Privacy policy

Controller

Dominic Marx, Ulmergasse 16, 89073 Ulm, Germany, email: hey@marx-media.net. This policy covers the website catd.io and the application catd at my.catd.io and api.catd.io.

Website and server

When you open a page, the server processes technical data such as your IP address, the time, the requested address and the browser identifier, to deliver the page and to protect it from abuse. The legal basis is Art. 6(1)(f) GDPR.

The website sets one cookie for the chosen language. It uses no analytics or advertising cookies. Fonts are served from our server.

Account and application

For an account, we process your name, email address, password as a hash, profile photo, sessions, organizations, workspaces, and your chats, pipelines, jobs, files, approvals and a log of actions. The application sets the cookies that sign-in needs. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the log.

We keep this data as long as the account exists and legal retention duties require it. You can export your data in the settings.

Connected services

You decide which services you connect to catd. catd stores the keys and tokens of these services encrypted and calls the services only for your organization. Actions that move money, delete data or go to customers wait for your approval.

Agents run on a worker that you operate yourself, for example on your computer. The worker uses the model provider that you set up there. Content that an agent reads for a step goes to this provider. The terms you agreed with that provider govern its processing.

Google user data

When you connect a Google account, catd receives through OAuth only the permissions you grant. The integration "Google" accesses Gmail, Google Calendar and Google Contacts. The integration "Google Ads" uses the scope https://www.googleapis.com/auth/adwords and accesses accounts, campaigns, budgets, ads, keywords, assets and performance data of the Google Ads accounts that your Google account reaches.

Use: catd uses this data only to carry out tasks that you or your organization start in catd, for example creating a report or setting up a campaign. Every change to Google Ads waits for your approval.

Storage: catd stores the OAuth tokens encrypted. catd stores content from Google only where a result is recorded in a chat or job of your organization. When you remove the integration, catd deletes the tokens.

Sharing: catd shares Google user data only with the model provider you set up on your worker and with the processors named below, as far as your task requires it. catd doesn't sell this data, and doesn't use it for advertising or to train AI models. People read it only with your consent, for security incidents, or when the law requires it.

catd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can revoke access at any time: in catd by removing the integration, and in your Google account at https://myaccount.google.com/permissions.

Recipients

We use processors: Hetzner Online GmbH, Germany, for hosting, Cloudflare, Inc. for domain management, and an email provider for sending system emails. Where data goes to a country outside the EU, this happens on the basis of appropriate safeguards under Art. 44 ff. GDPR.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection under Art. 15 to 21 GDPR. You can withdraw consent at any time. Write to hey@marx-media.net for this. You can also complain to the data protection authority of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).