Privacy Policy

Effective date: 2026-09-08 (set to the go-live date when published)

mAIstro is operated by Industry Rockstar Switzerland GmbH ("we", "us"), Byfangweg 6, 4148 Pfeffingen, Switzerland, UID CHE-392.505.829. This policy explains what personal data we collect when you use mAIstro at katek.app and its subdomains (the "Service"), why we collect it, who we share it with, and the choices you have.

If you have questions or want to exercise a right described below, write to [email protected].

1. Who this policy covers

• Visitors to katek.app.
• Customers: the business that signs up for mAIstro and the people it invites as users.
• Contacts: the customers' own leads, clients and correspondents whose data flows into mAIstro from the tools the customer connects. For contact data, the customer is the controller and we process it on the customer's instructions.

2. What we collect

Account data. Name, email address, password hash, business name, and billing details. Payments are handled by Stripe; we never see full card numbers.

Connected-tool data. When you connect a tool, we sync the data needed to run the Service:

• GoHighLevel: contacts, opportunities and pipeline stages, conversations, appointments, tasks, notes and tags.
• Gmail: message headers and bodies of conversations with your contacts, so they appear on the contact timeline and can be drafted against.
• Google Calendar: events, attendees and times.
• SMS and WhatsApp (via Twilio): messages sent and received on the numbers you connect.

Usage data. Pages viewed, actions taken, approvals and rejections of AI drafts, timestamps, IP address, browser type. We use this to run and improve the Service and to keep an audit trail of what the AI proposed and what you approved.

Support data. Anything you send us when you ask for help.

We do not knowingly collect data from children under 16, and the Service is not directed at them.

3. How we use data

• To provide the Service: sync your tools, build the morning brief, draft replies and follow-ups, and carry out the actions you approve.
• To generate AI output. Parts of your connected-tool data are sent to a large language model provider to produce briefs, summaries and drafts (see section 5). Our model provider's API terms exclude using customer inputs and outputs to train its models.
• To bill you, secure your account, prevent abuse, and meet legal obligations.
• To send you service messages. We do not send marketing email without your consent, and you can opt out at any time.

We do not sell personal data and we do not use it for advertising.

4. Google user data

mAIstro's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: Gmail and Google Calendar data is used only to show your conversations and meetings inside mAIstro and to draft replies and follow-ups for your approval. It is not used for advertising, is not sold, and is not read by humans except with your explicit permission for support, for security, or as required by law. Gmail data sent to the AI model provider is used only to generate the output you asked for and is not retained by the provider for training.

You can disconnect Google at any time from Settings. Doing so stops the sync and deletes the stored Google tokens; synced messages already on your contact timelines remain until you delete them or close your account.

5. Who we share data with (sub-processors)

We may also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case this policy continues to apply to the transferred data.

6. International transfers

We host the Service in the European Union. Some sub-processors are in the United States. Where data leaves Switzerland or the EU, we rely on the recipient's certification under the Swiss-US and EU-US Data Privacy Framework where it holds one, and otherwise on the EU standard contractual clauses with the Swiss addendum.

7. Retention

• Account and connected-tool data: for as long as your account is open. When you close your account we delete it within 30 days, except billing records we must keep for 10 years under Swiss law (Code of Obligations art. 958f) and encrypted backups, which expire within 26 weeks.
• Audit trail of AI proposals and your approvals: for the life of the account, because it is the record of what the Service did on your behalf.
• Usage logs: 90 days.

8. Security

Data is encrypted in transit and at rest. Access to production is limited to named staff with a business need, logged, and protected by two-factor authentication. Every AI action is approve-first by default: nothing is sent, tagged or moved in your connected tools without a person in your business approving it, and every action is written to an audit log you can review.

No system is perfectly secure. If we learn of a breach affecting your data we will tell you without undue delay and, where required, notify the authorities.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to complain to a supervisory authority. In Switzerland that is the Federal Data Protection and Information Commissioner. Write to the contact address above and we will respond within 30 days.

If you are a contact of one of our customers and want your data changed or removed, contact that business directly; we will help them carry out your request.

10. Cookies

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We do not use advertising cookies or third-party analytics cookies, and no analytics script is loaded on katek.app.

11. Changes

We will post changes here and update the effective date. For material changes we will email account holders at least 14 days before they take effect.

12. Contact

Industry Rockstar Switzerland GmbH Byfangweg 6, 4148 Pfeffingen, Switzerland UID CHE-392.505.829 [email protected]