Privacy Policy
Version of 4 November 2026
1. Who we are
catchy-me is a service that finds B2B leads and helps prepare the first contact with them at catchy-me.com (the "Service").
The controller of personal data is Ivan Liangasov pr Računarsko programiranje Liangas Beograd (Stari grad), a sole proprietor (preduzetnik) registered in the Republic of Serbia ("we", "us"):
- address: Kraljice Natalije 11/2, Stari Grad, 11000 Beograd, Serbia;
- registration number (matični broj): 66774244;
- tax ID (PIB): 113368875;
- email for any question about data: support@catchy-me.com.
We have not appointed a data protection officer (DPO). We handle all data questions at the address above.
We process data under the Serbian Law on Personal Data Protection (ZZPL) and, for people in the EU, also under the EU General Data Protection Regulation (GDPR).
This Policy is information about how we handle data. You do not need to agree to it. The legal bases on which we process data are listed below.
2. Whom this Policy covers
- Customers and website visitors: people who have registered with the Service or opened our pages. Section 3 is about them.
- People in search results (leads): people whose professional data the Service has found for our customers. Section 4 is about them.
- Senders: people on whose behalf a customer prepares messages. The customer gives us a link to the sender's public professional profile or a description of the sender in their own words.
Our roles
- For customers' data, and for the leads' data we collect to run the Service, we are the controller.
- Data about other people that a customer gives us (exclusion lists, sender details about themselves or a colleague) we process on the customer's instructions. We will provide a data processing agreement (DPA) on request.
- When a customer uses the results for their own messages, they become an independent controller of that data and are responsible for their messages themselves.
3. Customers' data
| Data | What exactly | Why | Legal basis |
|---|---|---|---|
| Account | name, email, password hash, language, role, status, plan, dates of registration and last login | to create your account and let you into it | contract |
| Acceptance of the Terms | document version, time, IP address, user agent | to show that the agreement was made | legitimate interests |
| Codes and registration | email, code (we keep only its hash), name and password hash until the address is confirmed | to confirm your email and reset your password | contract |
| Sessions and security | the session's IP address and user agent; counters of login attempts and code requests per IP address and email | to keep you logged in and protect against password guessing and abuse | contract; legitimate interests (security) |
| Search setup and onboarding | company description, text of your website or of an uploaded file, goals, audiences, ideal customer description, language of the texts, the assistant's answers; profile links from an exclusion list (we do not keep the file itself) | to set up and run a search | contract |
| Sender details | a link to a public professional profile (we load it through a public data collection service) or a description in your own words; the essence of your offer; which channels you have, without access to them | to write texts on the sender's behalf | contract |
| Results | searches, leads found, facts, assessments, outreach texts | to show you the results | contract |
| Balance and billing | credits, holds, charges per action, top-ups, the rate at the time of each operation, invoices and payment records | to keep your balance and bill you | contract; legal obligation (accounting) |
| Limits | number of assistant calls and new searches per month | fair use of the Service | legitimate interests |
| Emails | email address and the code in the email | to send a registration or password reset code | contract |
| Support | your emails and our replies | to help you and handle questions and complaints | contract; legitimate interests |
| Technical logs | the proxy server log: IP address, page address with parameters, user agent, time, response code; application logs with masked email addresses; records of requests to providers without their content | to keep the Service running and secure, and to find errors | legitimate interests |
| Staff action log | which staff member entered which account and when, what they changed (for example, the balance), the staff member's IP address, the account's email | to control access to data | legitimate interests |
| Text diagnostics | requests to AI models and their answers while texts are prepared (lead and sender data) | to investigate errors and the quality of texts | legitimate interests |
Your name, email and password are required: without them we cannot create an account. Everything else is up to you, but a search cannot be set up without a company and ideal customer description.
We send only emails with codes, with no links and no tracking. We do not send marketing emails. If we start, we will ask for your consent separately.
Our legitimate interests here are to protect the Service and the accounts, to prove that the agreement was made, to keep track of which staff members saw data, and to improve the quality of texts. You can object to processing based on legitimate interests (section 10).
Our staff see account data when they need to for support, billing and security. A staff visit to your account lasts no more than 30 minutes and is recorded in a log.
4. People in our search results
This section is for you if catchy-me has found you for one of our customers. We did not get your data from you, so we explain what we hold and how to stop it.
