described above. It does not run unless you consent.

Connecting your Facebook, Instagram or Google Business Profile

This is being set up and isn't available yet. When it is, a member will be able to connect their own business's accounts from their Account page, if they choose to. Nothing is read or posted until they do.

• What we'll ask permission for: to publish the posts you approve to your Facebook Page, Instagram professional account and Google Business Profile; to read their basic details (names, profile information) and how your recent posts did, so Katalis can plan and report on your marketing; and on Google, to read your Business Profile's reviews and post the replies you approve.
• What we'll keep: the access the platform gives us (encrypted), which Page, Instagram account or Business Profile you picked, and the figures we need for your plan and reports. Content we read from Google is kept for no more than 30 days.
• What we won't do: sell it, use it for advertising, use it to train AI models, or share it with anyone except the services that run Katalis for us (listed above). We only post what you've approved.
• Katalis's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Removing it: disconnect an account from your Account page and we delete its access and what we stored from it. You can also remove Katalis in Facebook (Settings → Business integrations) or in your Google Account (Security → third-party connections); we then delete what we hold from that account. Deleting your Katalis account deletes all of it. Or email katalis@meetkatalis.com and we'll delete it within 7 days and tell you when it's done.

People named on public registers

Some of our tools read public registers about businesses: Companies House (including the names of directors and people with significant control, and whether their identity shows as verified), the Environment Agency and other government registers. We show that information to help people check a business, under our legitimate interest and the registers' own open licences. We read directors' details live and do not keep them. Anyone can see how many of a company's directors and PSCs show a verified identity; who they are by name we show only to an account with a verified email and mobile (on our ID check, up to ten companies a day; through our API, to developer accounts, which need the same), and we keep a record of which account looked up which company, so a list of names can't quietly be gathered for scams. We do keep public contract award notices (Contracts Finder and Find a Tender), which name the winning supplier exactly as published; for a sole trader that is their trading name. Where a register mixes businesses and individuals (for example the ICO's register of fee payers), we keep only the businesses.

Named on the register and want us to stop showing you? Email katalis@meetkatalis.com with your name and the company (or “all my companies”) and we will. From then on our ID check and our APIs leave your name out; the company's counts (how many of its people show a verified identity) still include you, because those are about the company. We reply once it's done. You don't need to give a reason. If it's anything else about a register, email us too.

Some providers may process data outside the UK/EEA (for example, in the US). Where that happens, appropriate safeguards such as Standard Contractual Clauses are in place.

How long we keep it

We keep enquiry details for two years from when you got in touch, then delete them. What visitors type to Katalis on the site is kept for 12 months, then deleted (a member's own chat stays with their account and goes when it closes). Error reports from the site are kept for up to 12 months. You can ask us to delete your data at any time.

If you ask us to follow up, or for help, through a free tool, your email is kept alongside your other enquiry details. An ID-deadline watch starts only when you press the button in the first email we send; a request nobody confirms is deleted after 7 days, and a watch is kept until 1 December 2026 or until you stop the updates, whichever comes first. The record of which account looked up which company's named directors and PSCs, and of which account opened which business's full Business Score report, is kept for 12 months, even if the account is closed, so misuse can be traced. If you ask us to stop showing your name, we keep your name and the company for as long as your request stands, because that list is how we leave you out. When you tick a follow-up box we keep a record of the words you agreed to and when, as proof of your consent, for two years, then delete it. Marketing screenshots that members upload are processed in the moment and not stored afterwards. The screenshot of a member's own homepage is kept with their brand kit until they take a new one or close the account. When one of our effects runs on someone's website, we count how many times it's shown each day, as a number only: nothing about the people viewing it is kept. To make sure an effect only runs on its member's own website, we check the address of the page asking for it, and keep nothing. Every picture of a member's piece we hand out (a download, a saved image, a share) carries an invisible mark that names the piece, not a person, so we can recognise our art if it turns up elsewhere. If a member ticks “Let Katalis show this as an example” on a piece, we keep when they ticked it and the words they agreed to, with the piece, until they untick it. The record of the choices a member makes inside their account is kept while the account exists and deleted with it. Short-lived security and rate-limiting records (which can include your IP address) are deleted automatically, usually within a day or two. Developer account details (email and verified mobile number) are kept while the account exists and deleted when it closes; API usage logs are kept for up to 12 months. When an account is deleted we keep only one-way fingerprints (hashes) of its email address and mobile number, which can't be turned back into either, so the same email or number can't claim the free sign-up allowance or a free API key a second time. You can close your developer account at any time from the dashboard settings — closure requests are actioned within 30 days.

Cookies

The public website uses no advertising cookies. Our core analytics are cookieless and never identify you. Essential cookies are used only to keep you signed in: a small one that remembers a member is signed in (so the site opens their account), and one for the private admin area, which visitors never see.

We also offer optional analytics: Microsoft Clarity (anonymised, masked session recordings and heatmaps), which sets non-essential cookies. It loads only after you accept it in the cookie banner. You can decline, and you can change your mind at any time with “Cookie settings” at the foot of every page (or by clearing this site's data in your browser): the banner asks again.

So that Katalis can remember your conversation as you move between pages and if you come back later, we keep a copy of it and a random id in your browser's local storage, and we attach that same id to the conversation records we store (as described above) so we can recognise a returning browser and understand what people keep asking about. That id identifies a browser, not you personally, and you can reset it any time by clearing this site's data. We don't use your IP address to identify you or track you for marketing; we do briefly process it to keep the site secure and to rate-limit our public tools against abuse, and those short-lived security records are deleted automatically (within a day or two).

Your rights

Under UK data protection law you have the right to access, correct, delete, or restrict how we use your data, to object to certain uses, and to ask for a copy of it. To exercise any of these, email katalis@meetkatalis.com and we'll sort it. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We may update this policy from time to time. When we do, we'll change the date at the top of this page.