Privacy policy

Last updated

2 October 2026

1. Catalog’s roles under the GDPR

Two roles

Depending on the context, Catalog acts either as a data controller or as a data processor within the meaning of the GDPR.

Controller

Catalog acts as a data controller for the management of its website, its prospects, its user accounts, its support and its legal obligations.

Processor

Catalog acts as a data processor when it processes personal data contained in emails, orders, quotes, attachments, customer data, product data or ERP systems on behalf of its B2B customers.

Company

Catalog SAS, a French simplified joint-stock company (SAS) with a share capital of €2,001,000, registered with the Bordeaux Trade and Companies Register (RCS) under number 950 871 848.

Registered office

51 Quai Lawton, 33300 Bordeaux, France.

Personal data contact

dpo@startcatalog.com.

2. Data collected

User account data

Surname, first name, business email address, hashed password, role, organisation (seller).

Connected mailboxes

Content of the connected mailboxes (Gmail, Microsoft 365 / Outlook, IMAP): incoming and outgoing messages, attachments, senders, recipients, subjects, headers, labels / categories, threads, technical identifiers.

B2B business data

Orders, quotes, products, customers, prices, ERP integrations.

Application and technical logs

IP addresses, user agent, session identifiers, execution traces, errors, performance metrics.

Cookies and browsing data

On gocatalog.ai, where applicable, managed through the cookie banner or cookie management module.

Telephone data

Where entered by your customers: normalised numbers for matching purposes.

3. Purposes and legal bases

Providing the service

Providing the Catalog service (performance of the contract): email ingestion, order extraction, classification, follow-up, sending replies, ERP integration.

Improving the service

Improving the quality of the service and the performance of the AI features configured for the service (legitimate interest or performance of the contract, depending on the context): evaluation, quality control, error detection. No customer data is used to train public or general-purpose models.

Security

Security, fraud prevention and continuity (legitimate interest and legal obligation).

Transactional communications

Transactional communications and support (performance of the contract).

Marketing communications

Marketing communications (consent only; you may unsubscribe at any time).

Audience measurement

Measuring the audience of this site and how it performs (consent only; you may withdraw it at any time): Dash0, Google Analytics 4 and the HubSpot tracking code, which links your visit to your contact record after a form is submitted. These tools run only if you accept the “audience measurement” category.

Advertising

Measuring the results of our advertising campaigns and, where applicable, showing our ads to people who have visited this site (consent only; you may withdraw it at any time): Google Ads and the LinkedIn Insight Tag, including the carry-over of the identifier of the ad click that brought you here (gclid, gbraid, wbraid, li_fat_id). These tools run only if you accept the “advertising” category.

Campaign source

Knowing which campaign a contact request comes from (legitimate interest): the campaign parameters (UTM) of the link that brought you here are carried in the address of the pages of this site, from one to the next, and recorded in our CRM with your request if you send one. Nothing is stored on your device for this.

4. Processing by artificial intelligence

Models

Catalog relies on AI models, including third-party models, to analyse the content of emails, extract orders, classify messages and generate suggested replies.

Third-party providers

Where third-party AI model providers are used, Catalog configures the services and binds its providers contractually so that customer data is not used to train public or general-purpose models.

Human oversight

No purely automated decision producing legal effects or significantly affecting a person is taken without human intervention. You keep the final say on what is sent to your ERP or to your customers.

5. Compliance with the Google API Services User Data Policy (Limited Use)

Principle

Catalog’s use of information received from Google APIs, including Gmail, complies with the Google API Services User Data Policy, and in particular with its Limited Use requirements.

In practice

We use Gmail data only to provide the features requested by the user (Smart Inbox, Smart Order, Smart Agents); we never sell this data; we do not use it for advertising; we transfer it to third parties only where strictly required to perform the service (the processors listed below); people at Catalog do not read your emails except with your explicit consent, under a legal obligation, or for security or user-support purposes.

Retention

Gmail data is kept only for as long as necessary to provide the service, in line with the retention periods set out below, and is then deleted or anonymised according to the applicable settings and contractual obligations.

6. Compliance for Microsoft Graph and IMAP

Same principles

When you connect a Microsoft 365 / Outlook or IMAP mailbox, the principles above (minimisation, no resale, no advertising, no reuse for public training) apply identically.

Tokens and revocation

Access and refresh tokens are encrypted at rest. You can revoke access at any time from your Microsoft admin console, your email provider, or the Catalog console, depending on the connection method used.

7. Processors and partners

Amazon Web Services (AWS)

Hosting, storage, databases, cache, messaging and managed AI services. Location: European Union.

MongoDB Atlas

Document database (seller settings, email metadata, logs). Location: European Union.

Google Cloud / Google Workspace APIs

Gmail / Workspace connection, push notifications, managed cloud and AI services. Location: European Union.

Microsoft Corporation

Outlook / Microsoft 365 connection, Microsoft Graph, Entra ID and configured Azure services. Location: European Union.

