CATOS LABS, INC. PRIVACY POLICY

Last updated: October 7, 2026

Please read this Privacy Policy (“Privacy Policy”) and the related Terms of Service (“Terms”) carefully before using the Services. The website-hosted user interface located at https://catalyst.app/chat (the “App”) is operated by Catos Labs, Inc. (“Company,” “us,” “our,” and “we”), a Delaware corporation. The App provides an agentic artificial intelligence interface through which AI-powered agents (“AI Agents”) convert your natural-language prompts into trading strategies and, with your authorization, execute transactions through your Wallet and, where applicable, through a brokerage account opened with a third-party broker-dealer. This Privacy Policy applies to you (“you” or “user”) and to your use of the App, including all products, services, tools, features, functionality, and information made available through the App, as described in our Terms (collectively, the “Services”). Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms.

We are committed to protecting your privacy. This Privacy Policy describes what information we collect, how we collect it, how we use and share it, and the choices and rights you may have regarding your information under applicable data protection laws.

If you do not agree with our policies and practices, please do not use the Services. By accessing or using the Services, you agree to this Privacy Policy. This Privacy Policy may change from time to time (see the Changes to This Privacy Policy section below). Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check this Privacy Policy periodically for updates.

1. INFORMATION WE COLLECT

1.1. Collected Information. We collect Personal Data and Anonymous Data as described below. For purposes of this Privacy Policy, “Personal Data” means data that identifies you or could reasonably be used to identify you, including, for example, your email address, phone number, Wallet address, and any other non-public information about you that is associated with or linked to any of the foregoing, and “Anonymous Data” means data, including aggregated and de-identified data, that is not associated with or linked to your Personal Data. Anonymous Data does not, by itself, permit the identification of individual persons. We limit our collection of Personal Data to what is reasonably necessary for the purposes described in this Privacy Policy, and we do not process Personal Data in a manner incompatible with those purposes.

1.2. Information You Provide Us.

(a) Account Information. To use the Services, you must create an Account. When you create or access your Account, we collect your email address or phone number, which we use to authenticate you. We also collect your Wallet address, which may become associated with your Personal Data when you use the Services.

(b) Identity Verification Information. If you choose to use features of the Services that involve services offered by our partner, Alpaca Securities LLC (“Alpaca”), Alpaca will collect information needed to verify your identity and satisfy “know your customer” (“KYC”) and anti-money laundering obligations. This information may include your full name, date of birth, residential address, Social Security number or other taxpayer identification number, and, where required, a copy of your passport or driver’s license and a photograph of your face, which may be used to generate Biometric Data as described in the Biometric Data section below. We collect and use this information solely for identity verification, account opening, fraud prevention, and regulatory compliance, and we do not use it for any other purpose.

(c) Prompts and Agent Instructions. When you use the AI Agents, Inputs, as well as Outputs. We use Inputs and Outputs to provide and operate the Services, including to configure and run your AI Agents. We do not use your Inputs to train, develop, or improve our AI Agents or underlying AI models.

(d) User Communications. If you contact us, we will collect your name and contact information, as well as any other content included in your message.

(e) User Provided Information is Voluntary. Providing us with Personal Data is voluntary, and you can always choose not to provide certain information; however, you may not be able to use some or all features of the Services if you do not provide it.

1.3. Information Collected via Technology.

(a) Automatic Data Collection. As you navigate through and interact with the Services, we may use automatic data collection technologies to collect certain information about your device, browsing actions, and usage patterns, as described in this Section.

(b) Device and Usage Information. To provide the Services and make them more useful to you, we (or a third-party service provider acting on our behalf) collect information including your browser type, operating system, device type, Internet Protocol (“IP”) address, Wallet address, date/time stamps, the pages and features you use, the actions you take within the App, and how long you spend on the App.

(c) Log Files. We gather certain information automatically and may store it in log files. This information may include IP addresses, browser type, referring/exit pages, operating system, date/time stamps, and clickstream data. We use this information to administer and secure the Services, troubleshoot issues, and analyze trends.

(d) Cookies and Authentication Tokens. A cookie is a small file placed on your device. We use cookies and similar technologies, such as authentication tokens, that are necessary to authenticate you, keep you signed in, and secure your Account. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline them (as discussed in the Your Choices Regarding Information section below). If you disable these technologies, you may not be able to sign in or use the Services. Our systems do not currently respond to “do not track” signals or other similar mechanisms.

(e) Analytics Services. We use PostHog, a third-party analytics service (together with any similar service we may engage in the future, the “Analytics Services”), to help us understand how users interact with the Services. The Analytics Services may set their own cookies or use similar technologies to collect information about your use of the Services, such as the pages and features you use, session duration, device and browser type, and IP address (the “Analytics Information”). We use Analytics Information to measure usage, diagnose with the law and improve the Services. Each Analytics Service’s ability to use and share Analytics Information is governed by its own terms of use and privacy policy.

