Privacy Policy

Effective October 26, 2026

Who we are

Catagraph is a course-planning service operated by INTEGRIIT LLC (“we”, “us”). This policy covers the Catagraph website (catagraph.io), the Catagraph app (app.catagraph.io) and the Catagraph mobile apps.

What we collect

When you create an account

• Your name, school email address, school, and role (student, advisor, or faculty).
• Your password, which we store only as a secure one-way hash (bcrypt). We can’t read it.

When you use Catagraph

• The questions you ask and the answers Catagraph gives, so you can see your chat history.
• Courses you tell us you’ve taken or are taking, and the plans you build.
• Support requests you submit, such as a classroom technology problem.

For faculty who connect Canvas

• The Canvas access you grant, kept on our servers and never sent to your browser or to other users.
• Course information from Canvas needed for the features you use, such as your roster’s prerequisite readiness.

When you contact us

• The name, email, school, role, and message you send through the contact form, and the IP address it came from (to stop abuse).

Automatically

• Basic server logs: the page or feature requested, the time, whether it worked, and the IP address. Logs don’t include what you typed into a question.

How Catagraph answers questions

Answers come from your school’s published catalog and other information your school provides, processed by Catagraph’s own software running on our servers. We don’t send your questions or your record to outside AI providers, and we don’t let anyone use them to train outside AI models. If this ever changes, we’ll update this policy and tell partner schools before it takes effect.

How we use your data

• To answer your questions and check prerequisites against your own courses.
• To save your chat history and plans so they’re there next time.
• For partner schools: to show your plan and reasoning to your own advisor, and roster readiness to your own instructors.
• To keep the service secure, fix problems, and respond to support requests.
• To improve how Catagraph reads catalogs and answers questions. We do this with catalog data and aggregated or de-identified usage, not by reading individual students’ conversations.

We don’t sell personal data, rent it, or use it for advertising.

Who can see your data

• You.
• Your school, if it’s a partner school. Advisors and faculty at your school see what their role needs: advisors see their advisees’ plans and the reasoning behind Catagraph’s answers; faculty see readiness for their own courses. People at other schools never see your data.
• Service providers who run parts of Catagraph for us, under contract, only for that purpose:

  Provider	What they do	Where
  Amazon Web Services	Servers that run Catagraph	Canada (Montréal region)
  MongoDB Atlas	Database for accounts, chats, and plans	Canada (on AWS, Montréal region)
  Google Workspace	Our support email	Google’s data centers
  Resend	Delivers contact-form notifications to us	United States
  openrouteservice, Mapbox	Walking directions on campus maps (they receive the start and end points of a route, not your name or account)	Europe / United States

• When the law requires it, such as a valid court order. Where we’re allowed to, we’ll tell the affected school and user first.

Students and education records

When a school partners with Catagraph, we handle student education records on the school’s behalf and under its direction, for the school’s purposes only, consistent with the U.S. Family Educational Rights and Privacy Act (FERPA) and, for Canadian schools, applicable provincial privacy law. Partner agreements set out these responsibilities in detail.

Catagraph is built for college and university students. It isn’t directed to children under 13, and we don’t knowingly collect their information.

Where your data is stored

Accounts, chat history, and plans are stored in Canada, in the AWS Canada (Central) region. Email-related providers listed above may process the limited data they handle outside Canada.

How long we keep it

• Account data, chats, and plans: while your account is active. When you delete your account or ask us to, we delete it within 30 days, except where the law requires us to keep something.
• Contact-form messages: up to two years, so we can follow up.
• Server logs: up to 90 days.

Your choices and rights

You can ask us to show you the data we have about you, correct it, export it, or delete it. Email support@catagraph.io from your school email address and we’ll respond within 30 days. If your school is a partner, some requests may go through your school.

Cookies and browser storage

Catagraph doesn’t use advertising or tracking cookies, and the site and app don’t include analytics or ad scripts. The app keeps your sign-in and your chosen school in your browser’s local storage so you stay signed in. The website loads fonts from Google Fonts, which receives your IP address when the page loads.

Security

All connections use HTTPS. Passwords are hashed, Canvas access stays on our servers, and access to production systems is limited to the people who run Catagraph. No system is perfectly secure; if a breach affects your data, we’ll notify you and your school as the law requires.

Changes

If we change this policy, we’ll update the date above. For significant changes, we’ll notify partner schools and show a notice in the app before they take effect.

Contact

Questions or requests: support@catagraph.io. INTEGRIIT LLC, operator of Catagraph.