Catch8 Privacy Policy

Catch8 (the "App" or the "Service", on the web, iPhone and Android) is operated by CRE8TOR Group Limited, a company incorporated in Hong Kong ("we", "us", "our").

For your account information, we are the "data user" under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO"), and the "controller" under the EU General Data Protection Regulation and the UK GDPR (together, "GDPR").

Contact for anything in this policy: support@catch8.ai. Requests to access or correct your personal data go to our Privacy Officer at the same address. The Privacy Officer is our data access officer under the PDPO. We have not appointed a data protection officer under the GDPR.

EU and UK representatives (GDPR Art. 27): Catch8 is aimed at businesses in Hong Kong and is not marketed to people in the European Union or the United Kingdom, so we have not appointed an EU or UK representative. You can still use your rights in §11 by writing to support@catch8.ai.

This policy is also our Personal Information Collection Statement under the PDPO.

• Bank Statement Import source files: file contents and text are processed temporarily in device and server memory for reading, review and retry. This feature does not save the original file, original filename or extracted source text in our database or file storage. On iPhone and Android, the file picker creates an app-cache copy; Catch8 attempts to delete that copy after reading it, without deleting your original. A crash or failed deletion may leave the cache copy until the operating system clears it. Clearing memory and cache is not a guarantee of immediate or forensic erasure.

• Bank Statement Import records: the transactions you choose to post remain in your books, including the reviewed date, description, amount, account and source row or page reference. Minimal duplicate-prevention and request-result records also remain for the lifetime of your company in Catch8. Those records contain digests, identifiers, outcomes and counts, rather than source files, source text, filenames, dates or descriptions. Temporary source processing does not delete posted transactions or these records.

• You give us your email address, your business's name and currency, receipt photos, and the bookkeeping records you enter.

• We use them only to run Catch8 for you. We do not sell your data, we do not use it for advertising, and we do not track you across other apps or websites.

• Receipt images are read by Google's Gemini AI, and we do not use them to train AI models.

• You can export your receipts, and delete your account and your books, inside the App at any time.

• AI template import needs separate permission from receipt reading. It sends uploaded quotation or invoice images, or a PDF's first-page image, to Google Gemini to create an editable template. See §3, §5 and §8.

a) Information you give us

Data: Email address; When: When you sign up or sign in with an emailed code; Required?: Yes. It is how you log in

Data: Google account details: your email address, and the name, profile-picture link and Google account ID that Google sends; When: Only if you choose "Continue with Google" (web and Android); Required?: No. Use the email code instead

Data: Business name and default currency; When: During onboarding; Required?: Yes

Data: The language you choose during onboarding; When: During onboarding. It is used once, to name your starting categories, and is not stored as a setting on our servers; Required?: Yes

Data: Receipt and statement images (photos or screenshots); When: When you add a receipt; Required?: Only to use AI reading

Data: Your bookkeeping records: accounts and opening balances, transactions (date, description, counterparty, amount, client, category, notes), invoices (number, client, dates, amount, status), bills and subscriptions, budgets, categories and categorisation rules, and receipt details; When: When you enter, import or confirm them; Required?: Only to use those features

Data: Quotation or invoice files you select for AI template import, including customer names and addresses, line items, bank details and other content present in the file; uploaded images may also contain location or camera metadata; When: When you upload a file for AI template import; Required?: Only for that optional feature. You can use a built-in design instead.

Data: Bank-statement CSV files or PDFs with selectable text that you choose for Bank Statement Import, including account details, transaction dates, descriptions, amounts and other content in the file; When: When you upload a file for this feature; Required?: Only for this optional feature. You can enter transactions by hand instead.

b) Information created when you use the App

• AI reading results: the merchant, date, currency, amounts and suggested category read from an image, a confidence score, the AI model name, and the raw result.

• Usage counters: how many records each of your companies has used, and your plan (Free or Pro), its status, which store it was bought through, and its expiry date.