Why we have your data
Our customers are companies looking for business partners and customers. A customer describes whom they are looking for: for example, heads of sales at companies of a certain industry and size. The Service finds people whose professional profile matches that description and helps the customer prepare a short, personal first message.
What data
- your professional profile: name, job title, profile headline, your company and its details (website, industry, size, headquarters), city and country, experience, skills, education and certifications as published, badges such as "open to work" or "hiring", number of connections and followers;
- links to your professional and social profiles;
- a small profile photo (96×96 pixels);
- your public posts and publications, and reviews of your company;
- facts about you or your company, with links to the sources;
- your work email, if it is published on public pages or is in a B2B data provider's records. We do not guess addresses and do not buy them from enrichment services;
- our assessment of how well you fit the customer's request, and the texts the Service prepared for the customer.
We do not collect phone numbers. We do not deliberately look for special categories of data (health, religion, political opinions and the like), and the AI that studies the sources is told explicitly not to look for details of private life.
Where it comes from
- Commercial B2B databases of people and companies: profile, company, work email.
- Professional and social networks: public profile data, the profile photo, public posts of the person and the company.
- Search engines and maps: search results and reviews of the company.
- Company websites and other public pages. We do not use contact data sites as sources.
- A customer: if a customer knows you and asked us to leave you out of a search, we hold your profile link from their list.
All sources except the commercial B2B databases are publicly accessible pages. On request, we will tell you which specific source your data came from.
Purpose and legal basis
The purpose is to give our business customers relevant business contacts and the context for a personal, relevant first message.
The legal basis is legitimate interests, ours and our customers'. We have weighed them against your interests and limited the processing:
- professional context only: your work, your company, your public business posts;
- no special categories of data and no phone numbers;
- a customer can send you only a short personal message, which you can ignore or opt out of;
- under our Terms, customers must say in their first message where they got your data and must act on opt-outs at once;
- you can object at any time, without giving reasons.
Who sees your data
- The customer who ran the search: they see your full name, profile, facts, email, the assessment and the texts, and can export the results to a file.
- Our staff, when support or the running of the Service needs it.
- Our providers listed in section 6, only as far as the Service needs.
We do not sell personal data.
How long we keep it
At present, data about the people found is kept in the search results for as long as the account of the customer who ran the search exists. This includes people who turned out not to fit the request.
How to object or have your data deleted
Write to support@catchy-me.com and include your profile link or your email address. You do not need to give reasons. You can always object to the use of your data for direct marketing.
We will delete the data about you that we hold within 30 days. The data leaves our backups within 14 days after deletion.
You can also ask for a copy of your data and for the specific source, have inaccurate data corrected, or restrict its processing (section 10).
If a catchy-me customer has already written to you, that message is theirs: they are an independent controller and are responsible for it. To stop their messages, reply to them that you opt out, and write to us as well.
We answer requests in Russian or English.
5. How we use AI
AI models of third-party providers help us at several steps:
- the onboarding assistant reads the customer's website and helps describe goals, audiences and the ideal customer. It is an AI system, and the Service says so;
- models turn the customer's description into search parameters, read profiles, posts and pages, extract facts, assess the fit and write the texts.
Each provider processes data under its own terms. We do not train our own models on your data.
The fit assessment is profiling. It decides only one thing: whether to suggest a person to a customer. It has no legal or similarly significant effect on the person, so the Service makes no decisions within the meaning of Article 22 of the GDPR.
6. Whom we share data with
We share data with providers that help us run the Service. Each gets only what its task needs.
| Provider | What it does | What data | Where |
|---|---|---|---|
| Hosting provider | cloud infrastructure: server, database, backups | all data of the Service | server in Amsterdam, the Netherlands |
| Email delivery service | sends emails with codes | your email, the code, the text of the email | USA |
| AI model providers and the service that routes requests to them | write facts, assessments and texts; answer in onboarding | onboarding and search setup texts; lead data (profile, posts, pages, facts); sender details | USA and other countries |
| B2B data providers | databases of people and companies | search parameters from the ideal customer description, profile IDs, profile links from exclusion lists | USA |
| Public data collection services | collect public posts and profiles; load web pages when our own request fails | profile links and account names of leads, the sender's profile link, page addresses | EU, USA and other countries |
| Search results service | search engine results and company reviews | search queries: a person's name and company, a company name and city | outside the EEA |
We also disclose data:
- to public authorities and courts when the law requires it;
- to a successor of our business if the business passes to them. We will tell you in advance, and this Policy will continue to apply.
