Privacy Policy
This Privacy Policy explains what personal data catlg handles, why, who sees it, how long we keep it, and the choices you have. We have tried to write it in plain language. A short summary first:
- You sign in with Google. We store your name, email and profile photo link, and what you upload.
- Your files and data are hosted in the European Union. We never sell data, show ads or run analytics trackers.
- A small amount of text (and, for scanned PDFs, page images) is sent to an AI provider to read unclear columns and pages. See section 6.
- You can delete any catalogue, or your whole account, yourself in the app.
1. Who we are
catlg is operated by PULSE360 LTD (trading as MyPulse360; "catlg", "we", "us"), a company registered in England and Wales (company no. 14255560), of 62 Staines Road East, Sunbury-on-Thames, TW16 5BB, United Kingdom. See our Legal Notice. We have not appointed a Data Protection Officer, as we are not required to; privacy questions go to business@mypulse360.com.
This Policy is written to meet the UK GDPR, the EU GDPR and US state privacy laws (such as the CCPA/CPRA) at once. Where they differ, we apply whichever gives you the stronger right.
2. Two roles: your account and the data in your files
catlg is a tool for cleaning supplier catalogues. That gives us two kinds of data, and our role differs for each:
- Account data (yours): we are the controller and this Policy applies directly.
- Data inside the files you upload (supplier catalogues, price lists, photos): you decide why and how it is used. We handle it only to run catlg for you.
Catalogues normally contain business data (products, prices) rather than personal data. If a file does contain personal data, you are responsible for having the right to process it. Please do not upload sensitive personal data.
3. Information we collect and where it comes from
| Data | Source | Details |
|---|---|---|
| Account data | Google Sign-In (Firebase Authentication) | Name, email address, profile photo link and a unique user ID. We never see your Google password. |
| Uploaded files | You | Supplier catalogues (Excel, CSV, PDF) and photos (including those found at image URLs in your files, which our server downloads). |
| Derived data | Generated by catlg | Extracted product rows, column mappings, cleaned values, issue flags, duplicate groups, resized photos with thumbnails, perceptual hashes and image embeddings. |
| Supplier profiles | Generated by catlg | The column mapping you confirmed for a file layout, so the next file from that supplier is mapped automatically. |
| AI usage ledger | Generated by catlg | Monthly count and cost of AI calls per user, to enforce the budget cap. |
| Feedback | You | The message you send and the page you were on. |
| Technical data | Hosting | IP address, user agent and request URL in server logs for operation, security and debugging. |
We do not collect precise location, contacts, payment details or biometric data, and we do not use analytics or advertising trackers (see our Cookie Policy).
4. Why we use it, our legal basis, and how long we keep it
| Purpose | Legal basis | Retention |
|---|---|---|
| Run catlg: sign you in, process your files, store results, produce exports | Contract (our Terms) | Until you delete the catalogue or your account. |
| Security, abuse prevention and debugging | Legitimate interests | Server logs: up to 30 days. |
| Enforce the AI budget | Legitimate interests | Until you delete your account. |
| Respond to feedback | Consent (given by sending it) | Until you delete your account. |
We do not make automated decisions with legal or similarly significant effects. Flags and duplicate suggestions are shown to you, and you decide.
5. What others can see
Nothing in catlg is public. Your catalogues, products and results are visible only to you. Photos are served from private, unguessable web addresses so that your shop can download them during import; anyone who has such an address can view that photo. Our staff access data only when needed to run, secure or fix the service, or when you ask for support, and are bound by confidentiality.
6. How we share information, and our sub-processors
We do not sell personal information, do not use it for advertising, and do not share it for cross-context behavioural advertising. We use these providers (sub-processors) to run catlg, each bound by data-protection terms:
- Google (Firebase Authentication): Google Sign-In. Global; may process outside the EU.
- Google Cloud: hosting (Cloud Run), file storage (Cloud Storage), secrets and server logs. EU region.
- MongoDB Atlas: database. EU region.
- OpenRouter and the model provider it routes to: used only when rules cannot read something. What may be sent: (a) column headers with a few sample values when columns are unclear and the supplier is new; (b) images of scanned PDF pages; (c) product names, brands, categories and short descriptions only if you press "Tidy with AI". Photos are never sent to AI. These providers may process data outside the EU/UK. If no key is configured or your monthly budget is reached, no AI call is made.
We will update this list before adding a new sub-processor. We may also disclose information if required by law, or to protect the rights, property or safety of catlg, our users or the public.
7. International transfers
Your files and data are stored and processed in the European Union. Some providers (for example Google, for sign-in, and the AI providers above) may process limited data in other countries, including the United States. Where that involves a transfer out of the UK or EEA, we rely on the provider's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, or an adequacy decision where one applies. If you use catlg from outside the EU, your data is transferred to the EU to be stored.
8. Security
We protect data with encryption in transit (HTTPS), encryption at rest provided by our hosting and database providers, sign-in tokens verified on every request, strict separation between users (you can only access your own data), restricted staff access, and neutralised spreadsheet formulas in exports. No system is perfectly secure. If a personal-data breach affects you, we will notify you and the relevant authorities as the law requires.
9. Deleting your data
You can delete a catalogue at any time. To delete your account and everything you own, go to Account → Delete my data; this erases your catalogues, products, photos, supplier profiles, AI usage ledger and account record immediately, with no waiting period. You can download your catalogues as export files first. If you can no longer sign in, email us from the address on your account and we will delete it for you. Server logs expire automatically after 30 days.
10. Your rights
Depending on where you live, you may have the right to: be informed (this Policy); access your data; correct it; delete it; restrict or object to processing; data portability; and withdraw consent at any time. You can make a request by emailing business@mypulse360.com; we will respond within one month (or the period your law sets), and we may need to verify your identity. We do not charge a fee unless a request is clearly unfounded or excessive.
California and other US states: you may have the right to know, delete, correct and limit use of your personal information, and not to be discriminated against for exercising these rights. We do not "sell" or "share" personal information as those terms are defined, so there is nothing to opt out of. We do not respond to "Do Not Track" signals because we do not track you across sites.
Complaints: if you are in the UK or EEA you may complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve it first. You can also revoke catlg's access from your Google account's Security settings.
11. Children
catlg is a business tool for adults; you must be at least 18 to create an account. We do not knowingly create accounts for, or collect personal data from, children. We use your data only to provide catlg: we never use it for advertising, profiling, selling, or building marketing profiles, and catlg does not use it to train AI models. United States: catlg is not directed to children under 13. If you believe a child has created an account, email us and we will delete it.
12. Cookies and local storage
catlg does not use advertising or analytics cookies. It uses browser storage to keep you signed in, remember your theme and make the app load quickly. See our Cookie Policy.
13. Beta service
catlg is currently in beta. Features and this Policy may change as the service develops.
14. Changes to this Policy
We may update this Policy. We will tell you about material changes in the app or by email before they take effect. The "Updated" date above shows the current version; we keep prior versions on request.
15. Contact
Questions or requests? Email business@mypulse360.com, or write to:
PULSE360 LTD (trading as MyPulse360)62 Staines Road East
Sunbury-on-Thames, TW16 5BB
United Kingdom
Company no. 14255560 · business@mypulse360.com