Privacy Policy

The Catalyst Rail, LLC (“Catalyst Rail,” “we,” “us”) operates a software platform that helps organizations collect and send payments over bank rails. This policy explains what information we collect, why, who we share it with, and the choices you have.

1. What We Collect

If you sign up as an organization (merchant/vendor): your business name, contact name, and email address. Bank-account details for receiving payouts are collected and verified directly by Moov through its own hosted onboarding process — we never see or store your bank account or routing number ourselves.

If you’re paying an invoice (a parent, guardian, or customer of an organization using the Service): the name and email address the organization used to send you the invoice, and whatever information you provide to Plaid when linking a bank account to make the payment. As with organizations, we never see or store your bank account number or login credentials ourselves — that flows directly between you and Plaid, and between Plaid and Moov.

We do not collect payment card numbers or full bank account/routing numbers directly. Those are handled entirely by Plaid (bank linking) and Moov (account verification and money movement) under their own security and compliance programs.

Automatically collected: basic usage analytics via Vercel Web Analytics (page views, general traffic patterns) — this does not use third-party advertising cookies and is not used to build an advertising profile of you.

2. How We Use It

• To operate the Service — create invoices, initiate payments, and route funds through Moov to the correct destination account
• To communicate with you about your account or a specific payment
• To detect and prevent fraud, and to comply with our own legal and financial recordkeeping obligations
• To improve the Service based on aggregate usage patterns

We do not sell your personal information, and we do not use it for third-party advertising.

3. Who We Share It With

We share information only with the service providers that make the Service work, and only as needed for that purpose:

• Moov Financial, Inc. — banking-rail partner; performs account verification (KYB/KYC), holds funds in transit, and executes payments.
• Plaid Inc. — bank-account linking and verification for payers.
• Supabase — our database provider (application data storage).
• Vercel — our application hosting provider.

We don’t share your information with any other third party, and we don’t share it for their own marketing purposes. We may disclose information if required by law, or to protect the rights, safety, or property of Catalyst Rail, our users, or the public.

4. Security

We use industry-standard safeguards to protect your information: encryption in transit (TLS) and at rest, database-level access controls that limit which parts of the system can read personal data, and multi-factor authentication on every administrative account with access to production systems. No method of transmission or storage is 100% secure, but we treat this seriously and keep our practices documented and current.

5. Data Retention & Your Rights

We keep your information for as long as your account is active or as needed to provide the Service. Financial transaction records (the fact that a payment of a given amount occurred, on a given date, between which accounts) are retained longer, even after a deletion request, because we’re required to keep financial recordkeeping for recordkeeping and dispute-resolution purposes — but the personal information tied to those records (your name, email) is removed from our systems on request, described below.

To request deletion of your personal information, email lee@catalystrail.org. We’ll remove or anonymize your personal information within a reasonable time, retaining only the de-identified transaction record required by law. You can also request a copy of the information we hold about you, or ask us to correct it, at the same address.

6. Children’s Privacy & Schools

The Service is not directed at children, and we do not knowingly collect personal information directly from anyone under 13. Where the Service is used in a K-12 context (a booster club or school-affiliated organization collecting trip or fundraiser payments), it is the paying parent or guardian who creates the payment — not the student — and any invoice or payment record we hold identifies the payer, not a student. If a specific trip, team, or event needs to be referenced, that appears only as a general description, not as a dedicated student-identity field.

7. Changes to This Policy

We may update this policy from time to time. We’ll post the updated version here with a new “Last updated” date.

8. Contact

Questions about this policy, or a request about your data: The Catalyst Rail, LLC — lee@catalystrail.org.