Privacy Policy

Scope of This Policy

This policy governs the personal information handled by CatalystUI LLC through its public website and through its professional services. It applies to visitors who browse the website, to prospective clients who submit an enquiry, to clients who engage the company for design and engineering work, and to suppliers and partners who correspond with the studio. It does not govern information held by third parties that the company does not control, and it does not govern the internal policies of a client organisation.

The website is a professional presentation of the service lines offered by the company, namely interface system design, integration architecture, dashboard engineering, design token governance, accessibility audits and frontend modernization programs. Information collected through the website is limited to what is necessary to respond to an enquiry, to operate the site securely, and to improve the clarity of the published material. Information collected during an engagement is governed additionally by the written agreement between CatalystUI LLC and the client organisation.

Where a client organisation supplies the company with information about its own customers, employees or partners, that information is processed on the instructions of the client and under the terms of the engagement contract. In such cases the client organisation remains the primary controller of that information, and requests about it should first be directed to the client organisation rather than to CatalystUI LLC.

Information We Collect

CatalystUI LLC collects only the information that serves a stated purpose. The company does not build exhaustive profiles of visitors, it does not purchase marketing lists, and it does not acquire personal information from data brokers. The categories of information that may be collected include identity details such as a name, contact details such as an email address and telephone number, the content of a message submitted through the website, and technical details generated by a browser when a page is requested.

During a professional engagement the company may also receive business information that is necessary to perform the work, such as descriptions of existing systems, sample data required for dashboard design, organisational charts, and the names of project contacts. When sample data is required for design or testing, the company prefers that the client supply anonymised or synthetic data, because the safest way to protect personal information is to avoid receiving it in the first place.

The company does not intentionally collect sensitive categories of personal information such as health records, biometric identifiers, precise geolocation histories or information about political or religious beliefs. If a visitor or client believes that such information has reached the company by accident, the company should be contacted immediately so that the material can be removed.

Information You Provide Directly

Most personal information reaches CatalystUI LLC because a person chooses to send it. When a visitor completes the contact form, the company receives the name, email address, optional subject line and message body that were entered. When a person writes directly to support@camofire.buzz or calls +12185206694, the company receives the content of that correspondence together with the contact details used to send it.

The company uses contact information solely to answer the enquiry, to clarify the scope of a possible engagement, and to maintain a record of the conversation so that later messages are handled consistently. The company does not add website enquirers to a marketing list, does not sell their details, and does not pass them to advertising networks. A person who sends an enquiry may ask at any time that the correspondence be deleted, and the company will honour that request unless a legal obligation requires the record to be retained.

During an engagement, information is provided directly by the client organisation through the channels agreed in the engagement contract. This may include project documentation, system inventories, credentials for test environments and the contact details of project participants. Credentials for production environments are requested only when the work cannot proceed without them, and they are handled under the strictest controls described later in this policy.

Information Collected Automatically

When a visitor loads a page, the web server records standard technical information. This typically includes the internet protocol address of the requesting device, the date and time of the request, the address of the page requested, the referring address where one is present, and the name and version of the browser and operating system. This information is generated by the mechanics of the web and is used to keep the site available, to diagnose faults and to understand aggregate traffic patterns.

The company does not attempt to identify individual visitors from this technical information except where it is necessary to investigate a security incident, to prevent abuse, or to comply with a lawful request. Server logs are reviewed in aggregate and are separated from the personal information supplied through the contact form, so that a browse session is not routinely joined to a named person.

Technical information may also include the approximate country derived from the internet protocol address, which helps the company understand which regions its published material reaches. No precise location tracking is performed by the website, and no device fingerprinting is used to build persistent identifiers for advertising purposes.

Cookies and Similar Technologies

The website relies on cookies and closely related storage technologies only where they serve a clear function. Essential cookies may be used to keep a session stable and to protect submitted forms against cross site request forgery. These cookies are required for the site to behave correctly and they do not contain advertising identifiers.

Where the company uses preference storage, its purpose is limited to remembering a visitor choice such as a dismissed notice so that the same message is not shown repeatedly. Preference storage is not used to follow a visitor across unrelated websites. The company does not operate third party advertising cookies and does not embed tracking pixels that would report a visit to an advertising network.

A visitor can control cookies through the settings of the browser. Blocking essential cookies may prevent the contact form from working correctly, but it will not prevent a visitor from reading the published material. Where the law requires consent before a non essential cookie is placed, the company asks for that consent before the cookie is set and honours a refusal without degrading access to the site.

How We Use Information

CatalystUI LLC uses personal information for the purposes for which it was provided and for closely related purposes that a reasonable person would expect. The primary purposes are to respond to an enquiry, to prepare a proposal, to deliver professional services, to maintain business records, to protect the website from abuse, and to comply with legal and accounting obligations.

