Privacy Policy

1. Introduction

Catupult Pte Ltd, a Singapore company with its registered address at 20A, Teck Lim Road, Singapore 088391, referred to in this Privacy Policy as “Catupult,” “we,” “us” or “our,” operates catupult.ai and provides AI-native operating software for global freight and trade, including Catupult Forward.

Catupult Forward is an AI-native international forwarding workspace for freight forwarders, NVOCCs and logistics teams. It helps customers manage workflows including customers, enquiries, rates, schedules, quotations, orders, bookings, jobs, documents, milestones, Track & Trace, vendor costs, invoicing and profitability.

This Privacy Policy explains how we collect, use, disclose and safeguard personal information, and the rights available to individuals under applicable data protection laws.

This Privacy Policy applies globally. Where a specific jurisdiction grants additional rights, those rights apply as required by applicable law.

2. Our roles: controller and processor

2.1 Where Catupult acts as controller

We act as a controller when we determine why and how personal information is processed.

This includes personal information processed when you visit catupult.ai, create or administer a Catupult account, communicate with us, request a demo, use our website forms, receive our marketing or business communications, or interact with us as a customer, prospect, supplier, partner or business contact.

This Privacy Policy governs that processing.

2.2 Where Catupult acts as processor

When our customers use Catupult Forward to manage their own business, they may upload, create or process shipment records, customer and vendor details, KYC or identity documents, rate cards, quotes, bookings, messages, documents and related operational data.

For that data, Catupult generally acts as processor on behalf of the customer. The customer is generally the controller and is responsible for the lawful collection and use of that data.

Where the customer is itself a processor acting on behalf of a third-party controller, Catupult acts as sub-processor.

Our handling of that customer-controlled data is governed by the applicable customer agreement and Data Processing Addendum, not this Privacy Policy, except where this Privacy Policy is expressly incorporated or referenced.

If your personal information was provided to Catupult by one of our customers, including your employer or a freight, shipping, logistics, vendor, agent or customer organisation using Catupult Forward, please direct privacy requests to that customer in the first instance. We will assist the customer as required by applicable law and our Data Processing Addendum.

3. Information we collect as controller

3.1 Information you provide

Account and contact information, such as name, business email, company name, role and business contact details.

Authentication information, such as login credentials and account security settings.

Billing and usage information, such as billing contact details, subscription or package details, payment status and usage records. Payments may be processed through payment providers, and we do not store full card numbers unless expressly stated by the payment provider.

Communications, such as support requests, demo enquiries, feedback, sales communications, messages and other content you send to us.

Marketing and event information, such as communication preferences, responses to campaigns and participation in product demos or webinars.

3.2 Information collected automatically

Technical information necessary to operate, secure and improve the website and Service, such as IP address, timestamps, browser type, device type, operating system, pages visited, referring source, server logs and security logs.

Usage information about how users interact with our website, product and communications, including feature usage, account activity, support activity and product telemetry.

Analytics information, where analytics are enabled and lawful, to help us understand website and product usage.

3.3 Information from third parties

Business contact, enrichment or prospecting information from business data providers, where permitted by law.

Information from integration partners, applications, carriers, vendors, agents, visibility providers, communication tools, payment providers or other services you or your organisation choose to connect with Catupult.

Information from public or professional sources, such as company websites, business directories and professional networks.

3.4 Sensitive personal information

We do not seek to collect sensitive or special-category personal information through the public website.

Customers should not input sensitive personal information into Catupult Forward unless it is needed for a lawful freight, trade, KYC, identity, compliance or operational workflow and the customer has the legal right to process and provide that information.

4. How we use information as controller

We use personal information to provide, operate, secure and support our website and services; create, administer and manage accounts; process billing, package usage, payments and related administration; respond to enquiries, support requests and demo requests; communicate with customers, users, prospects, suppliers and partners; send service notices, product updates and administrative messages; conduct marketing and outreach where permitted by law; measure the effectiveness of communications and campaigns; improve and develop our website, products, workflows, features and user experience; detect, prevent and respond to fraud, abuse, misuse, security incidents and technical issues; protect our rights, users, customers, systems and services; comply with legal obligations; and enforce our agreements.

5. Customer data, AI features and aggregated data

Catupult Forward includes AI-enabled features, including assistant, document, workflow, quotation, communication, extraction, validation, orchestration and intelligence features.

These features may process customer-provided data to deliver product functionality to that customer.

5.1 Customer Personal Data

Where Catupult processes Customer Personal Data on behalf of a customer, we process that data only to provide and support the Service and as instructed by the customer, except as otherwise permitted under the applicable customer agreement and Data Processing Addendum.

We do not sell Customer Personal Data.

We do not use one customer’s identifiable Customer Personal Data for another customer.

5.2 AI features

AI features may process Customer Personal Data to deliver those features to that customer.

These features may run on foundation models provided by third-party model-hosting or AI service providers operating within Catupult’s cloud infrastructure or under Catupult’s service environment.

