Legal

Privacy policy

Last updated 4 November 2026

Draft. This document has not been reviewed by a lawyer. Do not publish until it has.

Items marked to be confirmed are placeholders that the operator must complete before publication.

This policy explains what Catchment collects, why we collect it, who can see it and what you can do about it. Catchment is operated by operating entity to be confirmed, based in Australia. In this policy, "we", "us" and "our" mean the operator of Catchment. "You" means an agency, a team member, a client or anyone else who uses Catchment.

What Catchment does

Catchment helps local SEO agencies and freelance web designers show their clients what their online presence delivers. An agency connects its clients' accounts with Google, Facebook, Instagram, TikTok and Microsoft Bing. Catchment then builds reports, and publishes posts when the agency asks it to.

What we store

  • Accounts. Names and work email addresses for agency admins, team members and clients. Passwords are stored as one-way hashes, so we cannot read them.
  • Two-factor authentication. Authenticator set-up secrets, which are encrypted, and recovery codes, which are stored as one-way hashes.
  • Connection tokens. Sign-in tokens and API keys for Google, Meta, TikTok and Microsoft Bing. These are encrypted.
  • Business details. Business names, websites, addresses, services, suburbs, report titles and brand colours.
  • Figures from connected platforms. Totals for each day, such as views, calls, clicks, website visits and search positions. These are totals, not records about individual people.
  • Uploaded files. Logos, screenshots, and images and videos for posts.
  • Post history. The text of each post, the platforms it went to, its result and a link to the live post.
  • Sign-in and activity logs. Sign-ins, failed sign-in attempts, password and two-factor changes, and the network address each event came from. Passwords, codes and tokens are never written to these logs.
  • Email settings. The server details for the agency's own outgoing email. The email password is encrypted.

What we do not store

  • Individual visitors or customers. We do not hold records about the people who visit a client's website, call the business or ask for directions. Figures are totals, such as the number of sessions from a suburb.
  • Raw platform exports. We keep the totals needed for reports, not the full files that platforms send.

Why we collect it

We use this information to provide the reports, publishing and sign-in features that an agency asks for. We also use it to keep accounts and business data secure, and to answer support requests. We do not sell personal information, and we do not use it for advertising.

Who can see it

  • The agency's own users. Admins see every business the agency manages. Team members see only the businesses they have been added to.
  • Clients. A client who has a login sees only its own business. A read-only client view is planned and is not yet available.
  • The operator. The Catchment team can access data only when needed for support, security or to keep the service running.

Third parties

Catchment receives or sends data through the services below. Each has its own privacy policy, which applies to its own service.

  • Google. Business Profile, Google Analytics 4, Google Search Console and, where connected, Google Ads. These are data sources.
  • Meta. Facebook Pages, Instagram and, where connected, Meta Ads. These are data sources, and Facebook and Instagram are used for publishing when the agency asks for it.
  • TikTok. A data source, and a publishing destination when the agency asks for it.
  • Microsoft Bing. Bing Webmaster Tools, which is a data source.
  • Manual entry. Figures from Apple Business Connect and Bing Places are typed in by the agency from those dashboards. Neither service is connected directly.
  • Email provider. The agency sets up its own email server. Password reset emails and sign-in codes are sent through it, where email has been set up.
  • OpenStreetMap. Map tiles, and lookups of place names such as city names so they can be shown on the map. These lookups do not include details about individuals.
  • Hosting provider. The company that runs the servers Catchment runs on. The data centre location is to be confirmed.

Google user data

Catchment's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data only to produce the reports and publishing that the agency asks for. We do not use it to serve advertising, and the Catchment team does not read it except where needed for security, to comply with the law, or with the consent of the account holder.

Cookies

Catchment uses one session cookie to keep you signed in. It cannot be read by scripts, and it is marked Secure when the service runs on HTTPS. We do not use tracking, advertising or analytics cookies.

The app also remembers your appearance choice (light, dark or automatic) in your browser's local storage. This stays on your device and is not sent to us.

How long we keep it

  • We keep account and business data while your account is active.
  • If you cancel, we delete your account and business data within 30 days of cancellation.
  • Backups are kept for to be confirmed before they are overwritten.
  • Sign-in and activity logs are kept for to be confirmed.
  • Connection tokens are removed when you disconnect a platform.

How we protect it

  • Encryption at rest. Connection tokens, API keys, app secrets, the email password and two-factor secrets are encrypted with AES-256-GCM.
  • HTTPS. Connections between your browser and Catchment use HTTPS, and the app sends security headers that help protect against common web attacks.
  • Two-factor authentication. Required for admins and optional for everyone else.
  • Audit log. Security-related events are recorded, so admins can see who signed in and what changed.
  • Access limits. Sign-in attempts are rate limited, and sessions end after a period of inactivity or a set maximum length.

Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you can:

  • ask for access to the personal information we hold about you;
  • ask us to correct information that is wrong; and
  • make a complaint if you think we have not handled your information properly.

To make a request, contact us using the details below. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/.

Disconnecting a platform or deleting a business

  • Disconnect a platform. Open the business, go to Settings > Connections and disconnect the platform. This removes the connection tokens for that platform.
  • Remove a Google or Facebook sign-in. Open the Setup page and select Remove next to the sign-in. Businesses already imported keep working.
  • Delete a business. Open the business, go to Settings > Profile and select Remove business. This deletes the business's data in Catchment. It does not change anything on the platforms themselves.
  • Delete a login. An admin can remove a login under Admin > Users once it no longer owns a business. You can also contact us.

Changes to this policy

We may update this policy as Catchment changes. We will change the date at the top when we do. For significant changes, we will tell agency admins before they take effect.

Contact us

Catchment, operating entity to be confirmed, Australia. Email: to be confirmed (privacy contact email). Website: https://catchment.au/.

See also our terms of service.