1.4. Information Collected from Third Parties. We may receive Personal Data about you from third parties that provide products or services used in connection with the Services. For example, our wallet infrastructure provider, Privy, provides us with your Wallet address and the email address or phone number you use to authenticate, and Alpaca may provide us with the confirmation of your identity verification. We may combine this information with the information we have collected from or about you through the Services.

1.5. Public Information Observed from Blockchains. We collect data from activity that is publicly visible or accessible on blockchains. This may include Wallet addresses and information regarding Transactions you execute through the Services, which may then be associated with other data you have provided to us.

2. HOW WE USE THIS DATA

2.1. Personal Data Use. We process your Personal Data to run our business, provide and improve the Services, and comply with our legal obligations. Specifically, we use your Personal Data to:

provide you with access to the App and the Services and authenticate you when you sign in;
configure and operate your AI Agents and execute Transactions in accordance with your instructions and delegated permissions;
verify your identity, screen Wallets and Transactions, and comply with KYC, anti-money laundering, sanctions, and other legal and regulatory requirements;
analyze usage of the Services and improve their functionality, performance, and user-friendliness;
display your Wallet activity, Transaction history, and AI Agent performance within the App;
provide customer support and respond to your requests, inquiries, and feedback;
detect, prevent, and address fraud, security incidents, violations of our Terms or policies, including this Privacy Policy, and other harmful or unlawful activity;
send you administrative notifications and security, support, and maintenance advisories;
comply with applicable laws, cooperate with investigations by law enforcement or other authorities, and pursue or defend against legal claims; and
act in any other way we may describe when you provide the Personal Data.

2.2. Anonymous Data. We may create Anonymous Data from Personal Data. We use Anonymous Data to analyze usage patterns so that we may improve the Services. We reserve the right to use Anonymous Data for any purpose and to disclose Anonymous Data to third parties without restriction, subject to applicable law.

2.3. Automated Processing. AI Agents act on the instructions, permissions, and parameters you provide. We do not use automated processing to make decisions that produce legal or similarly significant effects concerning you, such as determining your eligibility for an account; decisions regarding the opening of a brokerage account are made by Alpaca under its own policies. If our automated compliance screening results in a Transaction being blocked or your access to the Services being restricted, you may contact us to request human review of that outcome.

3. HOW LONG WE KEEP YOUR DATA

We keep your Personal Data for as long as necessary to provide the Services, process your requests, and operate our business, or for longer periods where required by law, including recordkeeping obligations under anti-money laundering and securities laws, except that Biometric Data is retained and destroyed as described in the Biometric Data section below. For as long as we have your data, we will continue to protect its privacy and security consistent with this Privacy Policy.

4. HOW WE PROTECT YOUR INFORMATION

4.1. Precautions We Take. We maintain reasonable physical, administrative, and technical safeguards designed to protect the integrity and security of information collected through the Services. These measures include encryption of data in transit, two-factor authentication, and hardware security keys for access to our systems. We restrict access to Personal Data to our authorized personnel and to third-party service providers as appropriate and necessary to provide the Services. If we become aware of a security incident that compromises your Personal Data, we will notify you and any applicable regulators as and when required by applicable law.

4.2. Your Responsibility. The safety and security of your information also depends on you. You are responsible for the security of your Wallet, your Account credentials, and any device you use to access the Services, and we urge you to take steps to keep them secure. If you discover an issue related to your Wallet, please contact your wallet provider. We ask you not to share your passwords, private keys, or recovery phrases with anyone.

4.3. No Guarantee. Unfortunately, the transmission of information via the internet is not completely secure. Although we work to protect your Personal Data, we cannot guarantee the security of information transmitted to or through the Services, and any transmission is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained in the Services.

We disclose your Personal Data as described below and as described elsewhere in this Privacy Policy.

5.1. Wallet Infrastructure Provider. We share your email address or phone number and Wallet address with Privy, which provides the embedded Wallet infrastructure and authentication services used by the App. Your use of the Wallet is subject to Privy’s terms of service and privacy policy.

5.2. Brokerage Partner. If you choose to open a brokerage account to trade securities through the Services, we share your identity verification information (including your name, date of birth, address, Social Security number or taxpayer identification number, government-issued identification, facial photograph, and, subject to your consent, any Biometric Data) with Alpaca so that Alpaca can verify your identity, open and maintain your account, and comply with legal and regulatory obligations. Alpaca acts as an independent controller of the information it receives, and its collection, use, retention, and disclosure of that information are governed by Alpaca’s own privacy policy, available at Alpaca’s Privacy Policy. We encourage you to review Alpaca’s privacy policy.