7. Transfers outside Serbia and the EEA
Our server is in the Netherlands. Serbian law treats EU and EEA countries as providing an adequate level of data protection.
Some providers are in the United States and other countries outside the EEA. We send them data under their data processing and protection terms, including standard contractual clauses or certification under the EU-U.S. Data Privacy Framework where the provider offers them. Where a provider has no such terms, we send it only what the request cannot do without: search parameters, a profile link, a search query, a page address.
8. How long we keep data
| Data | Retention |
|---|---|
| Your account, its searches, results, texts, sender settings, text diagnostics | while the account exists; deleted within 30 days after you ask us to close the account |
| Lead data | while the account of the customer who ran the search exists; deleted within 30 days at the person's request (section 4) |
| Records of acceptance of the Terms | while the account exists and, after closure, for as long as claims under the agreement can be brought |
| Sessions | 30 days; deleted at once when you log out, and an expired one at your next login |
| Codes and unfinished registrations | up to 1 day; a code is valid for 15 minutes |
| Abuse protection counters | from 10 minutes to 1 hour; the counter of failed password resets until the end of the day |
| Limit counters | until the end of the month; up to 62 days for an assistant session |
| Proxy server log with IP addresses | up to 30 days |
| Application logs | overwritten as they fill up; email addresses in them are masked |
| Staff action log | while the account exists |
| Database backups | 14 days |
| Accounting and payment records | 10 years from the end of the year they relate to |
| Support correspondence | as long as needed to answer and resolve the matter, and while the account exists |
| Browser storage | until you clear it (Cookie Policy) |
After deletion, data stays in backups for up to 14 days and then disappears from them too.
9. How we protect data
- We store passwords only as argon2 hashes. Codes and session tokens are also stored as hashes.
- All connections use TLS (HTTPS). Session cookies cannot be read by page scripts.
- Only staff with the right role can access data. Staff visits to customer accounts and balance changes are recorded in a log.
- The number of login attempts, code requests and other requests is limited.
- The database is backed up every day.
No system is completely secure, so we cannot guarantee absolute security. If a breach puts you at risk, we will inform the Commissioner and you, as the law requires.
10. Your rights
You have the right:
- of access: to know what data about you we process and get a copy of it, and, for leads, to learn the source;
- to rectification of inaccurate data;
- to erasure of data;
- to restriction of processing;
- to data portability: to receive the data you gave us in a machine-readable format;
- to object to processing based on legitimate interests. Objection to direct marketing is unconditional;
- to withdraw consent where processing is based on consent. At present, none of our processing is based on consent.
In your account, you can change your name, language and password yourself, end sessions on other devices, and export search results to xlsx. For everything else, email support@catchy-me.com. Customers should preferably write from their account's address.
To avoid giving data to the wrong person, we may ask you to confirm that the request comes from you. We reply within 30 days. If a request is complex or there are many requests, we may extend this by up to 60 more days, as the law allows, and we will tell you so within the first 30 days. Handling a request is free of charge.
Complaints
If you believe we are breaching your rights, you can complain:
- to the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti): Bulevar kralja Aleksandra 15, 11000 Beograd, www.poverenik.rs;
- or to the data protection authority of the EU country where you live, work or where the breach took place.
We would be grateful if you wrote to us first: the matter can usually be resolved faster.
11. Cookies
We use only necessary cookies: for logging in, for registration, for support access and for your chosen language. There are no analytics, advertising or third-party cookies, and so no consent banner. See our Cookie Policy for details.
12. Children
The Service is meant only for people over 18 who use it for work. We do not knowingly collect children's data, and customers may not search for or contact minors. If you believe we hold a child's data, write to us and we will delete it.
13. Changes to this Policy
We tell you about material changes in advance, by email or in the Service. We announce a new purpose of processing before we start processing data for it. Minor changes (wording, contact details) are published with a new date. The version and the date of the last update are shown at the top of the page.
14. Contact
Ivan Liangasov pr Računarsko programiranje Liangas Beograd (Stari grad), sole proprietor (preduzetnik), Republic of Serbia
- address: Kraljice Natalije 11/2, Stari Grad, 11000 Beograd, Serbia
- registration number (matični broj): 66774244
- tax ID (PIB): 113368875
- email: support@catchy-me.com