BlackShift LLC Privacy Policy CATALYST PRIVACY POLICY Effective date: July 13, 2026 • Last updated: July 13, 2026 This Privacy Policy explains how BlackShift LLC (“Catalyst”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use the Catalyst service, including our mobile applications and the website at catalyst.life (together, the “Servic e”). It should be read together with our Terms of Service. Catalyst is the controller of the personal data described in this Policy. If you have any question about this Policy or about how we handle your data, you can contact us at privacy@catalyst.life. 1. Who We Are and About This Policy 1.1 BlackShift LLC, a Wyoming limited liability company with entity ID 2025 - 001734421, whose registered office is at 30 N Gould St, Ste R, Sheridan, WY 82801, United States, is the controller responsible for your personal data. 1.2 This Policy applies to personal data we process about users of, and visitors to, the Service. It does not apply to third - party services that we do not operate or control, even where we link to them or integrate with them. 1.3 Where we collect data in a particular context, we may give you further privacy information at the time, in addition to this Policy. 2. Information We Collect 2.1 We collect the following categories of personal data: 2.2 Account information. information you provide when you create and manage your account, which may include your email address, name or username, a password (which we store only in hashed form), your confirmation that you are at least eighteen (18) years of age, and, where you sig n in using a third party such as Apple or Google, the basic identifiers that provider shares with us. 2.3 Profile information. information you add to your public profile, such as a display name, a photograph, and any biographical details you choose to provide. 2.4 Content and onboarding information. the goals, tasks, commitment statements and questionnaire answers you provide during onboarding and while using the Service, and the Daily Reflections, posts, comments and messages you create through the Service, including in Mastermind Groups. Goals and t he tasks within them have visibility settings, as described in Clause 5. Your Reflections and other content are written by you and may, depending on what you choose to write, reveal sensitive information about you (see Clauses 3 and 5). 2.5 Cycle and activity data. information about your participation in Cycles, including your Cycle status, Lives, completion, the timing of your Daily Reflections, and your activity and interactions within the Service. 2.6 Payment information. we use third - party payment processors to take payments (see Clause 6). We do not collect or store full payment card numbers. We receive limited
BlackShift LLC Privacy Policy transaction information from our processors, such as a payment token, the status, date and amount of a payment, and a partial card reference, which we use to operate subscriptions and Cycles, to provide bonuses, and to manage refunds and disputes. 2.7 Device and technical information. information about the device and software you use, including device model, operating system, app version, language settings, device identifiers, and the push notification token used to deliver notifications. We process your IP address transiently when you connect, as described in Clause 2.8. 2.8 Approximate location. when you connect, we derive your country from your IP address and store only that derived country; we do not retain the IP address itself beyond short - lived technical logs. We use this to operate the Service, including for security and fraud prevention. Th e Service is not offered in the United Arab Emirates, as described in our Terms of Service. 2.9 Usage and analytics data. information about how you use the Service. Within our mobile and web applications, this is collected through our own self - hosted analytics systems only we do not use third - party analytics SDKs in the applications. On our public website (landing pages), w e use third - party analytics and attribution tools currently AppsFlyer, Meta Pixel and Google Analytics to understand traffic and measure our marketing, as described in Clause 11. Analytics data may include events relating to your use of features, subsc riptions, payments and Cycles. 2.10 Cookies and similar technologies. on our website, we and our providers use cookies and similar technologies as described in Clause 11. 2.11 Communications. the content of any messages you send us, including support requests. 2.12 Special category data. We do not ask you to provide special category data (such as data about your health, mental health, religious or philosophical beliefs, sexual orientation, or political opinions). However, because you write your Reflections and other content freely, that co ntent may contain such information. Where it does, we rely on the basis described in Clause 3.7, and the visibility rules in Clause 5 apply. 3. How We Use Your Information 3.1 We use your personal data for the purposes set out below. Where the law requires a legal basis for processing, the relevant basis is stated. 3.2 To provide the Service. to create and operate your account, provide the Service, operate Cycles and Mastermind Groups, deliver Completion Bonuses, and otherwise perform our agreement with you. Legal basis: performance of our contract with you. 3.3 To handle payments. to take payments and manage subscriptions, Participation Fees, bonuses, refunds, chargebacks and related records. Legal basis: performance of our contract with you, and compliance with our legal obligations. 3.4 To provide planning and voice features. to generate personalised planning suggestions, voice features and related materials, as described in Clause 4. Legal basis: performance of our contract with you. 3.5 To keep the Service safe. to operate the community feed and profiles, to keep the Service safe, to moderate content, to investigate misuse, and to prevent and address fraud and payment disputes. Legal basis: our legitimate interests in operating a safe