5.3. Third-Party Service Providers. We share Personal Data with third-party service providers that perform services on our behalf, including to provide technical infrastructure and hosting; process Inputs and generate Outputs, including through providers of artificial intelligence models; analyze how the Services are used (including PostHog); screen Wallets and Transactions for compliance purposes; prevent, detect, and respond to unauthorized activities; and provide customer support. These service providers may use Personal Data only as necessary to perform services for us. Providers of artificial intelligence models process Inputs and other Personal Data only on our instructions and are contractually prohibited from using your Personal Data, Inputs, or Outputs to train their own models or for any other purpose of their own.

5.4. Affiliates. We may share some or all of your Personal Data with any subsidiaries, joint ventures, or other companies under common control with us (“Affiliates”), in which case we will require our Affiliates to honor this Privacy Policy.

5.5. Professional Advisors. We share information with our professional advisors, such as lawyers and auditors, for purposes of audits and compliance with our legal obligations.

5.6. Corporate Restructuring. We may share some or all of your Personal Data in connection with or during negotiation of any merger, financing, acquisition, or dissolution transaction or proceeding involving the sale, transfer, divestiture, or disclosure of all or a portion of our business or assets. In the event of an insolvency, bankruptcy, or receivership, Personal Data may also be transferred as a business asset. If another company acquires our company, business, or assets, that company will possess the Personal Data collected by us and will assume the rights and obligations regarding your Personal Data described in this Privacy Policy.

5.7. Legal Requirements. We may share your Personal Data to comply with any court order, law, or legal process, including to respond to any government or regulatory request. We may also disclose Personal Data when we believe in good faith that disclosure is necessary to prevent physical harm or financial loss, to investigate suspected or actual fraud or other illegal activity, to enforce our Terms, or to protect the rights, property, and safety of Company, our users, or others.

5.8. Other Disclosures. We may also disclose your Personal Data to fulfill the purpose for which you provide it, for any other purpose disclosed by us when you provide it, or with your consent.

5.9. We Do Not Sell Your Data. We do not sell your Personal Data (including Biometric Data), and we do not share your Personal Data with third parties for their own marketing purposes or for cross-context behavioral advertising. We do not offer any financial incentives or discounts in exchange for your Personal Data.

6. BIOMETRIC DATA

This section sets out our written policy for the collection, use, disclosure, retention, and destruction of biometric data, including for purposes of the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, Washington’s biometric identifier law (RCW 19.375), the Colorado Privacy Act, and other applicable state privacy laws.

6.1. What We Collect. If you choose to open a brokerage account through the Services, you will be asked to submit a photograph or short video of your face together with an image of your government-issued identification. Alpaca’s may create a scan of your face geometry or a similar biometric template from these images in order to compare your face to the photograph on your identification and confirm that the images are of a live person (such scans and templates, together with any information derived from them that is used to identify you, “Biometric Data”). We do not collect fingerprints, voiceprints, retina or iris scans, or any other biometric identifiers.

6.2. Purpose of Collection. We collect and use Biometric Data solely to verify your identity, prevent fraud and impersonation, and comply with KYC, anti-money laundering, and other legal obligations in connection with opening and maintaining your brokerage account. We do not use Biometric Data for any other purpose, including marketing, advertising, profiling, tracking, or training, developing, or improving any artificial intelligence model.

6.3. Notice and Consent. Before we or our service providers collect any Biometric Data, we will inform you in writing (i) that Biometric Data is being collected or stored, (ii) of the specific purpose for which it is being collected, stored, and used and the length of time for which it will be retained, and (iii) of the third parties to whom it will be disclosed, and we will obtain your express written consent, which you may provide electronically. If you do not consent, we will not collect your Biometric Data. [Where available, you may verify your identity through an alternative method that does not involve Biometric Data;] however, you may be unable to open a brokerage account through the Services. You may withdraw your consent at any time by contacting us at privacy@catalyst.app, and we will destroy your Biometric Data as described below, although withdrawal will not affect processing that occurred before it.

6.4. No Sale or Profit. We do not sell, lease, trade, or otherwise profit from Biometric Data, and we do not purchase Biometric Data from third parties.

6.5. Disclosure. We do not disclose, redisclose, or otherwise disseminate Biometric Data except (i) to Alpaca and to identity verification service providers acting on our or Alpaca’s behalf, which are contractually required to use Biometric Data only for the purposes described above and to protect and destroy it consistent with this section; (ii) with your consent; or (iii) where required by federal, state, or local law or by a valid warrant or subpoena issued by a court of competent jurisdiction.

