Privacy Policy
Catalyst ("Catalyst", "we", "us") is an ASX announcement intelligence platform operated from Australia. We take privacy seriously and handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and, where applicable, the EU GDPR.
This policy describes the data we collect, why we collect it, who it is shared with, and the rights you have over it.
// 01 · What We Collect
Account information
- Email address (required for sign-in and transactional emails)
- Display name (optional)
- Password — stored as a bcrypt hash. The plain-text password never touches our database or logs.
Payment information
Payment card details are collected and stored by Stripe — Catalyst does not receive or store your card number. We retain only Stripe's opaque customer ID, subscription ID, the price tier you're subscribed to, and the current period end date.
Service data
- The ASX ticker codes you add to your watchlist.
- The plan you're on (Free or Pro) and subscription status (active, canceled, past due, incomplete).
Technical data
- Standard server logs (IP address, user agent, request paths) retained 30 days for security and debugging.
- Privacy-preserving, cookieless page analytics via Vercel Analytics (aggregate page views only — no cross-site tracking, no advertising use).
- We do not use behavioural-tracking cookies, third-party advertising pixels, or session-recording tools.
// 02 · How We Use It
- Authenticate you and maintain your sign-in session.
- Filter ASX announcements to the tickers on your watchlist.
- Generate AI summaries of those announcements via Anthropic.
- Process subscription payments and send billing receipts (via Stripe).
- Send transactional emails such as password resets (via Resend).
- Send price-sensitive announcement alert emails to Pro users who have opted in (via Resend).
- Detect and prevent abuse, fraud, and security incidents.
We do not sell your personal information, and we do not share it with advertisers or data brokers.
// 03 · Third-Party Processors
Catalyst relies on the following providers. Each handles a narrow slice of data under their own privacy commitments:
- Vercel (United States) — application hosting and request routing.
- Neon (Sydney region, AWS ap-southeast-2) — PostgreSQL database with encryption at rest.
- Stripe (United States / Ireland) — payment processing and subscription management.
- Anthropic (United States) — receives only the ticker symbol, headline, category, and (where available) public announcement text in order to produce summaries. No personal information is sent.
- Apify (Czech Republic) — receives only the watchlist ticker symbols and a result-count cap in order to fetch public ASX announcements. No personal information is sent.
- Resend (United States) — transactional and alert email delivery (password resets, account notices, price-sensitive alerts).
// 04 · How It's Stored
- Passwords hashed with bcrypt (cost factor 10) and a unique salt per user.
- All data in transit protected by HTTPS/TLS.
- Database encrypted at rest by Neon.
- Sessions are stateless JWTs signed with a server-side secret; no session data is stored long-term.
- API access for cron jobs requires a bearer token shared only between GitHub Actions and our routes.
// 05 · Data Retention
- Account data (email, password hash, watchlist) is retained until you delete your account.
- Subscription and billing records are retained for seven years for Australian tax compliance.
- Request logs are retained for 30 days, then automatically purged.
- Password reset tokens expire after one hour and are deleted after use; unused tokens are purged with regular database maintenance.
// 06 · Your Rights
Under the Australian Privacy Act (and the GDPR where applicable) you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Request deletion of your account and associated data.
- Export your data in a machine-readable format.
- Withdraw consent for non-essential processing.
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
To exercise any of these rights, email privacy@catalystasx.com. We will respond within 30 days.
// 07 · Children
Catalyst is not directed at people under 18 and we do not knowingly collect data from minors. If you believe a minor has provided us with personal information, contact us and we will delete it.
// 08 · International Transfers
Several of our processors operate outside Australia. Where data is transferred internationally, we rely on contractual safeguards (Standard Contractual Clauses for GDPR-protected data and the Privacy Act's cross-border disclosure principles for Australian data).
// 09 · Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by email to the address on your account and by a notice in the application. The "Last updated" date at the top of this page reflects the most recent revision.