The inputs and outputs transmitted to those model services to generate a result are not used to train the underlying foundation models. Where supported by the relevant provider and configuration, Catupult does not enable AI model invocation logging that would retain those inputs or outputs.

Catupult does not use Customer Personal Data to train AI models except on an aggregated and de-identified basis, as described below, and only where permitted by applicable law and the applicable customer agreement.

5.3 Aggregated and de-identified data

We may create and use aggregated and de-identified data derived from processing.

This may include statistical, benchmarking, usage, performance, operational and model-improvement information that does not identify, and cannot reasonably be re-identified to, any individual, data subject or individual customer.

We may use aggregated and de-identified data to operate, secure, benchmark, analyse and improve our services.

We do not disclose any individual customer’s identifiable or competitively sensitive data, including rates, quotes, margins, win/loss records, shipment data or customer/vendor details, to any other customer.

We maintain de-identified information in de-identified form and do not attempt to re-identify it except where required by law.

5.4 Assistant memory and session context

Within an active assistant session, Catupult Forward may retain short-lived conversational context to provide the requested functionality.

Where a customer enables cross-session assistant memory, the Service may retain a summary of key facts to personalise future interactions.

That memory is Customer Content, is stored in encrypted form, is scoped to the relevant customer organisation, is not shared across customers and is not used to train AI models.

Customer administrators may be able to view, manage or delete assistant memory through the Service, where enabled.

5.5 Usage data

Catupult may collect technical logs, telemetry and usage data about how customers and users interact with the Service.

Usage data excludes Customer Content. Catupult may use usage data to operate, secure, support, analyse and improve the Service, and may disclose it to third parties only in aggregated or de-identified form that does not identify a customer, user or data subject.

6. How we share information

6.1 Service providers and sub-processors

We may share personal information with service providers and sub-processors that act on our instructions and help us provide, operate, secure, support, bill, analyse or improve our services.

These may include providers of cloud hosting and infrastructure, AI model inference or AI processing, payments and billing, email, WhatsApp or communication services, customer support, product analytics, monitoring and security operations, website analytics and professional services.

Where a provider acts as a sub-processor for Customer Personal Data, it is handled under the applicable Data Processing Addendum.

6.2 AI model providers

AI features may be powered by third-party foundation model or AI service providers.

Where those providers process Customer Personal Data, they are used to deliver the AI-enabled features to that customer and are subject to applicable contractual, technical and data protection controls.

6.3 Integration partners

If you or your organisation choose to connect Catupult with third-party integrations, we may share information with those integration partners as needed to operate the integration.

These may include accounting systems, tracking providers, screening providers, carriers, airlines, co-loaders, transporters, agents, communication providers and other operating partners.

6.4 Legal and safety recipients

We may disclose personal information where required by law, regulation, legal process, court order, government request or other lawful authority.

We may also disclose information where reasonably necessary to protect rights, safety, security, property, users, customers, Catupult, our systems or the public.

Where a lawful request relates to Customer Personal Data, Catupult will handle that request in accordance with the applicable Data Processing Addendum and applicable law.

6.5 Business transfers

We may disclose personal information in connection with a merger, acquisition, financing, restructuring, sale of assets, investment transaction or similar business transaction, subject to appropriate confidentiality and data protection safeguards.

6.6 No sale of personal information

We do not sell personal information for money.

Where US state privacy laws define “sale” or “sharing” more broadly, see the United States section below.

7. Data location and international transfers

Catupult is based in Singapore.

Customer data is currently hosted and processed on enterprise-grade cloud infrastructure in Singapore unless otherwise agreed or updated in applicable customer terms.

AI inference and processing may also take place within Catupult’s Singapore-hosted cloud infrastructure or otherwise as described in applicable customer documentation.

If you are located outside Singapore, your personal information may be transferred to and processed in Singapore.

Some processing may also occur in, or be accessed from, other countries. This may include support, security, administration, analytics, communications, professional services or sub-processor activity.

Where we transfer personal information across borders, we rely on appropriate safeguards where required by applicable law. These may include contractual protections, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms recognised under applicable law.

For Customer Personal Data subject to EU or UK transfer restrictions, the applicable customer agreement and Data Processing Addendum govern the relevant transfer mechanism.

8. Cookies and tracking

Our website may use cookies and similar technologies.

8.1 Strictly necessary cookies

Strictly necessary cookies are required to operate the website and Service. They may be used to keep users signed in, maintain security, prevent abuse, remember essential preferences and provide core website or product functionality.

These cookies are always active and do not require consent where permitted by law.

8.2 Analytics cookies

Analytics cookies may be used to help us understand how visitors use our website and improve our content, performance and user experience.

Where required by law, analytics cookies are set only after consent.

8.3 Advertising and cross-site tracking

We do not use advertising or cross-site tracking cookies unless this Privacy Policy is updated and any required consent is obtained.

8.4 Managing cookie choices

Where a cookie settings interface or banner is available, users can manage or withdraw cookie choices through that interface.