Information may also be used in aggregate and anonymised form to improve the clarity of the website, to understand which service descriptions attract the most interest, and to plan capacity at the studio. Aggregation is performed in a way that does not single out an individual, and the company does not use personal information to train advertising models.

The company does not use automated decision making that produces legal effects for a person, and it does not profile visitors for the purpose of differential pricing. Where a client engagement involves the design of decision systems, the company works to keep a human operator in the loop for consequential decisions, reflecting the same principle applied to its own operations.

Legal Bases for Processing

Where the law requires a legal basis for processing, CatalystUI LLC relies on one of several grounds depending on the context. Consent is the basis when a person voluntarily submits a contact form or agrees to receive a specific communication. Contract performance is the basis when processing is necessary to deliver professional services that a client has engaged the company to perform.

Legitimate interests form the basis for limited activities such as securing the website, preventing abuse and maintaining ordinary business records, where those interests are not overridden by the rights of the individual. Legal obligation is the basis where the company must retain records for tax, accounting or other statutory reasons. Where consent is the chosen basis, it can be withdrawn at any time and the withdrawal does not affect processing that occurred before the withdrawal.

The company keeps a written record of the basis relied upon for each category of processing, so that a question about why information is held can be answered concretely rather than by reference to a general statement.

How We Share Information

CatalystUI LLC does not sell personal information and does not rent it to third parties. Information is shared only in the limited circumstances described in this section, and every sharing arrangement is governed by a written agreement that restricts the recipient to the stated purpose.

Information may be shared with service providers that host the website, deliver email, provide accounting software or support the studio operations. These providers act on the instructions of the company and are not permitted to use the information for their own marketing. Information may also be shared when the law requires it, when a valid legal process compels it, or when disclosure is necessary to protect the rights, safety or property of the company, its clients or the public.

If the company is involved in a merger, acquisition or transfer of assets, information may be transferred as part of that transaction. In such a case the company would require the recipient to honour this policy or to provide notice before applying a different one. The company would also notify affected individuals where the law requires it.

Service Providers and Processors

The company engages a small number of service providers to operate the website and the studio. These providers are selected with attention to their security posture and their privacy commitments, and each is bound by a written agreement that sets out the permitted purposes, the security measures and the deletion obligations that apply.

Hosting providers store the website and the server logs described earlier. Email providers transmit correspondence and store messages in transit and at rest. Accounting providers process invoicing records that may contain a client contact name and address. Each provider is assessed before onboarding and periodically afterward, and a provider that cannot meet the company standards is replaced.

Where a service provider is located outside the United States, the company takes steps to ensure that the transfer is lawful and that the information remains protected by appropriate safeguards. Those safeguards are described in the section on international transfers later in this policy.

Data Retention

CatalystUI LLC keeps personal information only for as long as it serves the purpose for which it was collected, plus any period required by law. Contact enquiries that do not lead to an engagement are retained for a limited period so that a later follow up message can be answered coherently, and are then deleted or anonymised. Correspondence relating to an active engagement is retained for the duration of the work and for a reasonable period afterward to support handover and dispute resolution.

Financial and contractual records are retained for the period required by tax and accounting law, which is typically several years. After the applicable period the records are securely deleted or irreversibly anonymised so that they no longer identify a person. Server logs are retained for a short operational window and then discarded, except where a log is preserved as part of a security investigation.

Where a person asks the company to delete information, the company does so unless a legal obligation or a legitimate interest requires retention, in which case the company explains the reason and the expected retention period in its reply.

How We Protect Information

The company applies technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure and destruction. The website is served over encrypted connections, access to studio systems is limited to the people who need it for their work, and strong authentication is required for accounts that can reach client information.

Data held in studio systems is separated by client and by project, so that work on one engagement cannot expose the records of another. Credentials for client environments are stored in a controlled vault rather than in documents or chat messages, and they are rotated when a project member leaves. Backups are encrypted and their restoration is tested so that a recovery is a rehearsed procedure rather than an untested hope.

No system can be guaranteed to be perfectly secure, but the company maintains a process for detecting, containing and reporting incidents. If a breach creates a risk to the rights of individuals, the company notifies the affected people and the relevant authorities without undue delay and describes what happened, what was done about it and what the affected person can do to reduce the risk.

Your Privacy Rights

Depending on where a person lives, the law may grant specific rights over personal information. CatalystUI LLC honours these rights for all individuals it serves, regardless of jurisdiction, because consistent treatment is easier to operate and fairer to the people involved. The rights described in the following sections are available on request and are exercised free of charge in ordinary circumstances.

