PRIVACY POLICY

Last updated: February 11, 2026

  1. DATA CONTROLLER

    • Name: 99global
    • Product operator: 99global SASU
    • Address: 60 Rue François 1er, 75008 Paris, France
    • Email: contact@catalogr.xyz

  2. DATA COLLECTED

    Identification data

    • Email: Authentication and communication
    • User ID: Technical identifier (UUID)

    Connection data

    • IP address: Security and abuse prevention
    • User-Agent: Fraud attempt detection
    • Tokens: SHA-256 hash for magic links; encrypted Amazon SP-API refresh token when an Amazon account is connected
    • Timestamps: created_at, used_at, expires_at, last_used_at

    Usage data

    • Access status: beta access, plan and usage limits
    • Quotas: GTINs processed per period
    • Files: Uploaded XLSX and generated output files
    • Jobs: statuses, marketplaces, metrics, technical errors

    Amazon catalog analysis data

    • Barcode identifiers: EAN, UPC or GTIN values supplied by the user
    • Amazon catalog identifiers: ASINs returned by Amazon SP-API
    • Product signals: sales rank, product dimensions, Buy Box and offer signals when available
    • Estimated calculations: estimated referral fees, estimated FBA fees, estimated profit and estimated ROI for screening purposes

  3. PURPOSES

    Purpose Legal basis Data
    Authentication Contract performance Email, tokens
    Amazon account authorization Contract performance Amazon SP-API authorization tokens and connection status
    Service delivery Contract performance Files, jobs, GTINs, ASINs and generated outputs
    Usage enforcement Legitimate interest Usage limits, plan and quota data
    Security Legitimate interest IP, User-Agent, technical logs
    Support Legitimate interest Technical errors, job metadata and user-provided support details

  4. RETENTION

    Data Duration Reason
    EmailAccount lifetimeService access
    Active magic-link tokens15 minutesAuthentication security
    Amazon SP-API refresh tokenUntil disconnection, revocation or account deletionService delivery
    Uploaded files30 daysProcessing and re-download
    Generated outputs30 daysDownload and re-download
    Job metadata and technical logs12 monthsService monitoring and abuse prevention
    IP logs90 daysSecurity

    After account deletion: uploaded files and generated outputs may remain available for up to 30 days, then are permanently deleted.

  5. RECIPIENTS

    • Hosting provider: Digital Ocean (EU)
    • Email service: Mailgun (EU / USA)
    • Amazon SP-API: barcode identifiers, ASIN identifiers and related catalog or pricing requests required to provide the service

    No data resale.

    Catalogr does not access buyer personal information, buyer addresses, seller orders, advertising data, inventory data or Brand Analytics data.

  6. DATA TRANSFERS OUTSIDE THE EU

    • Some service providers may process limited technical data outside the European Union
    • Where applicable, appropriate safeguards such as Standard Contractual Clauses are used
    • Amazon SP-API requests may involve transmission of barcode identifiers, ASINs and related catalog or pricing requests

  7. YOUR RIGHTS

    • Access
    • Rectification
    • Erasure
    • Portability
    • Objection
    • Restriction

    Contact: privacy@catalogr.xyz
    Regulatory response time: up to 1 month

  8. SECURITY

    • HTTPS / TLS
    • SHA-256 hashing for magic-link tokens
    • Encrypted Amazon SP-API refresh tokens
    • Rate limiting
    • Firewall and intrusion protection
    • Encrypted backups when applicable

  9. COOKIES

    • Strictly necessary session cookie
    • Duration: browser session
    • Purpose: authentication

    No third-party analytics cookies.

  10. MINORS

    Service prohibited for users under 16 years old.

  11. COMPLAINT

    CNIL
    3 Place de Fontenoy
    75334 Paris Cedex 07
    https://www.cnil.fr/

  12. CONTACT

    DPO email: privacy@catalogr.xyz

Effective date: February 11, 2026