6.6. Retention and Destruction. We permanently destroy Biometric Data, and require our service providers to permanently destroy Biometric Data, at the earliest of: (i) thirty (30) days after the purpose for which it was collected has been satisfied, which is generally upon completion or termination of your identity verification; (ii) forty-five (45) days after we determine that its storage is no longer necessary, adequate, or relevant to that purpose; (iii) your withdrawal of consent; or (iv) twenty-four (24) months after your last interaction with us, unless a longer retention period is required by law or by a valid warrant or subpoena. We review our retention of Biometric Data at least once a year. Copies of your identification documents and related records that do not contain Biometric Data may be retained as required by anti-money laundering and securities recordkeeping laws.

6.7. Security. We store, transmit, and protect Biometric Data from disclosure using the reasonable standard of care within our industry and in a manner that is the same as or more protective than the manner in which we store, transmit, and protect other confidential and sensitive information, including encryption [in transit and at rest] and access restricted to personnel and service providers who need it to perform the purposes described above.

7. LINKS TO THIRD-PARTY WEBSITES

The Services may contain links to third-party websites. When you click on a link to any other website or location, you will leave the Services and another entity may collect Personal Data from you. We have no control over, do not review, and are not responsible for these third-party websites or their content. This Privacy Policy does not apply to those websites or to any collection of your Personal Data after you click on links to them. We encourage you to read the privacy policy of every website you visit.

8. YOUR CHOICES REGARDING INFORMATION

You have several choices regarding the use of your information:

8.1. Email Communications. We may send you service-related communications, such as security alerts, Transaction notifications, and administrative messages, which you may not opt out of while you maintain an Account. If we send you promotional communications, you may opt out by following the unsubscribe instructions in the communication.

8.2. Cookies. You can change your browser’s settings to stop accepting cookies or to prompt you before accepting a cookie. Because we use cookies and authentication tokens to sign you in and secure your Account, disabling them may prevent you from using the Services.

9. YOUR RIGHTS

You can request to access, correct, or delete your Personal Data by emailing privacy@catalyst.app. Depending on where you live, you may have certain additional rights under applicable data protection laws, including the privacy laws of certain U.S. states. For example, you may have the following rights:

Right to access – you may ask us to confirm whether we process your Personal Data and to provide you with a copy of it;
Right to correct – you may ask us to correct inaccurate Personal Data we have about you;
Right to delete – you may ask us to delete Personal Data we have about you, unless we are required or permitted to retain it under applicable law or regulation;
Right to portability – you may request a copy of your Personal Data in a commonly used and machine-readable format;
Right to limit – you may ask us to restrict our processing of your Personal Data where it is not necessary for the purpose for which you provided it; and
Right to withdraw consent – where we process sensitive data, including Biometric Data, based on your consent, you may withdraw that consent at any time.

If you wish to exercise any of these rights, please contact us at privacy@catalyst.app, specify your request, and reference the applicable law. We may ask you to verify your identity or provide more information about your request. We will consider and act upon your request in accordance with applicable law, and we will not discriminate against you for exercising any of these rights. Where you ask us to correct, delete, or limit the processing of your Personal Data, we will notify the third parties to whom we have disclosed it where required by applicable law. Please note that if you choose to delete your information, certain features of the Services may no longer be available to you.

Notwithstanding the above, we cannot edit or delete any information that is recorded on a blockchain, as we do not have custody or control over any blockchain. Information recorded on a blockchain may include your Wallet address and the details of Transactions executed through the Services. In addition, identity verification and account information that Alpaca holds is subject to Alpaca’s own recordkeeping obligations, and requests regarding that information should be directed to Alpaca at privacy@alpaca.markets.

10. CHILDREN

The Services are not intended for individuals under the age of 18, and we do not knowingly collect Personal Data from anyone under the age of 18. If we learn that we have collected Personal Data from a person under 18, we will delete that information. If you believe that we might have any information from or about a person under 18, please contact us at privacy@catalyst.app and provide sufficient detail to enable us to delete that information.

11. DATA LOCATION

The Services are operated in the United States, and we store and process Personal Data in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Services, you acknowledge this transfer, storage, and processing. Third parties to which we disclose Personal Data, including Alpaca, may process it in other countries in accordance with their own privacy policies.

12. CHANGES TO THIS PRIVACY POLICY

We may modify, update, or otherwise change this Privacy Policy, in whole or in part, at any time. When we amend this Privacy Policy, we will revise the “Last Updated” date at the top of this Privacy Policy. For changes that we consider material, we will use reasonable efforts to notify you, such as by email or through a notice in the App. You are responsible for periodically reviewing this Privacy Policy to check for any changes.

13. QUESTIONS; CONTACTING US; REPORTING VIOLATIONS

If you have any questions, concerns, or complaints about this Privacy Policy or our data collection or processing practices, or if you want to report any security violation to us, please contact us at privacy@catalyst.app.