Section 1: Who We Are
CatalogBot is a Shopify application operated by ESPL ("we", "us", "our"). We are the controller of merchant account data and website enquiries. For personal data that may appear in files you upload or in your store's product data, we act as a processor on your behalf.
Section 2: Data We Collect
- Store and account data - when you install the app, Shopify shares your store name, store URL, and the store owner's name and email.
- Product data - the products and variants CatalogBot reads from or writes to your store.
- Uploaded files - the PDF and CSV catalog files you upload, which may contain supplier details, pricing, and occasionally contact names.
- Usage and technical data - credits used, import history, error logs, IP address, and browser information, used for operating and securing the Service.
- Billing data - plan and charge records. Payments are handled by Shopify; we never see your card details.
- Contact form data - the name, email, and message you send through this website.
Section 3: How We Use Data
- To provide the Service: process your files, manage credits, and sync products and variants to your store (contract);
- To manage billing, support, and service emails such as import and credit notices (contract);
- To secure the Service and prevent abuse (legitimate interests);
- To reply to enquiries sent through our contact form (legitimate interests);
- To meet legal, tax, and accounting obligations (legal obligation).
We do not use your files or store data to train AI models, and we do not use them for advertising.
Section 4: AI Processing
To extract product data, file content is sent over encrypted connections to third-party AI API providers acting as our subprocessors. They process the content only to return results to us, are contractually prohibited from using it to train their models, and keep it only as long as needed to provide their service.
Section 5: Sharing
We do not sell or rent personal data. We share data only with:
- Service providers - cloud hosting, storage, email, and AI processing providers bound by confidentiality and data protection terms;
- Shopify - as needed to operate the app and process billing;
- Authorities - when required by law or valid legal process;
- A successor business - in a merger or acquisition, subject to this Policy.
Section 6: Retention & Deletion
| Data Type | Retention |
|---|---|
| Uploaded files | Deleted within 30 days of upload |
| Store, account, product, and usage data | While the app is installed; deleted within 30 days after uninstall |
| Contact form enquiries | Deleted within 30 days after the enquiry is resolved |
| Billing records | As long as required by tax and accounting law |
You can ask us to delete your data sooner by emailing legal@catalogbot.io.
Section 7: Shopify Data & Compliance Webhooks
CatalogBot only requests access to read and write products and variants. It does not access orders, customers, or any other personal data of your shoppers.
We respond to Shopify's mandatory privacy webhooks:
- Customer data request and customer redact - we hold no shopper data, so there is nothing to return or erase; we acknowledge each request.
- Shop redact - sent by Shopify after you uninstall; we delete your store data within 30 days, keeping only billing records required by law.
Section 8: Your Rights
Depending on where you live (including under the EU and UK GDPR and California law), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to your local data protection authority. We do not sell or share personal data for cross-context advertising, and we will not treat you differently for exercising your rights.
Email legal@catalogbot.io with the subject "Privacy Request". We respond within 30 days and may need to verify your identity.
Section 9: Security & International Transfers
We protect data with encryption in transit and at rest and with access controls limited to staff who need it. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authorities as required by law.
We and our providers may process data outside your country, including in India and the United States. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Section 10: Children, Changes & Contact
CatalogBot is a business tool and is not intended for anyone under 18. We do not use advertising or cross-site tracking cookies on the app or this website.
We may update this Policy. For material changes we will give at least 30 days' notice by email or in the app.
This Privacy Policy was last updated on October 14, 2026.