• Sign-up source: if you reach the App through a campaign link (for example from our website), we note the tags in that link (source, medium, campaign, content and term), the language named in the link, and how you signed in (emailed code or Google). The App keeps these tags in your browser's local storage for up to 30 days and sends them to us when you sign in, and they are linked to your account. If you arrive without such a link, we record only how you signed in. We also record the date and time of four steps: your first sign-in, your first saved receipt, completing your company details, and a completed subscription purchase (with the plan and billing period). This record does not include the page you came from, your IP address or your device details, and we do not give it to any advertising platform or other third party.

• Technical and security data: your account's internal ID, sign-in times, and the IP address and device or browser information that our hosting and authentication providers record in their logs when your device connects.

• AI template-import results: the suggested layout and text, and the templates you save from them, with the uploaded image or a PDF's first-page image as a guide.

• AI permissions: separate receipt-reading and document-import notice versions, acceptance dates and withdrawal records, stored with your login.

• Bank Statement Import results: text and rows read from your file for review, your corrections and selected transactions, and minimal records to prevent duplicate transactions and safely resolve repeat requests, including content digests, row and transaction IDs, outcomes and counts. Posted transactions also retain a source row or page reference.

c) Information from app stores and payment providers

If you subscribe, Apple (App Store) or Google (Google Play), or Stripe for a purchase made on the web, tells us whether your subscription is active, which plan it is, and when it renews or expires. We do not receive your card number or bank details from these payment providers. Documents you upload may themselves contain bank details.

d) What we do not collect

We do not request access to your device's location, contacts, microphone or health data, or collect advertising identifiers. Files you choose to upload may contain location or camera metadata; AI template import does not guarantee its removal. The App (app.catch8.ai and the iPhone and Android apps) has no third-party analytics or advertising tools; the first-party sign-up source record in §3(b) stays with us. It has no crash-reporting service and no push notifications. Camera and photo-library access is used to capture or choose receipt or document images. Only files you select are uploaded.

Purpose: Creating your account, signing you in, keeping you signed in; Data used: Email, Google account details, account ID, security data; GDPR legal basis: Performance of our contract with you (Art. 6(1)(b))

Purpose: Keeping your books and showing them on all your devices; Data used: Business details, bookkeeping records, images; GDPR legal basis: Contract (Art. 6(1)(b))

For Bank Statement Import, Catch8 receives your selected CSV or selectable-text PDF on our server, reads it without AI, returns rows for you to check and correct, and records only the transactions you choose to post. This feature does not send the file or its text to Google Gemini. If you instead add a statement photo or screenshot through receipt reading, that separate AI feature uses receipt-reading permission. AI template-import permission remains separate and covers quotations and invoices only.

Purpose: Reading receipts with AI; Data used: Images, your category names, your default currency; GDPR legal basis: Contract (Art. 6(1)(b))

Purpose: Counting the records your companies use and applying your plan's allowance; Data used: Usage counters, plan status; GDPR legal basis: Contract (Art. 6(1)(b))

Purpose: Selling and managing subscriptions; Data used: Plan status and store records; GDPR legal basis: Contract (Art. 6(1)(b)); legal obligation for accounting and tax records (Art. 6(1)(c))

Purpose: Measuring which channel brought each sign-up and how far new accounts get, so we can tell which of our marketing works; Data used: Sign-up source tags, sign-in method, language, step dates, plan and billing period; GDPR legal basis: Our legitimate interests in understanding and improving our marketing (Art. 6(1)(f))

Purpose: Keeping the Service secure, and preventing abuse such as multiple accounts to get extra free records; Data used: Account ID, email, security and log data; GDPR legal basis: Our legitimate interests in a secure, fair service (Art. 6(1)(f))

Purpose: Answering your requests and support emails; Data used: Your email and what you send us; GDPR legal basis: Contract, or our legitimate interests

Purpose: Meeting legal duties and defending legal claims; Data used: What the duty or claim needs; GDPR legal basis: Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

Purpose: Creating an editable quotation or invoice template from your selected document with AI; Data used: The uploaded image, or a PNG image of a PDF's first page, including the content described in §3; GDPR legal basis: Contract (Art. 6(1)(b)) for creating the template you ask for, and your consent (Art. 6(1)(a)) for sending the document to Google. We ask for that consent separately, before this transfer, and you can withdraw it at any time (§8).

