Version: 1.1
Effective Date: 2026-07-14
Operator: Heliopolis Creative and Culture Limited (Hong Kong)
Contact: privacy@catalpasatelier.com
This Privacy Policy explains how Heliopolis Creative and Culture Limited, trading as Catalpas Atelier ("Catalpas Atelier", "we", "us", or "our"), handles personal information when you use our international website, account and subscription services, support services, and desktop software.
Our current desktop products covered by this Policy are Catalpas Atelier Scribe and Catalpas Atelier Scroll (together, the "Covered Software"). The Writing Suite (Scroll + Scribe) is a commercial plan that may provide entitlements to both products; it does not change how local project content is handled.
This Policy is a privacy notice, not a request for blanket consent. Where we rely on consent for a particular activity, such as optional analytics or marketing technologies, we ask for that consent separately and allow you to withdraw it.
Our Terms of Use and EULA govern your use of the website, account, subscriptions, and Covered Software. Our separate Cookie and Tracking Notice explains optional technologies used on catalpasatelier.com. The Catalpas Atelier Docs and Blog properties provide their own property-specific cookie notices and consent controls.
Catalpas Atelier is operated for the international region by:
This Policy applies to:
catalpasatelier.com and its account, checkout, billing, download, and support surfaces;The Catalpas Atelier Docs and Blog properties may display supplemental privacy or cookie notices describing processing specific to those properties. A supplemental notice controls for that property if it provides more specific information. The international and mainland China regions use different operators, infrastructure, account systems, and legal documents; this Policy does not govern services expressly offered by the mainland China operator.
We collect only information reasonably needed to provide, secure, support, and improve the relevant service.
When you create or manage an account, we may process:
If you use Sign in with Google, Google authenticates you and, after you complete Google's consent screen, provides the identifiers and profile fields needed to create or connect your Catalpas Atelier account, such as a Google account identifier, email address, name, and profile image. We do not receive your Google password.
Stripe processes international card and payment-method information. We may receive and store:
We do not receive or store full payment-card numbers, card security codes, or online-banking credentials. The Covered Software does not collect payment-card details; it opens the relevant Catalpas Atelier account or billing page.
When you visit our website or connect to an online service, our servers, hosting providers, content-delivery providers, and security systems may receive:
With your separate consent, analytics or marketing providers may also process page views, campaign/referrer information, browser/device information, approximate location, cookie or pixel identifiers, and the events described in our Cookie and Tracking Notice.
Campaign links. If you follow a Catalpas Atelier campaign redirect such as /r/<slug>, we record a first-party campaign visit before redirecting you. The record may contain the campaign identifier, a single-visit pseudonymous request identifier, landing page, request time, referrer, browser/user-agent information, IP address, and approximate country. We use it to route the request, apply an offer you requested, prevent abuse, troubleshoot links, and perform limited campaign measurement based on our legitimate interests. This first-party visit record is separate from optional analytics and advertising pixels.
We do not store a persistent campaign visitor cookie or link a campaign visit to a later registration or purchase unless you have granted marketing consent. If you grant that consent, we may store the host-only cas_visitor pseudonymous identifier for up to 30 days and use it to attribute a later registration or purchase to the campaign. Withdrawing marketing consent removes or disables that browser identifier for future attribution; it does not erase a campaign visit already recorded or information already received by a provider.
When Scribe or Scroll signs in, refreshes a session, verifies an entitlement, checks for an update, retrieves release information, or opens an account service, the request may include information such as:
We do not currently use the Covered Software to perform advertising tracking, third-party product analytics, hardware fingerprinting, MAC-address collection, device binding, or automatic third-party crash reporting. The Covered Software may create diagnostic logs on your device. Those local logs, screenshots, project samples, or crash details are sent to us only if you choose to provide them to support.
If we plan to add telemetry, crash reporting, device binding, or another materially different collection practice, we will update the applicable notice before enabling it and request consent where required.
When you contact us, we process your message, contact details, account and order references, and any screenshots, files, logs, or project excerpts you choose to provide. Please send only the material needed to resolve your request and remove personal or confidential content that is not relevant.
Scribe and Scroll are local-first desktop applications. By default, project content is stored in locations you control on your device or storage provider.
For Scribe, local project content may include manuscripts, notes, outlines, images, PDFs, typography and layout settings, project assets, and exports.