BlackShift LLC Privacy Policy and trustworthy service and protecting it from abuse, and compliance with our legal obligations. 3.6 To improve the Service and communicate with you. to understand how the Service is used, to improve and develop it, to send you service - related communications and notifications, and, where you have agreed or where the law otherwise permits, to send you marketing and to measure our marketing. Legal basis: our legitimate interests, and your consent where required. You can opt out of non - essential communications at any time using the unsubscribe link in the email; essential service communications (such as receipts, security notices and legal notices) continue for as long as you hold an account. 3.7 Where content contains sensitive information. where your Reflections or other content contain special category data, or where you choose to publish such content under Clause 5, we process it on the basis of your explicit consent. You can withdraw that consent at any time by ceasing to provide such con tent, by marking content private, or by deleting it, although this will not affect processing carried out before withdrawal. 3.8 To meet legal obligations. to comply with applicable law and lawful requests, and to establish, exercise or defend legal claims. Legal basis: compliance with our legal obligations, and our legitimate interests. 4. Automated Planning and Voice Features 4.1 Some features of the Service generate planning suggestions, voice output and related materials automatically. To provide these features, we share the relevant content you provide, such as your goals and Reflections, with third - party providers that operate the underlying AI models currently Anthropic and OpenAI for planning suggestions, and Eleven Labs for voice features which process that content on our behalf in order to provide those features to you. 4.2 These providers act as our processors for this purpose and are bound by contractual obligations that restrict their use of your content to providing the relevant services to us. Under the applicable terms and settings for the services we use, your content is not used to train these providers’ models. 4.3 These features are provided for general informational and organisational purposes only, do not constitute professional advice, and are subject to the disclaimers in our Terms of Service. The suggestions are generated automatically and may not always be acc urate or suitable. 5. Public Reflections, Profiles and the Community Feed 5.1 The Service includes profiles and a community feed through which Users can see one another’s content. Where you are not participating in a Cycle, your Daily Reflections may be shown on your profile; where you are participating in a Cycle, your Daily Reflec tions may be published to the community feed. 5.2 In either case, you may mark a Daily Reflection as private, in which case it is not shown on your profile or in the community feed and is not made available to other Users, including the members of your Mastermind Group. 5.3 Goals. When you create a goal, you choose its visibility. A public goal is shown on your profile, and your posts show both the goal and the tasks you completed or did not
BlackShift LLC Privacy Policy complete towards it. A semi - public goal is shown on your profile and in your posts, but the tasks within it are not shown. A private goal is not shown to other Users at all not on your profile, not in your posts, and not in the copies of your posts share d with your Mastermind Group although you remain free to mention it in the text of your own Reflections. You can change a goal’s visibility at any time; the change applies to how the goal is displayed going forward. 5.4 Content that you make visible to other Users can be seen, and may be stored or shared, by those Users. You should not include in any content you make visible any information you do not wish to be seen by others, including sensitive information about yo urself or others. 5.5 Removing or marking content private stops it being displayed going forward, but we cannot control content that other Users have already seen, copied or stored. 6. How We Share Your Information 6.1 We share personal data with service providers who process it on our behalf to operate the Service. These currently include providers of payment processing (Whop, RevenueCat and Network AE), AI features (Anthropic, OpenAI and Eleven Labs), cloud hosting and infrastructure (Google Cloud), chat and feed infrastructure (Stream), notifications (Firebase), and website analytics and attribution (AppsFlyer, Meta and Google). These providers may only use the data to provide services to us. 6.2 We share content you choose to make visible with other Users, as described in Clause 5. 6.3 We may disclose personal data where required to comply with applicable law, regulation or a lawful request, to enforce our Terms of Service, or to protect the rights, safety or property of Catalyst, our Users or others. 6.4 If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy. 6.5 We do not sell your personal data. 7. International Data Transfers 7.1 We and our service providers may process your personal data in countries other than the one in which you live, including the United States and the European Union, where our cloud infrastructure and the providers listed in Clause 6 are located. 7.2 Where we transfer personal data from the European Economic Area, the United Kingdom or other regions with similar restrictions to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, such a s standard contractual clauses, to protect that data. You can ask us for more information about these safeguards using the contact details in Clause 14. 8. How Long We Keep Your Information 8.1 We keep personal data for as long as necessary for the purposes described in this Policy, including for as long as you maintain an account, and thereafter as needed to comply with our legal obligations, resolve disputes and enforce our agreements.
