Privacy Policy & DPA

Privacy Policy & DPA Last Updated: October 2026 This document serves concurrently as the Privacy Policy and the Data Processing Agreement ("DPA") between Catchups Video Ltd. ("Company", "Data Processor", "we", "us") and the business entity utilizing the service ("Client", "Data Controller", "you"). 1. Compliance Framework and Applicability This Agreement is structured to ensure rigorous compliance with: • The Israeli Privacy Protection Law, 5741-1981, and associated regulations; • The European Union General Data Protection Regulation (EU GDPR 2016/679) and UK GDPR; • Applicable United States state privacy frameworks (e.g., CCPA/CPRA). Client accepts and agrees to the terms of this Privacy Policy & DPA by checking the active consent box during onboarding/checkout, installing the Catchups.ai Chrome Extension, integrating the API, or utilizing the platform dashboard. 2. Processing Roles & Legal Mandates 2.1 Division of Responsibilities • Data Processor (Catchups Video Ltd.): Processes personal data, brand assets, and contextual web content exclusively on behalf of, and in strict accordance with the documented instructions of, the Data Controller. • Data Controller (Client): Retains exclusive ownership, control, and responsibility for establishing an appropriate lawful basis (such as explicit consent, legitimate interest, or contractual necessity) for all personal data, URLs, prompts, images, or customer information submitted to or processed by the Service. 2.2 Client Responsibility for URL and Extension-Targeted Data Client explicitly warrants that if any URL, listing input, or webpage targeted via the Catchups.ai Chrome Extension contains Personally Identifiable Information (PII) of third parties (e.g., property agent names, contact info, owner details, portrait photographs, or author profiles): • Client has provided all required statutory notices to those data subjects; and • Client has secured all necessary legal consents or authorizations prior to directing Catchups.ai to fetch, parse, synthesize, or render that data into video Output. 3. Categories of Data & Processing Scope 3.1 Data Categories Processed • Account and Lead Data: Professional contact information (full name, corporate email address, organization name, role, billing addresses, and authentication credentials) used for account administration, license verification, customer support, and system auditing. • Contextual Inputs and Brand Assets: Text scripts, listing copy, property metadata, search parameters, keywords, brand logos, vector assets, and reference photographs submitted through the API or web playground. • Crawled and Parsed Web Content: Text, images, room dimensions, price attributes, and structured metadata programmatically fetched from Client-supplied URLs or Extension-targeted web pages. To the extent crawled content contains personal data, it is processed strictly as Customer Data under this DPA. • Usage and System Telemetry: Anonymized logs, API call volumes, latency records, browser extension trigger events, and error logs required for platform stability, security auditing, and rate-limiting enforcement. 3.2 Payment Data Safeguards (Stripe Integration) All payments and commercial billing transactions are processed through our PCI-DSS Level 1 certified third-party payment processor (Stripe). Catchups Video Ltd. does not store, capture, or have access to raw credit card numbers or sensitive payment instrument credentials. Billing records retained by Catchups are restricted to transaction identifiers, card expiration dates, last four digits, and invoicing metadata. 3.3 End-User Privacy Safeguards Catchups.ai does not track, harvest, profile, or sell personal data belonging to Client’s downstream viewers or audiences (e.g., social media viewers of generated videos). System analytics are collected strictly in aggregate, anonymized formats. 4. Technical and Organizational Security Measures (TOMs) Company maintains industry-grade technical and organizational safeguards to ensure confidentiality, integrity, and availability of processed data: • Encryption Standards: All data in transit across public networks is encrypted utilizing modern TLS 1.3 protocols. All persistent databases, media storage buckets, and cached assets are encrypted at rest utilizing AES-256. • Hosting and Infrastructure Security: Cloud infrastructure is hosted in enterprise-grade data centers operated by Amazon Web Services (AWS) and Google Cloud Platform (GCP), compliant with ISO/IEC 27001, SOC 2 Type II, and PCI-DSS standards. • Logical Tenant Separation: Workspace data, API tokens, and customer assets are logically isolated within multi-tenant database clusters, preventing cross-tenant access. • Security Incident Notification: In the event of a confirmed security incident resulting in unlawful access, loss, or alteration of Controller personal data, Processor shall notify Controller without undue delay, and no later than seventy-two (72) hours following verification. Processor shall provide prompt technical details to assist Controller in meeting its statutory disclosure obligations. 5. Sub-Processors and Cross-Border Transfers 5.1 Authorized Sub-Processors Controller grants general authorization to Processor to engage vetted third-party sub-processors for specialized infrastructure, AI synthesis, and video rendering components: • Cloud Infrastructure: AWS, Google Cloud Platform (compute, data storage, network security); • Upstream AI Pipelines: Specialized enterprise AI synthesis and Text-to-Speech (TTS) infrastructure endpoints (e.g., OpenAI, Google Cloud AI); • Billing Gateway: Stripe (PCI-DSS compliant payment processing). 5.2 Sub-Processor Data Protection Obligations Company enforces written data protection agreements with all sub-processors. These agreements ensure that sub-processors: • Act solely on documented processing instructions; • Implement technical and organizational security measures equivalent to this DPA; and • Access data exclusively via private, secure corporate API endpoints. 5.3 International Transfers Where personal data originating in the European Economic Area (EEA), the UK, or Israel is transferred across international borders, the parties rely on European Commission Standard Contractual Clauses (SCCs), UK International Data Transfer Addendums, or recognized adequacy regulations. 6. Zero AI Training Guarantee & Contextual Isolation 6.1 No General Model Training Processor expressly guarantees that it does NOT utilize proprietary Client inputs, Client Targeted Assets, real-estate/hospitality copy, private text prompts, or crawled URL content to train, retrain, fine-tune, or improve public, general-purpose generative AI models. 6.2 Enterprise Contextual Isolation Client business context, brand assets, and URL content are utilized solely during the runtime execution of Client's specific video generation jobs, remaining completely logically isolated from other customers and third-party models. 7. Data Retention, Retrieval, and Erasure 7.1 Retention Schedule • Telemetry and API Audit Logs: Retained for twelve (12) months solely for fraud detection, rate-limiting audits, and security troubleshooting, after which they are systematically deleted. • Rendered Video Output: Stored securely for the duration of the Client’s active subscription to facilitate downloading and platform playback. • Temporary Scrape Cache: Raw DOM elements and temporary scratch assets fetched from URLs are purged automatically following video compilation. 7.2 Post-Termination Deletion Mandate Upon termination of the commercial subscription or upon written request from the Data Controller, Processor shall permanently delete or irreversibly anonymize all Client-specific data, proprietary assets, and output files within sixty (60) days, preserving only statutory tax, invoice, or audit records required by applicable law. 8. Data Subject Rights & Audit Verification 8.1 Data Subject Assistance Taking into account the nature of the processing, Processor shall provide reasonable technical assistance to Controller to enable Controller to respond to requests from data subjects exercising their statutory rights (e.g., access, rectification, erasure, restriction, or portability). 8.2 Compliance Verification and Audit Rights Processor shall maintain records demonstrating adherence to this DPA. Upon thirty (30) days prior written notice, Enterprise Clients in good standing may request an executive summary of Company’s latest independent security certifications or submit an annual compliance evaluation questionnaire. 9. Contact Information For inquiries regarding data protection, privacy practices, or DPA execution: • Catchups Video Ltd. • Data Protection & Legal Affairs: legal@catchups.ai • Information Security Team: support@catchups.ai