The company will verify the identity of a requester before acting on a request, using information proportionate to the sensitivity of the request. The company aims to respond within thirty days and will explain any extension where a request is complex. If a request is refused, the company explains the reason and describes the available avenue for challenge.

A person may also lodge a complaint with the supervisory authority in the jurisdiction where the person lives. The company asks that an attempt be made to resolve the matter directly first, because most concerns can be settled quickly through a conversation.

Access and Correction

A person may ask CatalystUI LLC to confirm whether personal information about them is being processed and, where it is, to receive a copy together with an explanation of the purposes, the categories involved and the recipients. The company provides this information in a clear written form and, where practical, in a structured electronic format that can be reused elsewhere.

A person may ask that inaccurate information be corrected and that incomplete information be completed. Where the company disagrees with a proposed correction it will record the disagreement so that the alternative view is preserved alongside the disputed entry. Corrections are propagated to service providers where the information was shared with them.

Where information was processed on the basis of consent, a person may withdraw that consent at any time. Withdrawal takes effect for future processing and does not retroactively invalidate processing that was lawful when it occurred.

Deletion and Restriction

A person may ask that personal information be deleted where it is no longer needed, where consent has been withdrawn and no other basis applies, where the information was unlawfully processed, or where the law requires deletion. The company acts on a valid request promptly and confirms completion in writing.

A person may also ask that processing be restricted, meaning that the information is kept but not actively used, while a question about its accuracy or lawfulness is resolved. The company maintains a record of restrictions so that a restricted record is not accidentally drawn into ordinary processing.

Deletion is not always possible in full, because accounting law may require retention of a transaction record and a security log may need to be preserved during an investigation. Where retention is mandatory the company explains the reason, keeps the record locked to the purpose that requires it, and deletes it once the obligation expires.

Privacy for Children

The website and the professional services of CatalystUI LLC are intended for a business audience and are not directed at children. The company does not knowingly collect personal information from a child, and the design of the website reflects an adult professional context rather than a general consumer audience.

If the company becomes aware that it has collected personal information from a child without appropriate consent, it will delete the information promptly and take steps to prevent a recurrence. A parent or guardian who believes that a child has provided information to the company should contact support@camofire.buzz so that the matter can be resolved quickly.

Where a client engagement involves a system that is used by children, the company designs the system to support the privacy expectations that apply to that audience, including data minimisation and appropriate retention limits. This reflects the same protective principle applied to the company own operations.

International Data Transfers

CatalystUI LLC is based in the United States and processes most information there. Where information is transferred outside the United States, the company relies on lawful transfer mechanisms such as standard contractual clauses or an equivalent safeguard recognised by the relevant law. The company assesses the destination before transferring information and reviews the assessment periodically.

When selecting service providers located abroad, the company considers the legal environment of the provider and whether the provider can demonstrate that it applies the required safeguards. A provider that cannot meet these standards is not used for personal information, even if it offers attractive commercial terms.

A person may ask for information about the safeguards used for a particular transfer, and the company will provide a summary of the relevant mechanism and where the underlying document can be obtained.

Third Party Links

The website may link to external resources that are controlled by other organisations. CatalystUI LLC selects these links with care because they are relevant to the professional material it publishes, but it does not control the privacy practices of the destinations. A visitor who follows an external link should review the privacy notice of that destination before providing personal information.

The company does not embed external content in a way that silently reports a visit to a third party, and it does not publish tracking links that carry a visitor identifier into another site. Where an external resource is recommended, the reference is a plain descriptive link rather than a tracking redirect.

If a visitor believes that a linked destination has become inappropriate or harmful, the company welcomes a note so that the reference can be reviewed and removed where warranted.

Changes to This Policy

CatalystUI LLC may update this policy to reflect changes in law, technology or the way the studio operates. When a change is made, the effective date at the top of the page is revised and, where the change is significant, a notice is placed on the homepage so that a returning visitor is not surprised.

Significant changes include a new category of information being collected, a new purpose for processing, or a new class of recipient. Minor changes such as a clarification of wording or the correction of a typographical error do not trigger a homepage notice but are still recorded in the effective date.

Previous versions of the policy are retained internally so that a person who provided information under an earlier version can understand which rules applied at that time. A written request for information about an earlier version will be answered.

How to Contact Us

Questions, requests and concerns about this policy can be sent to CatalystUI LLC at the addresses below. A person may also write to the studio by post at the Syracuse address. The company will acknowledge a privacy request promptly and will answer it within the period required by the applicable law.

Requests to access, correct, delete or restrict information should include enough detail to identify the relevant records, such as the email address used to send an earlier message or the name of the engagement. The company will verify identity before disclosing or changing information.