Privacy Policy

Cactal, Inc., a Delaware corporation ("Cactal", "we"), is the controller for personal information we collect to run our marketing site, product app, API, billing, authentication, support, and account operations. This policy covers cactal.ai, app.cactal.ai, api.cactal.ai, and related Cactal services. When customers use Cactal to publish websites and collect first-party visitor analytics, the customer is responsible for their site and we process that visitor data on their behalf.

• Account and authentication data. Name, email address, profile image, password credentials, email verification state, session identifiers, IP address, user agent, and authentication events.
• Organization and access data. Organization names, slugs, logos, roles, memberships, invitations, website-scoped collaborator access, API key metadata, credential hashes, the AI assistants you connect and the access you give them, and audit history.
• Website and customer content. Website names, source files, custom code, CMS schemas, CMS fields and items, redirects, metadata, domains, deployments, generated artifacts, screenshots, images, files, and other assets you upload or publish.
• Website form submissions. What visitors send through forms on customer websites, including the fields they fill in, the page and referrer, an approximate country, and browser details, plus the email addresses site owners add to receive those submissions.
• Homepage prompt drafts. The website description and files you submit from the prompt box on cactal.ai before signing in. We hold them privately, return them only to the person who signs in and continues in the same browser, and delete each draft about 24 hours after it is submitted.
• Billing and usage data. Plan, subscription state, invoices, checkout and portal activity, live-site capacity, usage meters, prepaid balance activity, payment method setup status, provider customer identifiers, and billing events. We do not store full card numbers.
• Product usage and diagnostics. Pages and features used, API and MCP activity, operation outcomes, error categories, rate-limit events, device and browser information, log data, telemetry, and product analytics events.
• How you found us. When you visit cactal.ai or first open the Cactal app, the website that sent you (its domain only), any campaign tags in the link, such as utm_source, and the page you landed on. If you sign up, we keep this with your account.
• Communications. Demo requests, support messages, notification and email preferences, email delivery status, link clicks in emails we send, bounce or complaint data, and suppression records.

Customer websites may include first-party Cactal analytics. Those analytics can include pageviews, referrers, UTM campaign values, devices, countries, realtime activity, and related traffic statistics. Analytics are measured through same-origin Cactal collection paths rather than third-party advertising trackers, and our systems also process the technical serving logs needed to deliver customer sites. For this visitor data, the site owner is the responsible party: the owner must tell visitors how their site uses analytics, and visitor questions or requests about a customer website should go to that site's owner. We act on owner instructions consistent with our agreements.

Customer websites may include forms. We store each submission for the site owner, email it to any recipients the owner chooses, and screen it for spam, which can include an automated review by an AI model. As with analytics, the site owner is responsible for this visitor data, and visitor questions or requests about a submission should go to that site's owner.

We collect information directly from you when you create an account, configure an organization, publish a site, upload assets, use the API or MCP server, start billing flows, or contact us. We collect some information automatically through cookies, local storage, logs, analytics events, and service telemetry. We also receive information from service providers that help us process billing, send email, run analytics, host infrastructure, store assets, and secure the service. If you dictate in the prompt box on cactal.ai, your browser's built-in speech recognition turns your speech into text. Your browser's provider, such as Google or Apple, may process that audio under its own terms, and we receive only the text. If you dictate in the Cactal app, we send the recording to ElevenLabs, which turns it into text. If you sign in with Google, Google shares your name, email address, and profile image with us.

• provide, authenticate, authorize, publish, host, analyze, maintain, and support the service
• process subscriptions, usage charges, prepaid balances, invoices, payment setup, cancellations, and billing support
• secure accounts, detect abuse, enforce rate limits, debug errors, preserve audit history, and investigate incidents
• send transactional emails, invitations, OTP codes, billing notices, security notices, service updates, and support responses
• send getting-started guidance, product updates, website milestones and statistics, offers related to Cactal, and feedback requests by email, which you can opt out of at any time
• understand product usage, improve features and reliability, and measure the effectiveness of the service, including which websites and campaigns bring people to Cactal
• comply with legal obligations and enforce our Terms, policies, rights, and agreements

Where laws such as the GDPR or UK GDPR apply, we process personal information to perform our contract with you, pursue legitimate interests such as security, support, product improvement, billing administration, and abuse prevention, comply with legal obligations, and rely on consent where the law requires consent, such as for optional communications or non-essential tracking. We send getting-started, product, and offer emails to account holders based on our legitimate interest in helping you get value from the service and, where it applies, the existing-customer exemption for our own similar services. Every one of those emails includes an unsubscribe link.

We share information only as needed to operate Cactal, comply with law, protect rights and safety, or complete a business transaction. We do not sell personal information or share it for cross-context behavioral advertising.

