Privacy Policy

Katapult Media, Inc. ("Company," "we," "us," or "our") operates Klimb, a white-label platform that lets creators build and sell online courses under their own brand (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use Klimb — whether you are a creator running an academy or a learner enrolled in one.

Please read this policy carefully. By using Klimb, you consent to the practices described here. If you do not agree, please do not use the Service.

1. Information We Collect

Account Information

• Creators: Name, email, password (hashed), academy name, and branding settings.
• Learners: Name, email, and password (hashed) for the academy you enroll in.
• Payment Information: Payments are processed by Stripe. We do not store card numbers on our servers.

Course & Academy Content

To provide the Service, we store the content creators upload and configure:

• Courses & Lessons: Titles, descriptions, pricing, and lesson content.
• Video: Uploaded video is processed and delivered over signed, expiring URLs.
• Branding: Logos, colors, fonts, theme selection, and custom-domain settings.

Enrollment & Progress Data

• Entitlements: Which courses a learner has purchased or been granted access to.
• Progress: Lessons completed and playback position so learners can resume.

Usage Data

• Device & Log Data: Browser type, operating system, IP address, access times, and pages viewed.
• Cookies: Used to keep you signed in, remember preferences, and analyze usage.

2. Creators as Data Controllers

When a learner enrolls in an academy, the creator who runs that academy is the controller of the learner's account and enrollment data, and Klimb acts as a processor on the creator's behalf. Each academy is logically isolated — one creator cannot access another creator's learners, content, or revenue. Learners should review the privacy practices of the specific academy they join in addition to this policy.

3. How We Use Your Information

• Provide the Service: Host academies, stream lessons, process enrollments, and track progress.
• Process Payments: Facilitate checkout and payouts through Stripe Connect.
• Communicate: Send transactional email (verification, receipts, enrollment confirmations).
• Improve the Service: Analyze usage, fix bugs, and develop new features.
• Security: Detect and prevent fraud, abuse, and unauthorized access.

We do not sell your personal data.

4. How We Share Information

Service Providers

• Stripe: Payment processing and payouts (Stripe Connect).
• Cloud Hosting & Storage: Infrastructure and video storage/delivery.
• Email: Transactional email delivery.
• Analytics: Aggregate usage analysis.

Between Creators and Their Learners

Creators can see the learners enrolled in their academy, including name, email, enrollment, and progress, in order to deliver and support their courses.

Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect our rights and the safety of others. Where lawful, we will attempt to notify affected users.

Business Transfers

In a merger, acquisition, or sale of assets, information may be transferred to the acquiring entity.

5. Data Security

• Encryption in Transit: All traffic is served over TLS/HTTPS, including custom domains.
• Password Security: Passwords are hashed and never stored in plain text.
• Tenant Isolation: Each academy's data is isolated from every other academy.
• Access Controls: Employee access to data is limited and logged.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights & Controls

• Access & Correction: View and update your information in account settings.
• Deletion: Request deletion of your account and associated data.
• Export: Export your academy and learner data in a portable format.
• Marketing Opt-Out: Unsubscribe from marketing email at any time.

To exercise these rights, contact legal@katapultmedia.com. We respond within 30 days.

7. Data Retention

• Account & Content: Retained until you delete your academy or account.
• Transaction Records: Retained as required for tax and legal compliance.
• Backups: May persist for a limited period after deletion.

8. Children's Privacy

Klimb is intended for creators 18 and older. Some academies may serve younger learners; in those cases the creator is responsible for obtaining any required parental consent and complying with applicable laws (e.g. COPPA). We do not knowingly collect data directly from children without the operating creator's lawful basis.

9. International Users

Klimb is operated from the United States. If you access the Service from outside the U.S., your information may be transferred to and processed in the United States. EEA and California residents have additional rights (GDPR / CCPA), including access, deletion, portability, and the right to object to processing.

10. Changes to This Policy

We may update this policy from time to time. We will update the "Effective Date," post the new policy, and notify you of material changes. Continued use after changes constitutes acceptance.

11. Contact Us