Legal
Privacy Policy
This policy explains what personal information we collect when you visit covenantflow.ai, how we use it, and the choices you have. It covers this marketing site only. The CovenantFlow application that banks and lenders use is governed by the master agreement between Catalyze Labs and the customer institution.
Effective May 12, 2026
What we collect
The categories of information.
We only collect what we need to operate the site and respond when you reach out. We do not sell personal information.
| Category | Examples | Why we collect it |
|---|---|---|
| Contact form submissions | Name, work email, company, role, message body, and anything else you choose to include. | Reply to your inquiry, route to the right person on our team, and follow up. |
| Demo bookings (Cal.com) | Name, email, time zone, calendar event metadata, and any notes you add when scheduling. | Schedule and run a product demo. Cal.com hosts the booking experience. |
| Newsletter subscriptions | Email address. | Send the monthly Insights newsletter. You can unsubscribe from any issue using the link at the bottom. |
| Server logs | IP address, user-agent, request URL, timestamp, response status. | Operate the site, prevent abuse, debug errors, and meet security obligations. |
| Analytics | Pages viewed, referring URL, device type, approximate location (city/region), session duration. Collected via Google Analytics. | Understand which content is useful and improve the site. Aggregated, not used to identify individuals. |
How we use it
Purpose-bound, not exploratory.
- Respond to inquiries you send through the contact form.
- Schedule and confirm product demos you book.
- Send the monthly Insights newsletter to subscribers who opted in.
- Understand site traffic and which content people find useful.
- Detect, prevent, and respond to abuse, fraud, or security incidents.
- Comply with applicable law and respond to lawful requests.
We do not use the personal information collected through this site for automated decision-making, behavioral advertising, or cross-context profiling.
Who we share it with
Service providers, listed.
We share personal information with the service providers below, each acting on our behalf and bound by a written agreement to handle the data only as we instruct. We do not sell personal information and we do not share it with advertising networks.
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Hosts this site, serves pages, and stores server logs. | United States |
| Upstash | Stores the Insights blog content (Redis). | United States |
| Vercel Blob | Stores images uploaded for blog posts. | United States |
| Cal.com | Hosts the demo booking flow and sends calendar invites. | United States |
| Google Analytics | Aggregated traffic and engagement analytics. IP addresses are truncated before storage. | Global (Google) |
| Email service provider | Delivers the Insights newsletter to subscribers. Current provider available on request. | United States |
We may also disclose information when required by law, to enforce our terms, to protect rights and safety, or in connection with a business transaction (e.g. a merger or acquisition), with notice where reasonably practicable.
Cookies & analytics
What runs in your browser.
We use a small number of cookies. They fall into two groups:
Strictly necessary
The CMS at /admin uses a session cookie to keep authors signed in. Without it the CMS cannot function.
Analytics
Google Analytics sets cookies to measure aggregate traffic and engagement. IP addresses are truncated before storage. You can opt out site-wide using the Google Analytics opt-out browser add-on or by enabling Do Not Track / Global Privacy Control in your browser.
The Cal.com booking embed and any third-party content (e.g. videos) may set their own cookies when you interact with them.
Your choices
Control over your information.
Access, correct, or delete
Email us at privacy@covenantflow.ai with the request and the email address you used. We respond within 30 days.
Unsubscribe from the newsletter
Use the unsubscribe link at the bottom of any issue. The change is immediate.
Opt out of analytics
Install the Google Analytics opt-out add-on (linked above), enable Do Not Track or Global Privacy Control, or block third-party cookies.
Don't submit forms
You can browse the entire site without filling out the contact form, booking a demo, or subscribing.
California residents
CCPA / CPRA disclosures.
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:
- Right to know what categories of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it (described above).
- Right to access a copy of the specific pieces of personal information we hold about you.
- Right to correct inaccurate personal information.
- Right to delete personal information, subject to legal exceptions.
- Right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
- Right to limit use of sensitive personal information. We do not collect sensitive personal information through this site.
- Right to non-discrimination for exercising any of these rights.
To exercise any of these rights, email privacy@covenantflow.ai. We will verify your identity using the email address on file and any reasonable additional evidence we may request. You may authorize an agent to make a request on your behalf with written permission.
Retention
How long we keep it.
- Contact-form messages: retained for up to 24 months after our last interaction, then deleted.
- Newsletter subscriber list: retained while you are subscribed. After you unsubscribe we keep your email on a suppression list to honor the unsubscribe.
- Demo booking records: retained in Cal.com under its retention policy and copied into our CRM for follow-up. Deleted on request.
- Server logs: retained for up to 90 days, then rotated.
- Aggregated analytics: retained for up to 26 months in Google Analytics.
Security & children
A few quick notes.
Security
We use TLS in transit, encrypted storage, and audit logging for production access. No system is perfectly secure, but you can read about how we approach it on the Security page.
Children's privacy
This site is for business audiences. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided information through this site, email us and we will delete it.
Updates
How changes are communicated.
We may update this policy as our practices change. The effective date at the top of this page reflects the latest version. Material changes will be highlighted at the top of the page for 30 days after they take effect. Continued use of the site after an update means you accept the revised policy.
Contact
Questions about your data?
Catalyze Labs, LLC
2100 E Grand Ave
El Segundo, CA 90245
Delaware limited liability company