For Scroll, local project content may include documents, Story and planning data, cards, custom properties and relationships, reference cards and links, timelines, maps, tasks, metadata, delivery profiles, manifests, and other project files.
We do not, by default, upload, host, publish, sell, analyse, or use this local project content to train AI models. Scribe and Scroll do not currently provide Catalpas-hosted project sync or AI analysis of local project content. Creating a local export, reference link, bibliography projection, or delivery manifest does not by itself upload that content to Catalpas Atelier.
You may choose to move or share files through your own storage, email, collaboration, publishing, or other third-party services. Those services process the files under their own terms and privacy notices. If we later offer Catalpas-hosted sync, collaboration, AI assistance, backup, or remote publishing, we will provide updated information before those features process project content.
We use personal information to:
Where the GDPR, UK GDPR, or a similar law applies, our legal bases generally include:
Where we ask for consent, you may withdraw it at any time. Withdrawal does not affect processing already lawfully carried out before withdrawal.
catalpasatelier.com uses strictly necessary storage for functions such as language selection, authentication, security, preserving an offer you requested, and remembering your privacy choices. Optional analytics and marketing technologies are off unless you choose the relevant category.
Our consent design provides that:
A first-party campaign redirect and its limited server-side visit record may operate without marketing consent as described in Section 2.3. That record does not enable Meta Pixel, Reddit Pixel, Google Analytics, or persistent cross-session attribution.
Our Official website, Docs, and Blog properties each store their own consent choice. A choice on one property does not automatically apply on another. We use separate Google Analytics properties for those sites and may use shared Meta and Reddit pixels for suite-level campaign measurement. The use of a shared pixel does not override the requirement for separate consent on each property.
See our Cookie and Tracking Notice and the "Cookie preferences" control on the relevant site for details and choices.
We disclose only information reasonably needed for the relevant service or legal purpose. Categories of recipients may include:
Some providers act as our processors or service providers; others may act as independent controllers for parts of their service. Their own notices explain their processing. We require appropriate contractual and security protections where applicable.
We do not sell personal information for money. We do not disclose local Scribe or Scroll project content to advertising providers. Optional Meta and Reddit measurement may be treated as "sharing", targeted advertising, or a similar regulated activity under some US state laws; it remains disabled unless you grant marketing consent, and you may withdraw that consent.
We operate from Hong Kong and use providers that may process information in Hong Kong, Japan, the United States, the European Economic Area, the United Kingdom, or other locations. Those locations may have different privacy laws from your home jurisdiction.
Where required, we use an applicable legal transfer mechanism, such as an adequacy decision, contractual safeguards, or a data processing agreement, and apply supplementary safeguards appropriate to the processing. Contact us if you would like more information about the safeguards relevant to your information.
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security, support, and dispute requirements. Retention depends on the record:
We may retain information longer where necessary to comply with law, preserve evidence, resolve a dispute, or enforce an agreement. We may retain aggregated or de-identified information that no longer identifies an individual.
We use reasonable technical and organisational safeguards appropriate to the nature of the information, including access controls, password hashing, encryption in transit where appropriate, least-privilege access, logging, backup controls, and service-provider review. No service or transmission method is completely secure. You are responsible for protecting your credentials, devices, local project files, and backups.
Depending on your location, you may have rights to:
You can change optional website tracking choices through the site's Cookie preferences control and unsubscribe from marketing email using the link in the message. Where applicable law requires us to recognise a valid browser-based opt-out preference signal, we will treat it as an opt-out for the browser and property from which it is received.
To exercise another right, email privacy@catalpasatelier.com. Tell us which account, site, and right your request concerns. We may need to verify your identity and may retain a limited record of the request. We will not discriminate against you for exercising a privacy right.
If you are in the EEA or United Kingdom, you may complain to the supervisory authority in the country where you live or work or where the alleged infringement occurred. If applicable law requires us to appoint an EU or UK representative, we will publish that representative's contact details here before the appointment becomes required.
Our services are not directed to children under 13. You must also meet any higher minimum age that applies where you live, or use the services only with valid consent from a parent or guardian where the law permits. We do not knowingly collect personal information from a child in violation of applicable law. Contact us if you believe this has occurred.
We may update this Policy to reflect changes in law, providers, products, or processing. The version and effective date identify the current text. If a change is material, we will provide notice appropriate to the change, such as a website, account, email, or in-product notice. Where a new activity requires consent, we will request it rather than relying only on continued use.
For privacy questions, requests, or complaints, contact: