Last updated: 20 October 2026

Catalyst Group (“we”, “us”) runs catalystgroup.gg, the CRM-NG software and its hosted services. This policy explains what we collect, why, and what you can do about it. We keep it short and in plain words.

Who we are

Catalyst Group, reachable at privacy@catalystgroup.gg. Website: https://catalystgroup.gg.

What we collect, and why

  • Contact and booking forms, service finder, assessments. Name, company, email, phone and the answers you give. Used to reply to you, prepare a proposal and, if you become a client, to run your account. Kept while we work together and for 3 years afterwards for our records.
  • Client portal and CRM-NG accounts. Login details, tickets, documents you upload or sign, invoices, time records and messages. Used to deliver the services you bought. Kept for the life of the account plus 7 years for accounting records.
  • CRM-NG licences. Licence key, the site address it is activated on, product, plan and activation dates. Used to issue, validate and renew licences and to send licence emails. Kept for the life of the licence plus 7 years.
  • Payments. Handled by our payment providers; we see the amount, date, the last four digits of a card and the billing name, never the full card number.
  • Email we send you. Delivery, open and click records for emails sent from our CRM, so we can stop sending to addresses that bounce or unsubscribe. Every marketing email has an unsubscribe link.
  • Website visits. Server logs (IP address, pages, browser, time) kept for 30 days for security and troubleshooting. Our own visitor measurement runs on our server; we do not use third-party advertising trackers.

Google and Microsoft account connections (CRM-NG SMTP Email, One-Click Setup)

CRM-NG SMTP Email lets a site administrator send their site’s email through their own Gmail or Microsoft 365 account by signing in once. Here is exactly what happens:

  • We ask Google for the gmail.send permission only, and Microsoft for Mail.Send only. We cannot read your mailbox, contacts or files.
  • The sign-in goes through our relay (relay.catalystgroup.gg). The relay passes the result to your site in a sealed form only your site can open, and keeps no copy of your tokens. It logs the time, the provider and your site’s address, never the content of email.
  • The access and refresh tokens are stored on your own WordPress site, encrypted, and are used only to send that site’s email. Your email goes directly from your site to Google or Microsoft; it never passes through us.
  • You can disconnect at any time with the Disconnect button in the plugin, or by removing the app under your Google account’s “Third-party apps” or your Microsoft account’s “App permissions”. Disconnecting deletes the tokens from your site.
  • CRM-NG SMTP Email’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we do not do

  • We do not sell personal data, and we do not share it with advertisers.
  • We do not use data from your Google or Microsoft account for anything except sending your site’s email.
  • We do not use your data to train artificial-intelligence models.

Who else sees data

Only the providers we need to run the service: our hosting provider, our email delivery providers, our payment providers, and Google or Microsoft when you connect an account. Each sees only what its job needs. We disclose data when the law requires it.

Security

Encrypted connections everywhere, encrypted storage of secrets, two-step sign-in for staff, access limited to people who need it, logging of access to sensitive records, and backups kept off the live server. No system is perfect; if a breach affects you, we tell you without undue delay.

Your choices and rights

You can ask us what we hold about you, ask for a copy, ask us to correct or delete it, or object to a use of it, by emailing privacy@catalystgroup.gg. We answer within 30 days. If you are in the European Economic Area, the United Kingdom or California you have these rights by law; we extend them to everyone.

Cookies

We set the cookies WordPress needs to keep you signed in and to remember a form you started. We do not set advertising cookies.

Children

Our services are for businesses and are not directed at children under 16. We do not knowingly collect their data.

Changes

When this policy changes we update the date at the top and, for material changes, tell account holders by email.