1. Information we collect

• Account details you give us: your name, e-mail address, password (stored only as a one-way hash), office and mobile phone numbers, and your language and display settings.
• Company details: company name, address, city and country, website, description, business type, logo and photos; the team members you invite (name and e-mail address); and, if you apply for a verification badge, your tax ID and the document you upload.
• Listings and catalogs: the listings you create — titles, descriptions, categories, brands, grades, quantities, prices, photos and hashtags — and the catalogs and PDF catalogs made from them.
• Channels: the channels you save to share to — their name, type and what you type in them, such as a WhatsApp group name, a contact’s phone number or a social network username. You enter these yourself; Catalog10 does not read your phone’s contacts or address book.
• Text for AI listing creation: when you paste a message to create listings with AI, we send the text to our AI provider and keep the text and the results with your account.
• Phone verification: when you verify your mobile number, we send a code by WhatsApp or SMS and store it to check the code you enter. Before an SMS code is sent, a security check (Cloudflare Turnstile) runs in your browser.
• Messages to Catalog10’s WhatsApp number: when the number verified on a Catalog10 account writes to Catalog10’s WhatsApp number, we keep the text with that account. For every message, from any number, we log the number, the time and the kind of message (a sign-in code, a text, a file or other) — without its text — for 7 days, to limit how often we reply. We don’t store the text of messages from other numbers, and we never download files sent to us.
• Sign in with WhatsApp: the sign-in page gives you a code to send from your WhatsApp to Catalog10’s number. The code lasts 10 minutes and is kept only in temporary storage. When it arrives, we match the number it came from to the account where that number is verified and sign you in. In a web browser, that session lasts up to 7 days and cannot change your profile, your company, your team or your plan, or delete your account; for that, sign in with your password. If no account has the number, the sign-up form opens with the number and your WhatsApp profile name filled in, and the number counts as verified once you verify your e-mail address. A signed-in user can link their WhatsApp number to their account the same way.
• Sign in with Google: if you choose “Continue with Google”, Google sends us your name, e-mail address and Google account ID, and confirms that the e-mail address is verified. We use them to sign you in or create your account, and keep the Google account ID with your account so you can sign in with Google again. We don’t receive your Google password or anything else from your Google account.
• Connected WhatsApp Business numbers: when a business connects its WhatsApp Business number, we receive the messages its customers send to it — see section 6.
• Support and payments: the support requests you send us; your plan and payments, and the customer and subscription IDs Stripe gives us. Card details are handled by Stripe and never reach Catalog10.
• Activity on shared links and listings: see section 2.
• Technical data: the IP address and browser information sent with each request, a random identifier stored in your browser (see section 7), and server logs, which include IP addresses, kept for security and troubleshooting.

2. Activity on shared links and listings

When a business shares a catalog or listing through Catalog10, the link belongs to that share — and so to the channel it was shared to, which may be a group or a single person. When someone opens such a link or browses listings, we record:

• which link was opened, which listings were viewed, and when;
• whether it is a first or a repeat visit, using a random identifier stored in the visitor’s browser and the visitor’s IP address;
• taps on “inquire via WhatsApp” — these open a WhatsApp chat with the business; the conversation happens in WhatsApp and Catalog10 does not see it — and on contact buttons;
• the visitor’s Catalog10 account, if they are signed in.

These records are not anonymous: they are tied to the link — and through it to the person or group it was shared to — and they include IP addresses.

3. What the sending business sees

• For each share and channel, businesses see counts — visits, repeat visits, responses (taps on “inquire via WhatsApp”), listings viewed and contact clicks — by day. They do not see visitors’ IP addresses or browser identifiers.
• When a link was shared to a single person, these counts show the activity on that person’s link.
• Forwarded links: activity is counted under the link that was opened. If a recipient forwards their link, whatever is done through it afterwards is counted under the original recipient’s link; the counts do not show that the original recipient personally did it.
• When a signed-in user contacts a listing, the business that posted it receives the user’s name and WhatsApp number so that it can reply.

4. How we use information

• to run Catalog10: accounts, listings, catalogs, sharing, the Trading Floor and the statistics described above;
• to show businesses the messages customers send to the WhatsApp Business numbers they connect, labeled by topic and urgency (section 6);
• to verify phone numbers and keep accounts secure: verification codes, sign-in, security checks and limits against abuse and spam;
• to send you messages: security messages (verification codes, new sign-ins, password changes) always; notifications such as new requests on your listings, by WhatsApp or e-mail according to your settings; and news only if you turn it on;
• to answer support requests, process payments and keep billing records;
• to understand and improve how Catalog10 is used, including anonymous market statistics — category, brand, grade, price, quantity, country and dates of listings — that do not identify anyone;
• to comply with the law and enforce our Terms.

5. Who receives information

• Other users and visitors: your company profile and listings are shown on Catalog10 and to people who open your links, unless you make your company private; members of the same company account see its data; and businesses receive what section 3 describes.
• Service providers that run parts of Catalog10 for us: DigitalOcean (servers and database), Cloudflare (photo storage and delivery, and the security check before SMS codes), Meta (WhatsApp messages from Catalog10’s number and from the WhatsApp Business numbers businesses connect), Telnyx and Brevo (SMS codes and e-mail), Zoho (e-mail), Stripe (payments), OpenAI (reading pasted text for AI listing creation, and as a backup for labeling WhatsApp messages), and Anthropic and Google (labeling the messages businesses receive on their connected WhatsApp numbers — section 6).
• Services your browser contacts directly while you use Catalog10, which receive your IP address and standard browser information: ipify (looks up your public IP address), Google Fonts (fonts on our website), flagcdn.com (country flags), Cloudflare (photos and the security check) and Google (the “Continue with Google” button on the sign-in and sign-up pages).
• Authorities and others, when the law requires it or to protect the rights and safety of our users, the public or Catalog10.
• We do not sell personal information to third parties.