We do not use your data for automated decisions that have legal or similarly significant effects on you. AI suggests receipt details or document layout and text; you should check and correct the result before using it.

We will not use your personal data for direct marketing. If that ever changes, we will ask for your consent first, as the PDPO requires.

We share personal data only with the service providers who run Catch8 for us. Each processes it on our instructions, under a contract that requires protection at least equal to this policy:

Provider: Supabase, Inc.; What it does: Database, file storage for images, sign-in; Location: Singapore (AWS ap-southeast-1)

Provider: Railway Corporation; What it does: Hosts the web app and our server functions; Location: Singapore

Provider: Google LLC (Gemini API); What it does: Reads receipt images and, with separate document-import permission, reads quotation or invoice images to create editable templates. Google handles them under the Gemini API terms that apply to our account, and keeps them for the period those terms set; Location: United States and other Google locations

Provider: Google LLC (Google sign-in); What it does: Signs you in if you choose Google; Location: United States

Provider: Resend, Inc.; What it does: Sends your sign-in code emails, team invitations, and the quotations and invoices you send from Catch8; Location: United States and Japan (sending region)

Clients and sending. If you keep a client book, Catch8 stores the client contact details you enter (name, contact person, email, phone, address, tax number, notes) to fill your documents and to send them for you. When you email a quote or invoice from Catch8, the message and the PDF go through our email provider, Resend, to the addresses you type. When you send by WhatsApp, you send the message yourself from your own WhatsApp; Catch8 only creates a link to a copy of the PDF, which anyone with the link can open until it expires (30 days) or you turn it off. We keep a copy of each sent PDF so the link shows exactly what was sent. We never email your clients except when you send a document.

Provider: Apple Inc. / Google LLC; What it does: Sell and bill subscriptions bought in their stores; Location: Their own locations, under their own privacy policies

Provider: Stripe, Inc. and its group companies; What it does: Process card payments for plans bought on the web; Location: United States and others

Apple and Google, when they sell you a subscription, act as independent controllers under their own privacy policies.

We may also disclose personal data (a) when the law, a court or a regulator requires it, (b) to protect the rights, safety or property of our users, us or others, or (c) to a buyer or successor if our business or the App is sold or reorganised, under terms that keep this policy's protections.

We do not sell personal information and we do not "share" it for cross-context behavioural advertising.

Document import and your permission. Before your first AI template import, we ask separately whether Google Gemini may read your selected quotation or invoice to create an editable template. Catch8 receives the uploaded file. Our server sends the uploaded image bytes to Gemini, including any metadata they contain; for a PDF, it sends a PNG image of the first page, not the PDF itself. Content can include customer names and addresses, line items and bank details. This document permission does not give or replace receipt-reading permission. Google's processing is described in the Gemini provider row above and §6. Your controls are in §8.

• Your account and books: for as long as your account exists. When you delete your account, they are deleted straight away (see §8).

• Backups: deleted data can remain in our database provider's encrypted backups for up to 30 days, and then is overwritten. Backups are never used to restore an account you deleted.

• Server and sign-in logs: kept for up to 30 days for security, then deleted.

• Gemini: Google keeps requests and responses for the period set by its Gemini API terms.

• Subscription and payment records: Apple, Google and Stripe keep their own records under their own retention rules and legal duties. We cannot delete those.

• Support emails: kept for as long as needed to deal with your request, and then for up to 12 months after your request is closed.

• Sign-up source record: kept for up to 24 months from when it is recorded, or until your account is deleted, whichever comes first (see §8).

We are in Hong Kong, and our providers store and process data in other places, including Singapore and the United States. When your data leaves your country or Hong Kong, we protect it as follows:

• PDPO: we transfer only to providers bound by contract to protect it to a standard comparable to the PDPO, following the Privacy Commissioner's guidance on cross-border data transfer.

