Effective Date: 2026-05-31 Operator: Heliopolis Creative and Culture Limited (Hong Kong) Contact: privacy@catalpasatelier.com
This Privacy Policy explains what personal information Catalpas Atelier collects, how we use it, and the choices you have. It covers catalpasatelier.com and its product documentation subdomain, your Catalpas Atelier account and subscription, and any desktop software we make available under that account (currently the Catalpas Atelier Scribe desktop application; we may add or replace products such as Scroll or Script under the same account over time, in which case this policy or an updated version of it will apply).
Please also read our Terms of Use and EULA, which govern your use of the services.
Catalpas Atelier is operated by Heliopolis Creative and Culture Limited, a company registered in Hong Kong, with registered address Unit B, 12/F, No. 28 Yee Wo Street, Causeway Bay, Hong Kong. For privacy matters, contact us at privacy@catalpasatelier.com.
We are not currently required to appoint a Data Protection Officer or an EU/UK representative, because our processing of personal data of individuals in the European Economic Area and the United Kingdom is occasional and is unlikely to result in a risk to the rights and freedoms of natural persons. We will appoint a representative and update this policy before that ceases to be the case.
We collect only what we reasonably need to provide, secure, and support the service.
Account. When you create or use an account, we store your email address, display name, a cryptographic hash of your password (never the password itself), session and authentication tokens, account settings, language, plan status, and support history.
Subscription and billing. Payments are processed by Stripe. We receive and store the Stripe customer ID, subscription ID, billing plan, renewal and refund status, transaction timestamps, invoice metadata, and limited billing contact information that Stripe forwards to us. We never see or store full card numbers, card security codes, or bank credentials.
Website use. When you visit catalpasatelier.com, our servers and any analytics service we have enabled may record your IP address, browser and device type, pages viewed, time spent, referring page, and cookie identifiers. Where Google Analytics or similar analytics is enabled, it is gated by your cookie consent.
Desktop software. When you sign in to the Scribe desktop application, verify your subscription, or report a problem, we may collect the application version, operating system, basic hardware information (CPU, memory, GPU, screen resolution), your IP address and approximate region, sign-in and token-refresh events, and license-verification events.
As of the effective date of this policy, the desktop software does not implement device binding, single-device licensing, hardware fingerprinting, MAC-address collection, or any third-party crash-reporting service such as Sentry. The application writes local diagnostic logs to your device that you may attach voluntarily when contacting support. If we add any of those capabilities in the future, we will update this policy, describe what is collected and for how long, and where required obtain your consent before turning them on.
Support. When you contact us, we keep your message, the contact details you provide, any screenshots or attachments you choose to send, and our responses, so we can help you and refer back to the conversation later.
Scribe is designed as a local-first desktop application. Your manuscripts, notes, outlines, images, PDFs, exports, and project files stay on your device. We do not upload, host, share, sell, train AI models on, or analyze your local writing content by default, and Scribe does not currently provide cloud sync or AI content analysis.
You retain all rights in the content you create. If we later offer cloud sync, collaboration, AI assistance, backup, or remote publishing features, we will update this policy and our terms before those features touch your content.
We use the information described above to create and protect your account, deliver downloads and updates, verify subscriptions and process renewals or refunds, provide customer support, fix bugs and performance issues, detect abuse and protect paid features from unauthorised sharing, and meet legal and accounting obligations. Where we enable analytics, we use it to understand aggregate website and product usage and to improve the product.
Where GDPR, UK GDPR, or similar laws apply, we rely on the following bases: contract to deliver accounts, subscriptions, software, and support; legitimate interests to keep the service secure, prevent fraud, and understand aggregate usage; consent for optional analytics or marketing cookies; and legal obligation for accounting, tax, and regulatory requirements. You can withdraw consent at any time without affecting processing that already took place.
We use a small number of essential cookies for login, security, and remembering your consent preferences. Where you opt in, we may also set analytics or marketing cookies. You can change your choices at any time through our cookie banner or your browser settings; blocking essential cookies may prevent some pages from working.
Our news and blog subdomain at blog.catalpasatelier.com is operated by the same entity and has its own Privacy Notice and Cookie Policy. The blog uses additional analytics (Google Analytics 4) and an advertising pixel (Meta Pixel) under your separate consent, captured by the cookie banner shown on the blog itself. Cookie consent set on this main website does not carry over to the blog and vice versa.
We share limited information with the service providers that help us run the website, accounts, and software. They only process information for purposes we authorise.
We do not sell your personal information, and we do not use your local writing content for advertising or AI training. If we ever add a new category of provider — for example, a crash-reporting service — we will list it here before turning it on.
We keep personal information only for as long as we reasonably need it. Account data is kept while your account is active and for a short period after closure; billing records are kept as long as tax and accounting rules require; security and diagnostic logs are kept for a limited period needed to detect abuse and fix problems; support conversations are kept long enough to manage related questions and disputes. We may retain aggregated or anonymised data that no longer identifies you.
We use reasonable technical and organisational measures to protect personal information, including access controls, password hashing, encryption in transit where appropriate, least-privilege access, audit logging, backup controls, and vendor security review. No system is perfectly secure, so please look after your account credentials, devices, and local backups.
Because we operate from Hong Kong and use providers in other locations, your information may be processed in Hong Kong, Japan, the United States, the European Economic Area, or elsewhere. Where required, we use appropriate safeguards such as contractual protections or data processing agreements.
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal information; to receive a portable copy of it; to withdraw consent; to opt out of analytics, marketing, or the sale or sharing of personal information; and to lodge a complaint with a data protection authority.
California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, limit the use of sensitive personal information, and opt out of the sale or sharing of personal information. We do not sell personal information, we do not share personal information for cross-context behavioural advertising, and we do not use sensitive personal information beyond what is necessary to provide the service you requested.
To exercise any of these rights, email privacy@catalpasatelier.com. We may need to verify your identity before responding. We will not discriminate against you for exercising a privacy right.
Our services are not directed to children under 13, and you must be at least 16 in jurisdictions where that higher minimum age applies to online services, unless a parent or guardian provides valid consent. If we learn that we have collected personal information from a child without the required consent, we will delete it.
We may update this policy from time to time. If a change is material, we will give reasonable notice by posting the updated policy on our website or by sending an account or in-product notice. The updated policy applies from its stated effective date.
For privacy questions, requests, or complaints, contact us at:
Heliopolis Creative and Culture Limited Email: privacy@catalpasatelier.com Address: Unit B, 12/F, No. 28 Yee Wo Street, Causeway Bay, Hong Kong
If you are not satisfied with our response and the law gives you that right, you may also contact your local data protection authority — for example, the Information Commissioner's Office in the United Kingdom, or the data protection authority in your country in the European Economic Area.