BlackShift LLC Privacy Policy 8.2 Some data is kept for specific minimum periods. In particular, we retain records relating to payments and transactions for up to seven (7) years to meet legal, accounting, tax and payment - dispute requirements, even after you delete your account. 8.3 When you delete your account, we delete or anonymise your personal data within thirty (30) days, except for data we are required or permitted to retain as described above. Your profile, Reflections, posts and comments are deleted. Messages you have sent in direct messages and Mastermind chats are not deleted: they are anonymised and remain visible to the other participants, attributed to a deleted user. Content you previously made visible to other Users may persist as described in Clause 5.4. 9. How We Protect Your Information 9.1 We use technical and organisational measures designed to protect personal data, including encryption of data in transit and at rest, access controls, and restrictions on who can access data. No method of transmission or storage is completely secure, an d we cannot guarantee absolute security. 9.2 You are responsible for keeping your account credentials confidential and for the security of the devices you use to access the Service. 10. Your Rights 10.1 Depending on where you live, you may have some or all of the following rights in relation to your personal data: to access it; to have it corrected; to have it deleted; to restrict or object to its processing; to receive it in a portable format; and, where processing is based on consent, to withdraw that consent at any time. 10.2 You can exercise these rights, and can access and delete much of your data, through the Service, or by contacting us at privacy@catalyst.life. We may need to verify your identity before acting on a request. 10.3 You also have the right to lodge a complaint with a supervisory authority, such as the data protection authority in your country of residence or another competent supervisory authority applicable to you. We would, however, appreciate the chance to address your concerns before you do so. 10.4 Where we rely on our legitimate interests, you may object to that processing, and we will stop unless we have compelling legitimate grounds to continue or need to continue for legal reasons. 11. Cookies and Similar Technologies 11.1 On our website, we and our providers use cookies and similar technologies to operate the site, remember your preferences, keep you signed in, and on our public website understand traffic and measure our marketing through third - party tools, currently Ap psFlyer, Meta Pixel and Google Analytics. 11.2 Some of these are necessary for the site to function. For others, where required by law, we ask for your consent and you can manage your choices through the cookie controls provided on the site or through your browser settings. 12. Children
BlackShift LLC Privacy Policy 12.1 The Service is intended only for persons aged eighteen (18) or over. We do not knowingly collect personal data from anyone under eighteen. If we learn that we have collected such data, we will delete it. If you believe a person under eighteen has provided us with personal data, please contact us. 13. Changes to This Policy 13.1 We may update this Policy from time to time. If we make a material change, we will notify you by email or through the Service before the change takes effect. The date at the top of this Policy shows when it was last updated. Your continued use of the Servi ce after a change takes effect indicates your acceptance of the updated Policy, except where we are required to obtain your consent. 14. How to Contact Us and Complain 14.1 The Service is operated by BlackShift LLC, a Wyoming limited liability company with entity ID 2025 - 001734421, whose registered office is at 30 N Gould St, Ste R, Sheridan, WY 82801, United States. For any privacy question or request, contact us at privacy@ catalyst.life. Legal notices may be sent to legal@catalyst.life. 14.2 European Union representative: [To be appointed before the Service is offered in the European Union where appointment is required by applicable law. Contact details will be published here.] 14.3 United Kingdom representative: [To be appointed before the Service is offered in the United Kingdom where appointment is required by applicable law. Contact details will be published here.]