• GDPR / UK GDPR: where the destination has no adequacy decision (Hong Kong has none), we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum in our providers' data processing terms. For US providers certified under the EU-US Data Privacy Framework and its UK Extension, we may rely on that certification. You can ask us for a copy of the relevant safeguards at support@catch8.ai.

• Export: the Reports tab exports your receipts as a CSV file (date, merchant, category, currency, subtotal, tax, total, status, notes). In Settings, "Export all data" downloads everything we hold for a company of yours as one JSON file, with receipt images as links that work for 24 hours. If you cannot sign in, email support@catch8.ai and we will send your data in a common machine-readable format.

• Delete your account: Settings → Review account deletion, on iPhone, Android or the web at https://app.catch8.ai (sign in, then Settings). You type your business name to confirm. We then permanently delete, in this order: all your receipt images; your business and everything in it (accounts, transactions, receipts, invoices, bills, budgets, categories, rules, usage and plan records); and your login. This cannot be undone. If you cannot sign in, email support@catch8.ai from your account's email address and we will delete it for you.

• Deleting your account does not cancel a store subscription. Cancel it in your App Store or Google Play subscription settings, or in the web billing portal for a plan bought on the web, first. What deletion does not remove is listed in §6.

• Camera and photos: you can turn off access at any time in your phone's settings.

• AI template import: in Settings → AI template import, you can withdraw document-import permission. Once the withdrawal is saved, subsequent document-read requests will not send documents to Google unless you allow it again. It does not undo transfers already made, delete existing uploads or templates, or change receipt-reading permission. You can still use built-in designs and edit them by hand. Receipt-reading permission is controlled separately under Settings → Receipt reading.

Your records may contain other people's personal data, such as a client's name on an invoice or a counterparty on a bank line. For that data, you decide what is recorded and why. Under GDPR you are the controller, and under the PDPO the data user. We process it only to provide the Service to you, on your instructions as set out in our Terms, with the security and confidentiality described here. We will not use it for any other purpose, and we delete it when you delete your account. You are responsible for having a lawful basis to record it. If you need a data processing agreement, contact support@catch8.ai.

Data travels encrypted (HTTPS). Each business's data is separated at the database level: database rules let a signed-in person read only the records of their own business, and receipt images sit in private storage that only that business can open. Your sign-in session is kept in your phone's secure storage. Only a few narrow server functions use administrator access, to count AI reads, delete accounts and record subscriptions. No system is perfectly secure. If a breach affects your data, we will tell you and the relevant regulators where the law requires.

Everyone (Hong Kong PDPO). You may ask for access to, and correction of, your personal data (a data access request or data correction request). We may charge a fee that is not excessive for an access request, and we will respond within 40 days. Send requests to the Privacy Officer at support@catch8.ai. You can also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

Our practice follows the six Data Protection Principles of the PDPO: we collect only what the Service needs, for the purposes stated (DPP1); we keep it accurate and no longer than necessary (DPP2); we use it only for those purposes unless you agree otherwise (DPP3); we protect it (DPP4); we publish this policy (DPP5); and we give you access and correction (DPP6).

EU / UK users (GDPR). You also have the right to: erasure; restriction of processing; data portability; object to processing based on legitimate interests; and withdraw consent where we rely on it. You can complain to your local data protection authority (for example, in the UK, the Information Commissioner's Office). We will answer within one month, extendable where the law allows.

California users. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. In the last 12 months we collected these categories: identifiers (email, account ID, IP address); customer records and commercial information (subscription and purchase status); financial and business records you enter; images (receipt photos); and internet activity limited to security logs. The sources, purposes and recipients are in §3 to §5. You may ask to know, delete or correct your personal information, and we will not treat you differently for doing so. You may use an authorised agent, and we will verify requests by email.

To exercise any right, email support@catch8.ai from your account's email address.

Catch8 is for adults running a business or freelance work. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18, we will delete it.

If we change this policy in a way that matters, we will tell you in the App or by email before the change takes effect. The date at the top shows the current version.

This policy is published in English, Traditional Chinese and Simplified Chinese. If the versions differ, the English version prevails, unless the law where you live requires otherwise.

CRE8TOR Group Limited · support@catch8.ai