Privacy Policy

1. Who we are and what this covers

Lemon Juice Labs Inc. ("Lemon Juice Labs," "we," "us," or "our") operates CatProof. Our headquarters are in South Park, San Francisco, California, United States.

This Privacy Policy describes our handling of personal information when you visit catproof.ai, use the CatProof application at app.catproof.ai, configure supported integrations, or communicate with us. Personal information means information that identifies, relates to, or can reasonably be linked to an individual.

When an organization supplies information to its CatProof registry, it controls what it adds and who can access it. We process that registry information to provide the service to the organization. An applicable customer agreement may set additional terms for that processing. An organization’s policies also govern its use of your information.

2. Information we handle

Website visits

Our hosting and delivery providers process technical request information needed to deliver and protect the website. This may include IP address, browser and device information, requested URL, referring page, request time, response status, and diagnostic or security information. We use Render to host the public website and application.

Account and workspace information

If you create or use an account, the application processes your email address, password hash, account and registry identifiers, memberships, roles, invitations, session records, and security events. Passwords are stored as salted hashes, rather than as readable passwords. Owners can invite people to a registry and manage their access.

Agent registry and connector information

We process records you enter and observations obtained from sources you configure, including agent names and identifiers, purposes, platform and source metadata, business and source owners, relationship information, lifecycle and review decisions, notes, freshness information, and change history. These fields may contain personal information if you or a connected source includes it.

If you configure a protected connector, the service processes the credentials you supply to perform authorized reads. Stored connector credentials are encrypted and scoped to the relevant registry and connection. Please configure only sources you are authorized to access and avoid adding unnecessary sensitive personal information.

Optional local collector

If you choose to enroll CatProof Local, it reports approved installation and activity metadata, such as platform family, supported client versions, optional configured agent or MCP server names, and bounded session-lifecycle observations with hashed session identifiers. The collector is designed not to collect prompts, source code, transcripts, model responses, environment variables, or provider credentials. Your chosen enrollment label and enrolling account identify the device record. Review the collector’s preview and documentation before enabling optional reporting.

Demo and conversation brief

The public demo runs with fictional records and simulated actions in the browser. It makes no provider calls. Information entered into the conversation-brief form stays in the current browser session until you download, share, close, or reload it. The form does not submit that information to Lemon Juice Labs. Ordinary website-delivery requests still occur.

Communications

If you email or otherwise contact us directly, we receive the contact details and content you choose to send, and any information needed to respond. If you share a downloaded brief, the recipient receives the information in that file.

3. How we use information

• Deliver, maintain, troubleshoot, and improve the website and CatProof service.
• Create accounts, authenticate users, manage sessions, and apply registry roles and access controls.
• Read configured sources, display inventory and relationships, and preserve business records and decision history.
• Detect misuse, investigate errors, protect accounts and infrastructure, and maintain security records.
• Respond to support and privacy requests and send necessary service or security communications.
• Meet legal obligations, resolve disputes, and protect legitimate rights and interests.

Where applicable law requires a legal basis, we process personal information as necessary to provide services under our agreement, meet legal obligations, pursue legitimate interests in operating and protecting the service and responding to requests, or rely on consent where required. When we process organization-controlled information on its behalf, the organization determines the applicable basis for that use.

Connecting an inventory source does not authorize CatProof to invoke that source’s agents or make the public demo a live integration.

4. When we share information

Within your organization. Registry information is accessible to people granted access to that registry, according to their roles. Owners administer memberships and permissions. Authorized users may download or export information available to them.

With service providers. Providers supporting hosting, content delivery, databases, security, or communications may process information to support those functions. Render provides our hosting infrastructure. The website loads typography from Google Fonts, as described below. If account-recovery email delivery is enabled, the configured email-delivery provider processes the recipient address and message required to deliver the recovery email.

With integrations you configure. Requests to an external platform disclose the request and authentication information needed for the configured connection. That platform handles information under its own terms and privacy practices. Revoking a connection in CatProof does not delete information already held by the external platform.

For legal or business reasons. We may disclose information when required by law, to protect people or services, to investigate fraud or security incidents, or in connection with a merger, financing, acquisition, or transfer of business assets, subject to applicable protections. We may also share information at your direction or with your consent.

We do not sell personal information or share it for cross-context behavioral advertising. The public website does not include advertising pixels or third-party analytics scripts.

5. Cookies, external resources, and tracking signals

The CatProof application uses an essential session cookie to keep you signed in. The application also records session and security information on the server. You can sign out or revoke sessions using the available account controls. Blocking essential cookies may prevent sign-in or other account features from working.

The public marketing website does not set advertising or analytics cookies through its application code. Hosting and security providers may use technology needed to deliver and protect their services.

Our pages request font styles and font files from Google Fonts. Those requests disclose technical request information, such as your IP address and browser headers, to Google. See Google’s Privacy Policy and Render’s Privacy Policy for their practices.

Do Not Track and Global Privacy Control. The website does not currently change its behavior in response to a Do Not Track browser signal. We do not conduct sale or advertising-sharing activities for a Global Privacy Control signal to opt you out of. This does not limit any rights you have under applicable law.

Links to external platforms open services operated by other organizations. Their privacy policies apply to their collection and use of information.

6. Retention and security

We retain information for as long as reasonably necessary to provide the service, maintain requested records and history, handle support and security needs, resolve disputes, and meet legal obligations. Retention depends on the information, its purpose, your organization’s instructions, and applicable obligations. Records may remain in backups for the applicable backup cycle rather than disappear immediately from every copy.

We use safeguards designed to protect information, including HTTPS, password hashing, registry access controls, and encryption of stored connector credentials. No method of transmission or storage can guarantee absolute security. Protect your account, grant access carefully, and revoke credentials or sessions when they are no longer needed.

7. Your choices and privacy requests

You can use available account and registry controls to manage sessions, memberships, records, and connections within your permissions. For information controlled by your employer or another organization, first contact its registry administrator. Revoking access or a connector does not automatically remove historical records.

Depending on your location and the laws that apply, you may have rights to request access to personal information, correction, deletion, a copy, or restrictions on or objections to certain processing. Where processing relies on consent, you may be able to withdraw that consent. Applicable rights may also include appealing a decision or contacting a privacy regulator.

To ask about or exercise a right, contact us using the details below. Describe your request and your relationship to CatProof. We may need to verify your identity and authority, and may refer an organization-controlled request to its administrator. We respond as required by applicable law. Some information may need to be retained for legitimate security, recordkeeping, or legal reasons. We do not discriminate against people for exercising applicable privacy rights.

Please do not include passwords, API keys, or other secrets in a privacy request.

8. International visitors

Lemon Juice Labs is based in the United States. Information may be processed in the United States and other locations where our service providers operate. Privacy laws may differ from those where you live. Where applicable law requires safeguards for an international transfer, those requirements apply; this policy does not claim certification under an international privacy framework.

9. Children

CatProof is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

10. Changes to this policy

We may update this policy as the service or our practices change. We will post the updated policy here and revise the last-updated date. For material changes, we will provide additional notice when required by applicable law.