Microsoft Azure OpenAI

GPT models for the service’s AI features. Location: European Union.

Datadog Inc.

Application monitoring and observability. Location: European Union.

Vercel Inc.

Hosting of the front-end interfaces (seller-front, public-website). Location: European Union.

Auth0 (Okta)

Identity management and SSO. Location: European Union.

Amazon Cognito

User authentication and identity management. Location: European Union.

SendGrid (Twilio Inc.)

Sending transactional emails (notifications, accounts). Location: European Union.

HubSpot

Customer relationship management: the email address submitted through the contact form on this site, and the follow-up that results from it. If you accept the “audience measurement” category, the HubSpot tracking code also links your visit to your contact record after a form is submitted. Location: European Union.

Google Ireland Ltd (Google Analytics 4, Google Ads)

Audience measurement of this site (Google Analytics 4) and measurement of our advertising campaigns (Google Ads), only if you accept the matching categories. Location: Ireland (European Union); transfers to the United States are described in section 8.

LinkedIn Ireland Unlimited Company (Insight Tag)

Measurement of our LinkedIn advertising campaigns and, where applicable, showing our ads to the visitors of this site, only if you accept the “advertising” category. Location: Ireland (European Union); transfers to the United States are described in section 8.

Dash0

Audience measurement and monitoring of this site (page views, clicks on calls to action, errors and performance), only if you accept the “audience measurement” category. Location: European Union.

8. Data location

Preference

Catalog favours hosting and processing data within the European Union or the European Economic Area.

Contractual commitments

Where the contractual commitments made to a customer provide for hosting or processing exclusively within the European Economic Area, those specific commitments prevail for the customer concerned.

Transfers outside the EEA

Should a transfer outside the European Economic Area become necessary, Catalog would ensure that it relies on a GDPR-compliant transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or any other appropriate safeguard.

Transfers to the United States

For the audience measurement and advertising tools of this site that you accept, data may be transferred to Google LLC and LinkedIn Corporation in the United States. These transfers rely on the EU-U.S. Data Privacy Framework and on the European Commission’s Standard Contractual Clauses. They concern the visitors of this site only, not the data of the service’s customers.

9. Retention periods

Account data

For the whole duration of the contractual relationship, then 3 years for evidentiary purposes.

Connected emails and attachments

For as long as necessary to provide the service, then deletion within a reasonable time after termination, disconnection of the mailbox or an applicable request, unless a legal or contractual obligation provides otherwise.

Archived attachments

Attachments archived on S3 for the purposes of Smart Order extraction: for as long as necessary to provide the service, according to the settings applicable to the customer.

Technical logs

Limited to the needs of monitoring, security, diagnostics and service continuity, according to the settings applicable to the systems concerned.

BigQuery analytics data

13 months by default, configurable.

Accounting data and invoices

10 years (legal obligation).

Contact form addresses and CRM follow-up

Three years from the last contact with you, the criterion used for a prospect who does not become a customer. Erased sooner on request, and at any time through the rights described below.

Google Analytics 4 data (visitors of this site)

14 months.

Google Analytics cookies

_ga and _ga_*: 13 months.

Google Ads cookies

_gcl_*: 90 days.

LinkedIn cookie

li_fat_id: 30 days.

HubSpot cookie

hubspotutk: 6 months.

Dash0 storage

d0_session: 3 hours without activity, 6 hours at most. d0_tab: until the tab is closed.

10. Security

Measures

We implement appropriate technical and organisational measures: TLS encryption in transit, encryption at rest for OAuth tokens and secrets, strict isolation of environments and data per customer, role-based access control, logging and alerting, code reviews, automated tests and continuous monitoring.

Google security assessments

Catalog prepares or undergoes the security assessments required by Google for the use of restricted Gmail scopes, where those scopes are necessary to the service.

11. Your rights

Access, rectification, erasure

Access to, rectification and erasure of your personal data.

Restriction and objection

Restriction of and objection to processing.

Portability

Portability of your data.

Withdrawal of consent

Withdrawal of consent at any time, without retroactive effect.

Post-mortem directives

Setting directives on the fate of your data after your death.

Complaint

Lodging a complaint with the CNIL (cnil.fr).

12. Cookies

Consent module

When the site first loads, a consent module asks you to accept or refuse three categories of cookies: strictly necessary (locked; it only stores your choice), audience measurement (Dash0, Google Analytics, HubSpot), and advertising (Google Ads, LinkedIn). Refusing is as simple as accepting, and you can change your mind at any time from the “Cookies” page, accessible from the footer.

Detailed list

The detailed list of the cookies and storage technologies set, their origin and their retention period is published on that “Cookies” page.

13. Changes

Updates

We may update this policy to reflect legal, technical or business developments. The date of the last update appears at the top of the page. For substantial changes, we will notify you by email or through the application.