Retningslinjer for personvern

Last updated: October 16, 2026

This Privacy Policy explains how WebCatalog, Inc. ("we", "us") collects and uses personal data when you use our products and websites, and the choices and rights you have.

In short:

We collect what we need to run our products: your account, the content you create, purchases, support requests, and how the products are used.
We do not sell your personal data, and we do not use it for advertising.
We use service providers, including AI model providers, to run our products. They are listed on our Subprocessors page.
Our data is stored in the United States.
You can access, correct, download, or delete your data (section 9).

1. Who we are

WebCatalog, Inc. is the controller of your personal data under this policy.

WebCatalog, Inc.
1111B S Governors Ave #92887, Dover, DE 19904
United States of America
contact@webcatalog.io

Our EU and UK representatives are listed in section 14.

2. What this policy covers

This policy applies to the products, apps, browser extensions, and websites we offer that link to it (together, the "Services").

If you use the Services through an organization or workspace set up by your employer or another organization, that organization controls the data in it and decides who can see it. For that data we act as its service provider under our Data Processing Agreement, and its own privacy policy applies too.

3. Information you give us

Account. Your email address, your name, and optionally a profile picture, country, and language. If you sign in with another provider, such as Apple, Google, Microsoft, or your organization's single sign-on, we receive your name, email address, profile picture, and an account ID from that provider.

Content. What you create, upload, or submit in the Services, such as items, links, and settings, and the text, files, audio, or images you ask the Services to process. Some content syncs across your devices. Some images you upload, such as profile pictures, are stored on our content delivery network and can be opened by anyone who has the link.

Organizations and workspaces. If you join an organization or workspace, its admins and members can see your name, email address, profile picture, and role, and content added to it is visible to its members. Depending on the plan, admins can also see an activity log of changes.

Connected accounts. Some features let you connect an account you have with another service to show your own data in the Services. When you connect one:

We request only the access the feature needs, read-only where possible, and you see what is requested before you approve it.
We use the data only to provide that feature to you. We do not sell it, use it for advertising, share it with third parties except as needed to provide the feature, or use it to train AI models.
We store the credentials needed to keep the connection working, encrypted. The data itself passes through our servers when the feature loads it and may be cached on your device so the feature loads quickly; we do not keep it on our servers.
You can disconnect at any time, which deletes the stored credentials and asks the service to revoke our access. You can also revoke access from the other service's account settings.

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Purchases. Paddle sells our paid plans as our reseller and merchant of record, so it collects your payment details and billing address under its own privacy policy. We receive your email address, country, plan, and transaction details, but never your card details. If you buy through an app store, the store handles the purchase and we receive only what we need to activate your plan.

Support and feedback. When you contact support or send feedback, we receive your name, email address, your message, and any attachments, together with details about your account and devices that help us answer you (such as your plan, country, operating system, and app versions).

4. Information we collect automatically

Product usage. Our apps and extensions send us:

A device identifier, which the app creates or derives from your device's hardware ID.
Your operating system, app versions, and the country your IP address is in.
How you use the Services, such as the features you use, the items you open, and what you search for, linked to your account if you are signed in.
Error reports, which can include technical details about your device and the app.

We use this to run the Services, fix problems, and understand which features are used. For features that process your content, we record how much you use them, not the content itself.

Sign-in records. When you sign in, we store your IP address, browser or app details, and country with the session, to keep your account secure.

Websites. When you visit our websites, our hosting provider processes your IP address and browser details to deliver and protect the site. With your consent where the law requires it, we use Google Analytics to understand which pages are visited and how people find us. See our Cookie Policy.

Location. We don't collect precise location. Some features use the approximate location of your IP address, or a location you choose, for example to show local weather.

5. Information from others

Referral partners. If you arrive through a partner's referral link, the provider that runs our referral program tells us which partner referred you.
Organizations and workspaces. An admin can invite you by email or set up your account through their single sign-on.
Sign-in providers. See "Account" in section 3.

6. How we use your information and why

We only use personal data where the law allows it. Under the GDPR, these are our purposes and legal bases:

Providing the Services: your account, your content, syncing, organizations and workspaces, connected accounts, and features that process your content. Legal basis: performance of our contract with you.
Purchases and billing. Legal basis: contract, and legal obligations for tax and accounting records.
Support, including using AI to sort incoming requests by topic and urgency and to filter spam. Legal basis: contract, and our legitimate interest in answering requests quickly.
Security and abuse prevention: sign-in records, rate limits, and bot checks. Legal basis: our legitimate interest in keeping the Services and our users safe.
Understanding and improving the Services: product usage and error reports. Legal basis: our legitimate interest in knowing which features are used and fixing what's broken.
Website analytics. Legal basis: your consent where the law requires it, otherwise our legitimate interest.
Product news by email. We occasionally email account holders about our products. Every email has an unsubscribe link. Legal basis: our legitimate interest in telling customers about our products.
Our referral program. If you sign up through a partner's link, we share your name, email address, IP address, and browser details with the provider that runs our referral program so the partner can be credited and paid; the partner can see your name and email address there. On our websites, the referral cookie is only set with your consent where the law requires it. Legal basis: our legitimate interest in running the referral program, which you chose to use by following the partner's link.
Legal compliance: responding to lawful requests and enforcing our terms. Legal basis: legal obligation and our legitimate interests.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 10).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

You don't have to give us personal data, but we need your email address to create an account, and we can't process content you don't submit.

