Privacy Policy

1. Introduction

Katalyze AI, Inc. ("the Company," "we," "us," or "our") operates kataiyzeai.com (the "Site") and provides an AI-assisted quality workflow automation platform for pharmaceutical and biotech manufacturing teams (the "Service"). This Privacy Policy explains what information we collect through the Site and the Service, how we use it, and the choices available to you.

Our customers are pharma and biotech manufacturers whose quality teams use the Service to automate batch record review, deviation investigation routing, and quality check monitoring. When those customers upload manufacturing documentation to the Service, that data belongs to them and is processed under the terms we agree with each customer. This Policy describes how we handle information collected through the Site and, where relevant, the data practices that apply to all customers uniformly.

The Company is based at 245 Main Street, Suite 1400, Boston, MA 02142, United States. Questions about this Policy can be directed to [email protected].

2. Information We Collect

2.1 Information You Provide Through the Site

When you contact us, request a demo, or subscribe to updates through kataiyzeai.com, we collect:

• Contact details such as your name, work email address, and phone number;
• Professional context you choose to share, including your company name, job title, and manufacturing type (for example, oral solid dose, sterile injectables, biologics);
• The content of messages you send us through the contact form or by email.

2.2 Manufacturing Documentation Processed Through the Platform

Customers who subscribe to the Service submit batch records, deviation reports, and quality check documentation for AI-assisted review. We process this content solely to generate the review analysis, exception flags, deviation routing outputs, and quality check monitoring results that the customer has requested. We do not use customer batch records, deviation reports, or any other manufacturing documentation to train or improve AI models, and we do not share that content with third parties for any purpose outside of providing the Service.

Retention of platform data is governed by the customer's subscription agreement and our data handling commitments described in Section 6 below.

2.3 Information Collected Automatically When You Visit the Site

When you visit kataiyzeai.com, we automatically collect limited technical information:

• IP address and approximate location at the city or region level;
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and approximate time on page;
• Cookie identifiers and similar technologies (see Section 5 and our Cookie Policy).

2.4 We Do Not Knowingly Collect Children's Data

The Site and Service are directed exclusively to business users. We do not knowingly collect personal information from individuals under 13 years of age. If you believe a child has submitted information to us, contact [email protected] and we will delete it promptly.

3. How We Use Information

We use the information we collect to:

• Respond to demo requests, contact inquiries, and technical questions from pharma quality teams evaluating the Service;
• Schedule and conduct product demonstrations and onboarding calls;
• Send service updates and, with your consent where required, occasional communications about quality workflow practices and product improvements;
• Operate, maintain, and improve the Site and Service;
• Detect, investigate, and prevent fraudulent or abusive access to our systems;
• Comply with applicable legal and regulatory obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see the relevant section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf under contractual confidentiality obligations, including cloud infrastructure (US East region), transactional email delivery, and site analytics services;
• Legal authorities, when disclosure is required by law, court order, or to protect the rights, safety, or property of the Company, its customers, or the public;
• A successor entity in the event of a merger, acquisition, or sale of all or substantially all of our assets, subject to commitments consistent with this Policy.

We do not sell personal information to third parties. Customer manufacturing documentation submitted through the platform is not shared with any third party except as strictly necessary to deliver the Service under the applicable customer agreement.

5. Cookies and Tracking

We use cookies and similar technologies to operate the Site, maintain session state, and measure usage patterns. For a full description of what we use and how to manage your preferences, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described in this Policy or to satisfy legal and accounting obligations.

• Contact and inquiry records from the Site: retained for up to 24 months after last interaction, then purged from active systems;
• Platform customer manufacturing data (batch records, deviation reports, quality check documentation): retained for the duration of the active subscription plus 30 days after termination to allow the customer to retrieve or export data, after which it is deleted from all systems. Customers may request verified deletion at any time;
• Server access logs: retained for 90 days, then aggregated or deleted.

7. Security

We apply technical and organizational safeguards appropriate for the sensitivity of pharmaceutical manufacturing data, including AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls with configurable permission levels, SSO integration support, and append-only audit logging of all system and user actions. Our infrastructure is hosted in the US East region (AWS us-east-1). The audit trail design follows 21 CFR Part 11 electronic records principles as a design intent; this is not a certification claim.

No system is completely immune to unauthorized access. We cannot guarantee absolute security, but we commit to notifying affected customers promptly in the event of a confirmed data breach affecting their information.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access to your personal information, correction of inaccurate data, deletion, and the ability to limit certain types of processing. To make a request, email [email protected] with a description of what you are requesting and enough detail for us to verify your identity. We will respond within the timeframe required by applicable law.

9. Massachusetts Residents

Massachusetts does not currently have a comprehensive consumer privacy statute. As a matter of policy, the Company extends the following baseline rights to all United States residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you through the Site.
• Right to Delete: request deletion of personal information you have provided to us.
• Right to Correct: request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Marketing: unsubscribe from marketing communications at any time using the unsubscribe link in any message or by emailing [email protected].

9.2 How to Exercise

Email [email protected] with a description of your request and sufficient detail to verify your identity. We will respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws such as HIPAA or GLBA, those laws may provide additional rights with respect to data covered by them.

9.4 California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. The Company does not sell personal information and does not share personal information for cross-context behavioral advertising.

To submit a CCPA/CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date at the top of this page. Where appropriate, we will also provide notice through the Site or by email to affected customers.

11. Contact

Questions, requests, or complaints about this Policy can be directed to: