What we keep, and why.
Catlist keeps what it needs to run your batches and bill them, and nothing for anyone else. No analytics, no trackers, no advertising, one sign-in cookie.
Questions about your data: [email protected].
Last updated 28 October 2026.
What we keep
An access request
Your name, email, company, store address, rough product count, platform and anything you wrote, plus your IP address and browser name so we can stop automated spam.
Kept until we delete itYour account
Your email, name and company. Your password is stored only as a slow one-way hash : nobody here can read it. The credit history records who ran which batch.
Kept while the account existsYour batch
The links, sheet columns (prices, SKUs, barcodes, notes) and sheets you upload, and the products made from them with your edits, so a restart does not lose your work.
Replaced when you start a new listSign-in attempts and logs
The IP address of a failed sign-in, counted in memory for 15 minutes to lock out password guessing, and written to the server log with errors and batch progress.
Logs kept by our host for a limited timeWho helps us run it
Like most web apps, Catlist works with a few trusted providers. Each gets only what its part of a batch needs, never your password or your account details, and each is bound by its own data-protection terms.
| Provider | What for | What it receives |
|---|---|---|
| Cloud hosting | Runs the app and keeps its database | Everything listed above |
| Web access | Opens supplier pages that refuse an ordinary visit | The supplier link |
| AI services | Write the product copy, check photos and redraw the ones you ask for | The supplier page's text, product photos, the product's title and your column values for it |
| Image services | Host the finished photos and put products on white | Product photos |
Some of these providers process data outside your country. For the current list of providers, email [email protected].
Cookies and your browser
- One cookie, to keep you signed in for 30 days. It is only set when you sign in, cannot be read by page scripts, and is never shared.
- Your theme choice (dark or light) is remembered in your own browser, not sent to us.
Your choices
You can ask what we hold about you, have it corrected, or have your account and everything in it deleted. Email [email protected], or reply to any email from us. A person does it by hand, usually within a few days, and tells you when it is done.
Supplier photos and copy remain the supplier's: what you are allowed to publish is between you and them.