Privacy Policy

Catapultor, operated by JBW Investments, Inc.

Last updated: 18 August 2026

1. What Catapultor is, in privacy terms

Catapultor turns an article you have published into a set of social media assets

that you download and post yourself.

Two things follow, and they shape everything below:

• Catapultor never publishes anything on your behalf. It holds no permission

to post, comment, message, or advertise from any account. There is no code path

that writes to a social platform.

• Every social connection is read-only. We ask for permission to read how

content performed. We do not ask for permission to act.

2. Information we collect

2.1 Information you give us

2.2 Information from connected accounts — read-only

If you connect a Meta account (Instagram, Facebook Page, Threads), we read:

• Your account or Page identity — name, ID, profile picture
• A list of Pages and linked Instagram accounts you administer
• Content you have already published, and its engagement metrics

We request these permissions and no others: instagram_basic,

instagram_manage_insights, pages_show_list, pages_read_engagement,

threads_basic, public_profile.

We never request any publishing permission. Not pages_manage_posts, not

instagram_content_publish, not threads_content_publish. If a future version

of Catapultor ever needed one, it would require your explicit, separate consent,

and this policy would be updated first.

If you later connect Google Analytics or Search Console, we read traffic and

search performance for the properties you select. Read-only, and only those

properties. Catapultor requests no access to Gmail, Drive, Contacts, or any other

Google service.

2.3 Information generated by using the product

We keep an append-only record of activity in your account — generations,

downloads, edits, connections. This is how the dashboard shows your history and

how we debug problems. It is tied to your account and is not sold or shared.

2.4 What we do not collect

• We do not collect payment card details. If you subscribe, payment is handled by

our payment processor and card numbers never reach our servers.

• We do not buy personal data from third parties.
• We do not track you across other websites, and we run no advertising pixels on

the product.

3. How we use information

Only for these purposes:

1. Producing your assets and making them sound and look like your brand.

2. Showing you how content you posted performed.

3. Sending communications you have asked for — a post is due, a number moved.

We send when there is a reason, never on a fixed daily schedule.

4. Operating, securing and debugging the service.

5. Meeting legal obligations.

We do not sell personal information. We do not use your content or your

connected-account data to train machine learning models.

4. AI processing

Generating assets involves sending your article's text and your brand record to a

third-party AI model provider. That provider processes the text to produce your

posts. We do not permit that content to be used to train their models.

Your connected-account metrics are not sent to any AI provider.

5. Who we share with

Only service providers who make the product work, each limited to what their job

requires: our hosting and database providers, our AI model provider, our email

and SMS providers, and our payment processor.

We also disclose information if required by law, or to protect rights and safety.

If the business is sold, account data may transfer as part of that transaction.

You would be told before any transfer, and your export and deletion rights

(§7) survive it.

6. Retention

We keep your account data while your account is open. If you close it, we delete

your personal data within 30 days, except where law requires us to keep records

(for example, invoices).

Because Catapultor is a self-serve product with a written sunset clause, if we

ever discontinue it you get 30 days' notice and a full export before shutdown.

7. Your rights

Wherever you live, you can:

• Export everything we hold about you, in a machine-readable format
• Delete your account and personal data — see DATA_DELETION.md
• Correct anything inaccurate
• Disconnect any social or analytics account at any time, which immediately

ends our access

• Withdraw consent for SMS or email at any time

Depending on where you live you may also have rights to object to or restrict

processing, and to complain to your data protection authority.

Exercise any of these by emailing privacy@catapultor.com. We respond within

30 days, and we do not charge for it.

Revoking Catapultor's access from Meta's or Google's own settings also works

immediately, and does not require contacting us.

8. Security

Data is encrypted in transit and at rest. Access tokens are stored encrypted.

Every record in our database carries an owner and is isolated at the database

level, so one customer's data cannot be read by another. Access to production

systems is limited to those who need it.

No system is perfectly secure. If a breach affects your personal data, we will

notify you and the relevant authority as the law requires.

9. Children

Catapultor is for publishers and businesses and is not directed at children. We

do not knowingly collect data from anyone under 16. If we learn we have, we

delete it.

10. International transfers

We are based in the United States and process data there. If you are in the UK,

EEA or Switzerland, we rely on Standard Contractual Clauses or another lawful

transfer mechanism.

11. Changes

If we change this policy materially, we will email you before it takes effect.

The "last updated" date above always reflects the current version.

12. Contact

JBW Investments, Inc.

Privacy enquiries: privacy@catapultor.com