6. WhatsApp Business numbers that businesses connect

A business can connect its WhatsApp Business number to Catalog10 through Meta’s Embedded Signup. Catalog10 then receives, through Meta, the messages people send to that number and handles them on that business’s behalf, only to provide this service to it. We process:

• about the connection: the IDs of the WhatsApp Business account and of the phone number, the number and its business name, and the access token Meta issues to Catalog10 for them, stored encrypted;
• about each conversation: the customer’s WhatsApp number and profile name, when they last wrote and when the business last replied;
• about each message: when it was sent, whether it came from the customer or is the business’s reply, and its type (text, image, …); for customers’ messages, a topic — such as price inquiry, order or complaint — and whether it is urgent;
• the text of customers’ messages: to label a message, we send its text to our AI provider, Anthropic, and — when that answer is unsure or fails — to Google, with OpenAI as a backup, up to the daily number of labels in the business’s plan; past that number, the text isn’t sent. We keep the text of customers’ messages for 72 hours, so the business can read and sort them, then delete it. We don’t store the text of the replies the business sends from its WhatsApp app; replies sent from Catalog10 (when the owner switches this on) are kept for 72 hours like customers’ messages, with the name of the user who sent them. We never download files or media.

We use these messages only to provide this service to the business that connected the number. We don’t use them to build profiles of the people who write, combine them across businesses, sell them, use them for advertising or use them to train AI models. Our AI providers process the text only to return the label, under the terms of their paid API services, which don’t allow them to train their models on it.

The business’s users see its conversations on the Messages page. The business decides how to answer its customers and is responsible for its relationship with them.

If you wrote to a business and want your messages deleted, ask that business, or write to us (section 9).

7. Cookies, browser storage and tracking

Catalog10 uses a few cookies and browser storage items, listed below. We do not use advertising cookies, third-party analytics tools (such as Google Analytics) or tracking pixels.

• Sign-in (cookie “auth_token”, and a sign-in token and basic profile in local storage): keep you signed in.
• Preferences (cookie “i18next” on our website; local storage in the app): remember your language, theme, number and date format, table layouts and the catalog links you opened recently.
• Browser identifier (“d-c-b-etag” in local storage): a random value Catalog10 gives your browser. It is sent with your requests and, together with your IP address, used to tell first from repeat visits on shared links and listings (sections 2 and 3).
• IP lookup (“agent_ip” in local storage): the app asks ipify for your public IP address and keeps it for up to 4 hours; it is sent to Catalog10 and stored with link and listing activity.
• Security check: Cloudflare Turnstile runs only when you ask for an SMS code and uses browser and device signals to tell people from bots.

Clearing your browser’s data for catalog10.com deletes these items: you are signed out and a new identifier is created on your next visit.

8. How long we keep information

• We keep account, company, listing, channel and link-activity information while the account exists, unless you delete it sooner.
• When an account is deleted, it is erased 30 days later, except billing records kept for as long as the law requires (with the anonymised company and user records they refer to) and anonymous market statistics.
• Activity recorded on a business’s links is erased together with that business’s account. Activity a person generated on other businesses’ links stays part of those businesses’ statistics.
• Connected WhatsApp numbers: customers’ message texts are deleted 72 hours after they arrive. Conversations and labels are kept while the account exists, unless the business deletes them when it disconnects the number. Disconnecting a number deletes its access token, and Catalog10 stops receiving its messages.
• The log of messages to Catalog10’s WhatsApp number (number, time and kind, without text) is deleted after 7 days.
• Server logs are overwritten as new logs are written.

9. Your choices and rights

• See and update your details in Settings and in your company profile.
• Choose which notifications you receive, and how, in Settings → Notifications; security messages are always sent.
• Reply STOP (or PARAR / BAJA) to Catalog10’s WhatsApp number to turn off WhatsApp notifications; security messages can still be sent. News e-mails have a one-click unsubscribe link.
• Make your company private to hide it and its listings from the Trading Floor; your shared links keep working.
• Delete your account at any time — see our Data deletion page.
• Ask us for a copy of your information, or to correct or delete it, at [email protected]. Depending on where you live, local law may give you further rights.
• If you opened a link a business shared with you and want your activity deleted, write to [email protected] with the link and roughly when you opened it. You can also contact the business that shared it.
• If you wrote to a business’s WhatsApp number that the business connected to Catalog10 and want your messages deleted, ask that business, or write to [email protected] with the business’s name and your WhatsApp number.

10. Security

We protect information with measures such as encrypted connections (HTTPS), passwords stored only as one-way hashes, access tokens for connected WhatsApp Business numbers stored encrypted, checks that the WhatsApp messages and updates sent to our servers really come from Meta, and limits and security checks against abuse. No system is completely secure.

11. International processing

Catalog10 and its service providers may store and process information in countries other than yours.

12. Changes to this policy

We may update this policy. The current version is always on this page, with the date it was last updated.

13. Contact

Electrox LLC, which owns and operates the Catalog10 brand, is responsible for your information. Privacy questions and requests: [email protected].