Users may also be able to manage cookies through their browser settings.

9. Your rights

Depending on your jurisdiction and subject to applicable limits, you may have rights to access your personal information, correct inaccurate personal information, delete personal information, restrict certain processing, object to certain processing, withdraw consent where processing is based on consent, request data portability, opt out of certain processing where applicable, and lodge a complaint with a data protection regulator.

To exercise privacy rights, contact us at communications@catupult.ai.

We may need to verify your identity before responding to a request.

Where your personal information is processed by Catupult on behalf of a customer, we may direct your request to that customer or assist the customer in responding.

We will not discriminate against you for exercising privacy rights.

10. Jurisdiction-specific information

10.1 Singapore — PDPA

Catupult is established in Singapore and handles personal data in accordance with Singapore’s Personal Data Protection Act.

We collect, use and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances and that we have notified to you, and, where required, with your consent.

You may request access to, and correction of, personal data we hold about you.

Where Catupult processes Customer Personal Data on behalf of a customer, Catupult acts as a data intermediary and protects personal data in its possession or control using reasonable security arrangements.

Privacy and data protection requests may be sent to communications@catupult.ai.

10.2 EU / UK — GDPR and UK GDPR

Where the EU GDPR or UK GDPR applies, you may have the rights described in Section 9.

You may also have the right to complain to your local supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office.

Where GDPR or UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract, legitimate interests, consent and legal obligation.

Performance of a contract applies where processing is necessary to provide the Service, administer an account, process billing or deliver requested functionality.

Legitimate interests apply where processing is necessary for service security, fraud prevention, product improvement, customer support, business administration or permitted business communications, provided those interests are not overridden by your rights and interests.

Consent applies where required for marketing, analytics, cookies, certain optional features or other consent-based processing.

Legal obligation applies where processing is necessary to comply with law, regulation, legal process or regulatory obligations.

Where we rely on consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal.

Where Catupult is required to appoint an EU or UK representative, representative details will be made available through Catupult’s legal page, customer documentation or on request.

10.3 India — DPDP Act

Where India’s Digital Personal Data Protection Act applies, you may have rights to access information about processing, correct or update personal data, request erasure, have grievances addressed and nominate another person to exercise rights in the event of death or incapacity.

Privacy and grievance requests may be sent to communications@catupult.ai.

Where Catupult processes Customer Personal Data on behalf of a customer, Catupult acts as a processor under customer instructions and will assist the customer as required by applicable law and the applicable Data Processing Addendum.

10.4 United States — CCPA / CPRA and other state laws

California and other US state residents may have rights to know, access, correct and delete personal information, and to opt out of certain sale, sharing, targeted advertising or profiling activities.

We do not sell personal information for money.

We do not use Customer Personal Data for cross-context behavioural advertising.

To the extent any website analytics activity constitutes “sharing” under applicable US state laws, users may opt out by declining or withdrawing analytics consent through the cookie interface where available, or by contacting communications@catupult.ai.

Where Catupult processes Customer Personal Data on behalf of a customer, Catupult acts as a service provider or processor and not as a third party. Catupult will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship, or combine it with data from other sources except as permitted for a service provider or processor under applicable law and the applicable customer agreement.

11. Data retention

We retain personal information only as long as necessary for the purposes described in this Privacy Policy, to comply with legal obligations, resolve disputes, enforce agreements, maintain business records and operate the Service.

Retention periods vary depending on the type of data, context, legal requirements, customer agreement and operational need.

For Customer Personal Data processed under a customer agreement, deletion or return is governed by the applicable Data Processing Addendum. Unless otherwise agreed, Catupult will return and/or delete identifiable Customer Content and associated Personal Data after termination or expiry in accordance with the applicable customer agreement, subject to legal retention requirements and permitted retention of aggregated or de-identified data.

12. Security

We maintain technical and organisational measures designed to protect personal information.

These may include encryption in transit and at rest, network isolation, production data stores within a virtual private cloud, access controls based on least privilege, authentication controls, logging and monitoring of system activity, backup and recovery procedures, confidentiality obligations for personnel, security awareness and internal controls, secure software development and change-management practices, and security incident response procedures.

No system, network or service can be guaranteed to be completely secure.

If a personal data breach occurs, we will notify affected parties and regulators where required by applicable law.

Where a breach affects Customer Personal Data, we will notify and cooperate with the relevant customer in accordance with the applicable Data Processing Addendum and applicable law.

13. Children

Catupult is a business software provider.

Our website and services are intended for business users and are not directed to children.

We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child where not permitted, we will take appropriate steps to delete it.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be posted on this page with an updated “Last updated” date and, where required, communicated directly.

The updated Privacy Policy will take effect when posted or on the effective date stated in the updated policy.

15. Contact us

For privacy questions, requests or complaints, contact:

Catupult Pte Ltd

20A, Teck Lim Road

Singapore 088391

Privacy and communications contact: communications@catupult.ai