• Infrastructure and hosting. Railway, Postgres infrastructure, S3-compatible object storage, Cloudflare R2/CDN services, and related providers process account, content, asset, and operational data.
• Billing. Autumn and connected payment processors process subscription, checkout, invoice, usage, customer, and payment-method data.
• Email. Resend processes recipient, template, delivery, bounce, complaint, and suppression data for transactional and product email, including link-click data for product email.
• Analytics and observability. PostHog processes product analytics events, error reports, and page performance measurements. Hosted-site analytics run on Umami infrastructure we operate, and OpenTelemetry-compatible observability services such as OpenObserve may process diagnostics, traces, and metrics.
• Rendering and screenshots. Cloudflare Browser Run and sandbox infrastructure may process public URLs, rendered pages, screenshots, and generated artifacts.
• Document parsing. Firecrawl processes PDF, Word, and PowerPoint files uploaded as project context to extract readable text, including OCR when needed.
• Speech to text. ElevenLabs processes voice recordings you dictate in the Cactal app to turn them into text.
• AI infrastructure. Where AI features run, including generation and spam screening of form submissions, prompts, website source, form submissions, and related content may be processed by the model and inference providers we use to deliver those features.
• AI assistants you connect. When you connect an AI assistant, such as Claude, ChatGPT, or Cursor, to your Cactal account, the assistant and its provider receive what Cactal returns to it while it works for you. That can include website source and content, analytics, and form submissions containing website visitors' personal information. The provider handles that information under its own terms and privacy policy. You can disconnect an assistant at any time in your Cactal account settings.
• Legal, safety, and corporate events. We may disclose information to comply with law or valid legal process, to protect rights, safety, and the integrity of the service, or in connection with a merger, acquisition, financing, reorganization, or sale of assets, with notice where required.
• Public websites. Content you publish is served publicly to visitors and may be indexed, cached, linked, archived, or copied by third parties.

We use essential cookies for authentication and security, and to connect a draft you submit from the cactal.ai prompt box to your account when you sign in. We use local storage for preferences such as theme, for drafts you have not sent yet, and for product analytics identifiers when product analytics is enabled. We use session storage for short-lived product analytics flow state, such as sign-in completion. On cactal.ai, session storage remembers the website that sent you and any campaign tags in the link for the rest of your visit. When you first open the Cactal app, we keep them in a first-party cookie, so that if you sign up we know how you found us. The cookie lasts 90 days, and neither is ever used for advertising. We do not use third-party advertising cookies on the marketing site or product app.

• Account, organization, website, CMS, source, asset, and billing records are kept while needed to provide the service and for legitimate business, security, tax, accounting, legal, and compliance purposes.
• Organization deletion starts a 30-day support restore window before permanent purge eligibility. Websites deleted by that organization action are taken offline and may be restored with the organization during that window.
• Website deletion starts a 30-day restore window. After that window, the website and its dependent content, source, asset records, and backing objects become eligible for permanent deletion.
• Website assets and generated artifacts use soft-delete and retention sweeps. Deleted asset rows and backing objects are physically cleaned up after the configured retention window, which is currently seven days by default.
• Drafts submitted from the cactal.ai prompt box before sign-in are deleted about 24 hours after they are submitted, together with their files.
• Website form submissions are kept until the site owner deletes them or the website is permanently deleted. Submissions marked as spam are deleted after 30 days.
• Invitations, sessions, verification records, API keys, logs, audit events, notification events, provider records, and backups follow their configured expiration, retention, or legal hold periods.

We use safeguards intended to protect personal information, including authentication, authorization, scoped API keys, tenant-aware database constraints, rate limits, audit logging, reviewed telemetry allowlists, and encryption in transit where applicable. No method of transmission or storage is completely secure, and you are responsible for protecting your own credentials, exports, and endpoint environments.

We and our service providers may process information in the United States and other countries. Where transfer safeguards are required, we use appropriate measures such as contractual protections, standard contractual clauses, or other lawful transfer mechanisms.

You may request access, correction, deletion, portability, or restriction of your personal information, object to certain processing, withdraw consent where processing is based on consent, or opt out of optional communications. Email [email protected] or use our contact page to exercise these rights. We may need to verify your identity and authority before acting on a request, and where the law allows, an authorized agent may submit a request for you if we can verify the agent's authority. If we decline a request, we will explain why, and you may appeal by replying to our response. You can opt out of getting-started, product, and offer emails at any time with the unsubscribe link in any of those emails or by emailing us. We will still send transactional messages about your account, security, and billing.

Depending on where you live, you may have rights under the GDPR, UK GDPR, CCPA/CPRA, LGPD, or similar laws. Those rights may include the right to know categories of personal information collected, sources, purposes, recipients, retention periods, correction, deletion, portability, objection, restriction, non-discrimination for exercising rights, and complaint to a supervisory authority.

For California residents: in the last 12 months we collected the categories of personal information described in this policy, from the sources, for the purposes, and with the recipients described in this policy. We do not sell personal information or share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of, and we treat legally recognized opt-out preference signals such as Global Privacy Control accordingly. We do not use sensitive personal information to infer characteristics or for purposes requiring a separate "limit use" link, and we will not discriminate against you for exercising your rights.

Cactal is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided personal information to us, contact [email protected] and we will take appropriate steps to delete it.

We may update this Privacy Policy as our service, providers, data practices, or legal obligations change. We will post the updated version here and revise the date above. For material changes, we will provide reasonable notice by email, in-product notice, or another appropriate method.

Questions or privacy requests? Email [email protected] or use our contact page. Our mailing address is Cactal, Inc., 13740 N Highway 183 Ste L2 #448, Austin, TX 78750, United States.