Privacy Policy

Catalog Mind ("we", "us", or "our") operates the Catalog Mind platform, accessible at this website (the "Service"). This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what rights you have over your data.

By creating an account or using the Service, you agree to the collection and use of your information in accordance with this policy. If you do not agree, please do not use the Service.

Questions? Contact us at team@catalogmind.com.

Account information. When you register, we collect your full name, business name, and email address. These are used to create and manage your account.

Payment information. Billing is handled by Stripe. We do not store your card number, CVV, or full payment credentials. We receive a tokenised reference and your billing address from Stripe for invoicing purposes.

Product data you upload. When you upload product images, CSV files, or other catalog data, we store that data in your account to provide the enrichment service. This includes images, titles, descriptions, and any attributes you supply.

Connected system data. If you connect an ecommerce platform, point-of-sale system, database, product information system, API, file-based data source, or other supported third-party system to Catalog Mind, we collect information necessary to establish and operate that connection. This may include system or store identifiers, URLs or host information, connection configuration, and authorization credentials such as access tokens, API keys, secrets, certificates, or database credentials. We also collect the product and catalog information that you select, configure, or authorize Catalog Mind to access through the connection. Depending on the system, this may include product identifiers, SKUs, titles, descriptions, images, categories, tags, attributes, variations, metadata, inventory-related catalog fields, and other product information. Catalog Mind is designed to access only information necessary for the integration functionality you enable. You should not configure a connection to provide Catalog Mind with customer, employee, payment, transaction, or other personal information unless that information is required for a feature we expressly support and disclose to you.

Usage data. We log service activity including the number of enrichment requests made, enrichment status, and timestamps. This data is tied to your account and used for billing, quota management, and improving the service.

Technical data. We collect standard server logs including IP addresses, browser type, operating system, referring URLs, and pages visited. This information is used for security, diagnostics, and aggregate analytics.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process your enrichment requests and deliver results
• Calculate usage, apply billing, and manage your subscription
• Send transactional emails (account confirmation, password reset, billing receipts)
• Respond to support requests sent to our support email
• Detect and prevent fraud, abuse, or security incidents
• Improve the Service based on aggregate, anonymised usage patterns
• Comply with legal obligations

We do not use your uploaded, imported, transmited, or otherwise made available through the Service or a Connected System product images or catalog data to train AI models. Your data is used solely to generate enrichment output for your account.

We use Connected System data to:

• Establish and maintain connections you authorize
• Import and synchronize product and catalog information
• Perform product enrichment and related catalog processing
• Create or update information in a Connected System when you instruct us to do so or enable synchronization functionality
• Maintain mappings between Catalog Mind records and records in Connected Systems
• Troubleshoot, secure, monitor, and maintain integrations
• Provide support for integration functionality

We use Connected System credentials and imported data only as necessary to provide, secure, maintain, and support the integration functionality you have enabled, and not to access unrelated information from the Connected System.

Your data is stored in Supabase, a managed database platform with row-level security (RLS) enforced at the database layer. Each account's data is logically isolated — no account can read another account's data.

Product images are stored in secure cloud object storage. Images uploaded for enrichment are processed transiently by our AI pipeline and are not retained after the enrichment job completes, unless you have explicitly stored them as part of your product catalog.

We implement appropriate technical and organizational measures to protect your data against unauthorised access, loss, or disclosure. All data is transmitted over HTTPS/TLS. However, no system is completely immune to attack, and we cannot guarantee absolute security.

Credentials and authorization information for Connected Systems are protected using encryption at rest and appropriate technical and organizational access controls. Stored secret credentials are not returned to the client application after they have been securely saved. Access is limited to authorized systems and personnel where necessary to operate, secure, maintain, or troubleshoot the integration. Where possible, Catalog Mind encourages the use of scoped credentials, service accounts, read-only permissions, and other access controls that limit a connection to the minimum information and operations required.

We work with the following sub-processors to deliver the Service:

• Supabase — database, authentication, and file storage. Data is hosted in a SOC 2-certified environment.
• Stripe — payment processing. Stripe is PCI DSS Level 1 certified. We do not store raw card data.
• AI inference providers — we send product images and metadata to AI models to generate enriched catalog content. Requests do not include your personal account information. We use providers whose terms prohibit using API inputs for model training.
• Your connected systems — If you connect a third-party platform or data source, Catalog Mind communicates with that system using the authorization and configuration you provide in order to perform the integration functionality you enable. Connected Systems are selected and controlled by you and are separate from the infrastructure providers and subprocessors Catalog Mind uses to operate the Service. We do not sell Connected System credentials or use them for advertising or unrelated purposes. Credentials and connected data may be processed by infrastructure providers acting on our behalf where necessary to securely operate the Service.

We do not sell your data to third parties. We do not share your data with advertisers.

We retain your account data for as long as your account is active. If you cancel your subscription, your account and data remain accessible for 30 days, after which they are scheduled for deletion.

You may request immediate deletion of your account and associated data at any time by emailing team@catalogmind.com. We will process deletion requests within 14 business days.

Aggregate, anonymised usage statistics (which contain no personal data) may be retained indefinitely for service improvement purposes.

Connection credentials and configuration are retained only for as long as necessary to maintain the connection or provide the integration functionality you have enabled. When you disconnect a Connected System, Catalog Mind disables or deletes active connection credentials in accordance with our retention and security procedures. Residual encrypted copies may remain temporarily in secure backups until those backups expire or are overwritten under our normal retention procedures. Disconnecting Catalog Mind does not necessarily revoke credentials or permissions maintained by the Connected System. Where applicable, you should also revoke the relevant API key, token, service account, database user, or other authorization through the third-party system. Product and catalog data imported from Connected Systems is retained according to the same account and catalog retention practices that apply to other product information stored in Catalog Mind.

Depending on your location, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Request correction of inaccurate or incomplete data.
• Erasure. Request deletion of your personal data (subject to legal retention obligations).
• Portability. Request your data in a structured, machine-readable format.
• Objection / Restriction. Object to or request restriction of certain processing activities.
• Withdraw consent. Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at team@catalogmind.com. We will respond within 30 days.

We use essential cookies to maintain your login session and preferences. We do not use third-party advertising cookies. For full details, see our Cookie Policy.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

For privacy-related questions, data requests, or concerns, contact us at: