Privacy policy
What Catalot collects, why we are allowed to collect it, and how long we keep it.
In force since 2 September 2026.
Catalot is a cataloguing tool. It receives photographs of objects and returns written lot notices. This policy explains, in the terms of the General Data Protection Regulation, what personal data passes through the service and what you can do about it.
Who is responsible
The controller of the processing described here is:
- Company
- Catalot EURL
- Registered office
- Paris, France
- Founded
- 2026
- Publication director
- The gérant of Catalot EURL
- Contact
- contact@catalot.pro
- Hosting
- Cloudflare, Inc. — global edge network, European region
- Governing law
- French law
What we process, and on what basis
| Data category | Purpose | Legal basis |
|---|---|---|
| Account data — email address, password hash, display name, locale, plan and monthly usage counter | Opening and running your account, authentication, applying your plan quota | Performance of the contract |
| Photographs and notices — the images you upload and the notices written from them, with your cataloguer's notes and house style | Generating, storing, editing and exporting your lot notices | Performance of the contract |
| Usage logs — generation records, model used, token counts, duration, error messages, hashed IP address | Keeping the service working, preventing abuse, diagnosing failures, measuring cost | Legitimate interest in the security and reliability of the service |
| Newsletter and enquiries — the email address, and the message you send us through a form | Sending the letter you asked for, and answering you | Consent, withdrawable at any time |
How long it is kept
| Data | Retention |
|---|---|
| Account data | For the life of the account, then three years after closure |
| Photographs and notices | Until you delete them; deletion is immediate and final |
| Usage logs | Twelve months |
| Newsletter subscriptions and enquiries | Three years from the last contact |
Your rights
Under the GDPR you have the following rights over your personal data. To exercise any of them, write to contact@catalot.pro from the address on your account. We answer within one month, and we may ask for proof of identity where a request would otherwise expose someone else's data.
01Right of access
Ask what we hold about you and receive a copy of it.
02Right to rectification
Have inaccurate data corrected and incomplete data completed, including from your settings page.
03Right to erasure
Have your account, your photographs and your notices deleted, except where the law requires us to keep an accounting record.
04Right to restriction
Ask us to freeze processing while a dispute over accuracy or lawfulness is resolved.
05Right to data portability
Receive the data you gave us in a structured, machine-readable format; your notices also export as CSV from the app at any time.
06Right to object
Object to processing based on our legitimate interest, describing your particular situation.
07Right to withdraw consent
Unsubscribe from the newsletter in one click, or ask us to stop any processing based on your consent, without affecting what came before.
08Right not to be subject to automated decisions
Catalot writes drafts, it does not make decisions about people. No processing here produces a legal or similarly significant effect on you.
How it is protected
We keep the measures proportionate to a small service holding photographs of objects rather than sensitive personal data:
- All traffic served over HTTPS.
- Photographs held in a private bucket, never publicly listable, reachable only through short-lived signed links issued to their owner.
- Row-level security on the database, so one account cannot read another's lots.
- Passwords stored only as hashes; API keys held as encrypted server-side secrets, never sent to the browser.
- Access to production data limited to the gérant and logged.
Sub-processors
Catalot uses two sub-processors. We do not sell data, and there is no advertising network involved.
| Sub-processor | What it does | Where |
|---|---|---|
| OpenAI, L.L.C. | Runs the vision and language model that writes your notices; receives the photographs and the note for the duration of the generation. Data submitted through the API is not used to train models. | United States |
| Cloudflare, Inc. | Hosts the application and serves it from the edge network, including the managed database and photograph storage. | Global edge network, European region for EU visitors |
International transfers
Generation calls to OpenAI mean a transfer of the submitted photographs and notes to the United States. That transfer is covered by the European Commission's Standard Contractual Clauses together with the supplementary measures in our processor agreement. Everything else — your account, your stored photographs, your notices — stays within the European region of our hosting provider.
Complaints
If you think we have handled your data badly, tell us first at contact@catalot.pro. You also have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.