Privacy Policy

1. Who we are

This Privacy Policy explains how CatalogKite ("we", "us") collects, uses and protects personal data when you use catalogkite.com, the maker, the dashboard, online catalogs and related apps (the "Service"). For the personal data described here, we are the data controller, except where we say a partner acts as an independent controller. Contact us at support@catalogkite.com.

2. Data we collect

Using the maker without an account

If you use the maker without signing in, the catalogs, products and images you create are stored only in your browser (IndexedDB and local storage) on your device. They are not sent to our servers. PDFs are generated in your browser.

Account data

When you create an account we collect your email address. If you sign in with Google, we receive your email address, name and profile picture URL from Google, as permitted by your Google settings. We store sign-in sessions so you stay logged in.

Your content

When you save catalogs to your account we store the content you add: catalogs and product data (names, SKUs, prices, descriptions and other fields), images you upload (compressed in your browser before upload), and brand details such as your business name, logo and the contact details you choose to show (email, phone, WhatsApp number, address, website). Contact details you add to a catalog are visible to anyone who views it once published.

Billing data

Payments are handled by Dodo Payments as merchant of record. Dodo Payments collects your payment details, billing address and tax information directly. We receive limited information from Dodo Payments: your subscription status, plan, billing interval, country, and identifiers that let us match your payment to your account. We never receive your full card number.

Usage, device and log data

When you use the Service, our infrastructure processes technical data such as IP address, browser and device type, pages requested, timestamps and error logs. We use it to run, secure and debug the Service, for example to rate-limit sign-in attempts. For published catalogs we record view counts, which appear as analytics on Pro and Business plans.

Communications

If you email us, we keep the correspondence so we can help you.

3. How we use your data

• To provide the Service: authenticate you, save and sync your catalogs, render previews and PDFs, and host your published catalogs
• To send transactional emails, such as one-time sign-in codes and important account or billing notices
• To manage subscriptions and enforce plan limits
• To keep the Service secure, prevent abuse and fraud, and fix problems
• To answer support requests
• To understand, in aggregate, how features are used so we can improve them
• To comply with legal obligations

We do not sell your personal data, and we do not use your catalogs or images to train machine-learning models.

4. Legal bases (EEA and UK users)

We process personal data to perform our contract with you (providing the Service), for our legitimate interests (security, abuse prevention, improving the Service, where these are not overridden by your interests), to comply with legal obligations (for example tax and accounting records), and with your consent where we ask for it.

5. Service providers we use

We share personal data only with providers that help us run the Service, under contracts that require them to protect it:

Dodo Payments processes payment data as an independent controller under its own privacy policy. Google's processing of your Google account is governed by Google's privacy policy. We may also disclose data if required by law, to protect our rights or users' safety, or as part of a business transfer, in which case we will tell you.

6. Cookies and local storage

We use a small number of strictly necessary cookies to keep you signed in and to protect sign-in forms. We use your browser's local storage and IndexedDB to store catalogs you create without an account and your editor preferences, and a service worker cache so the maker can load offline. We do not use advertising cookies or cross-site tracking. If we ever add optional analytics or marketing cookies, we will update this policy and ask for consent where required.

7. Published catalogs and buyer orders

Online catalogs you publish are accessible to anyone with the link (or the password, for password-protected catalogs). When a buyer sends you an order from your catalog, the order message is created in the buyer's browser and sent through WhatsApp or the buyer's email app directly to you; we do not receive the content of those messages. If you collect personal data from buyers, you are responsible for handling it lawfully.

8. How long we keep data

• Account and content: for as long as your account is active. When you delete your account, we delete your account data, catalogs and images from our live systems within 30 days, and from backups within a further 30 days.
• Billing records: kept by Dodo Payments and, where we hold them, for as long as tax and accounting laws require.
• Logs: kept for a short period for security and debugging, then deleted or aggregated.
• Support emails: kept while needed to help you and for a reasonable period afterwards.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can:

• Correct or export your catalogs at any time from the app (for example by exporting PDFs)
• Delete your account and its data from your account settings, or by emailing support@catalogkite.com
• Make any other request by emailing support@catalogkite.com from your account email address

We will respond within the time required by applicable law, usually within 30 days. You also have the right to complain to your local data protection authority.

10. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and our providers' data processing terms.

11. Security

We use encryption in transit (HTTPS), access controls, short-lived one-time sign-in codes with rate limiting, and storage that keeps each account's files separate. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

12. Children

The Service is for businesses and adults. It is not directed at children under 16, and we do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy. If changes are material, we will notify account holders by email or in the app before they take effect. The "last updated" date above shows when it last changed.

14. Contact

Questions or requests about privacy: support@catalogkite.com.