7. AI processing

Some features use AI models from third-party providers to process content you submit, for example to translate or transcribe it. We also use AI models in our own work, for example to sort support requests. The providers are listed on our Subprocessors page.

We don't use your content to train AI models, and we only use AI providers that don't train on it either. Where your plan includes zero data retention, we use it wherever our AI providers support it, so those providers don't keep the data after answering. Otherwise, AI providers may keep requests for a limited time under their own terms, for example to detect abuse.

Files you upload only to be processed, and their results, are deleted within 24 hours.

8. Who we share it with

Service providers. We use service providers for hosting, databases, storage, email, payments, support, search, analytics, error monitoring, sign-in, and AI. They process personal data on our instructions and only for the purpose we give them. The full list, including where each is located, is on our Subprocessors page.

Companies acting on their own behalf. Our payment reseller, website analytics and referral program providers, app stores, and sign-in providers use the data they receive under their own privacy policies.

Your organization or workspace, as described in section 3.

Legal and safety. When the law requires it, or to protect the rights, property, or safety of our users, the public, or us.

Business transfers. If we're involved in a merger, acquisition, or sale of assets, your data may transfer to the new owner under this policy.

We do not sell your personal data, and we do not share it for targeted advertising.

9. Your rights

Depending on where you live, you have the right to:

Access the personal data we hold about you and get a copy of it.
Correct inaccurate data. You can edit most account details in your account settings.
Delete your data. You can delete your account from your account settings at any time.
Restrict how we use your data.
Data portability: receive your data in a machine-readable format. Some of our apps let you export your data; for anything else, contact us.
Object to processing based on legitimate interests (section 10).
Withdraw consent at any time, where we rely on it. For cookies, use the cookie settings link in our websites' footers.

To exercise these rights, email contact@webcatalog.io or contact our EU or UK representative. We'll respond within one month and may need to verify your identity first.

You also have the right to lodge a complaint with a data protection authority, such as the one where you live or work. In the UK, that's the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

10. Your right to object

You can object at any time to our use of your personal data based on legitimate interests, including product analytics and product news emails. Email us and we'll stop unless we have compelling grounds that override your interests, or need the data for legal claims. To stop product news emails, use the unsubscribe link in any of them.

11. International transfers

We're based in the United States and store our data there. Our service providers may process it in other countries, as listed on our Subprocessors page.

When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to countries without an adequacy decision, including the United States, we use the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments where applicable. You can ask us for a copy.

12. How long we keep it

Your account and content: until you delete them or your account. Deleting your account removes your profile, content, and synced data from our active systems.
Content in an organization or workspace: until an admin deletes it or the organization or workspace is deleted.
Files uploaded only to be processed, and their results: up to 24 hours.
Sign-in records: until the session ends or you sign out, and no longer than 5 years.
Purchase and billing records: as long as tax and accounting law requires, even after you delete your account.
Support conversations: as long as we need them to help you and keep a record of your request, even after you delete your account.
Product usage and error data: 24 months. After that, we delete it or keep it only in a form that no longer identifies you, which we may keep indefinitely.
Backups: overwritten on a rolling schedule.

13. Children

The Services are not intended for children. You must be at least 16 to use them. If we learn that we hold personal data of someone under 16, we'll delete it. Organizations and workspaces must make sure their members meet this age requirement.

14. EU and UK representatives

If you're in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representatives under Article 27:

EU representative
Euverify Limited (Ireland)
Unit 3D North Point House, North Point Business Park
New Mallow Road, Cork, T23 AT2P
Ireland
gdpr@euverify.com

UK representative
Euverify Ltd (UK)
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom
gdpr@euverify.com

To submit an access, deletion, or other GDPR request, or to verify our representatives, use Euverify's secure portal. Requests submitted there are logged and tracked.

15. US state privacy rights

If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Texas, or Virginia, you have the right to know what personal data we process, and to access, correct, delete, and get a copy of it. Sections 3 to 8 describe the categories of personal data we collect, where it comes from, why we use it, and who we share it with.

We do not sell personal data, and we do not share it for targeted advertising or profiling with legal or similarly significant effects. Our websites honor the Global Privacy Control signal.

To make a request, email contact@webcatalog.io. If we decline your request, you can appeal by replying to our answer; we'll respond to your appeal within 60 days. We won't discriminate against you for using your rights.

16. Security

We protect your data with encryption in transit, access controls, and encrypted storage for sensitive credentials, and we review our safeguards as the Services change. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the authorities as the law requires.

17. Changes to this policy

When we make significant changes, we'll notify you before they take effect, for example by email or in the Services. The date at the top shows when this policy last changed.

18. Contact us

For privacy questions or requests:

WebCatalog, Inc.
1111B S Governors Ave #92887, Dover, DE 19904
United States of America
contact@webcatalog.io