Privacy Policy — Catalogist

Last updated: 24 June 2026

This Privacy Policy explains how Iscovici Labs – by Ori Iscovici (“Catalogist,” “we,” “us”) collects, uses, stores, and shares information when you install and use the Catalogist – Bulk Product Editor application (the “App”) on your Shopify store. By installing or using the App, you agree to this Policy. Where we process personal data on your behalf as a processor, the Data Processing Agreement also applies.

1. The short version

• Catalogist is a catalog-editing tool. It accesses and edits your products, variants, inventory, and locations — nothing else.
• Catalogist does not access, request, store, or process your customers’ personal data or your orders. We hold no customer/order Shopify scopes.
• We store only what’s needed to operate the App: your store domain and plan, the access token Shopify issues us, and a history of the edits you make (so you can undo them).
• We use a small number of infrastructure providers (§6) and do not sell or rent your data or use it for advertising.

2. Who this Policy covers

This Policy covers you, the merchant (the store owner and staff who use the App). It is separate from your own privacy obligations to your customers — see §9. We provide the same privacy rights to all users regardless of where you are located.

3. What we access, and what we deliberately don’t

Catalogist requests only these Shopify access scopes:

We do not request — and therefore cannot access — customer records, order data, payment data, fulfillment data, or any protected customer data. This is a deliberate design boundary.

4. What we store, and why

This history and snapshot data is your catalog data (titles, prices, inventory numbers, tags, etc.) — not end-customer personal data. We do not collect device fingerprints, advertising identifiers, or browsing data outside the App.

5. How we use information

We use the data above only to: (1) provide the App’s features (bulk editing, preview, History, undo, catalog health scanning, and AI-assisted drafting); (2) apply your plan and process billing through Shopify (we never see or store card details — Shopify handles payment); (3) operate, secure, debug, and improve the App; (4) communicate with you about support you request; and (5) comply with legal obligations. We do not use your data for advertising or for any purpose unrelated to operating the App.

AI-assisted drafting. When you choose “Fix with AI,” Catalogist sends the relevant product data for the products you select (title, vendor, product type, tags, and current description or SEO) to our AI provider, Anthropic, to draft product copy. We send only product and catalog data — never your customers’ personal data or your order data (the App holds none of it). Anthropic processes this data solely to return the draft and, under its commercial terms, does not use it to train its models by default — a default we do not change. Anthropic’s security and privacy documentation is available at trust.anthropic.com. You review every draft before anything is applied, and every applied change is reversible. AI drafting is optional and metered by credits.

Legal bases (where the GDPR / UK GDPR applies)

Where you are a natural person (e.g. a sole trader), your store domain, access token, and related data may be personal data. We process it on these bases:

• Performance of a contract (Art. 6(1)(b)) — store identifier, access token, edit history, undo snapshots, and operational metadata necessary to provide the App you installed.
• Legitimate interests (Art. 6(1)(f)) — aggregate usage analytics, debugging, and security monitoring, where our interest in a secure, reliable, improving App is not overridden by your rights. You may object (§9).
• Legal obligation (Art. 6(1)(c)) — limited data retained to meet tax, accounting, or regulatory requirements.

6. Service providers (subprocessors)

We share data only with the infrastructure providers needed to run the App. We rely on each provider’s data processing terms, which require them to process data only on our instructions, keep it secure, and assist with data-subject requests. We remain responsible for their performance. Our current subprocessors (also listed, with regions, in the DPA):

We will give at least 30 days’ notice before adding a subprocessor that materially changes how data is handled, so you can object or uninstall.

Analytics note: product analytics is configured by us at the application level and, when enabled in production, is always on; it is keyed to your store domain (never to individual staff), is used only to understand feature usage and improve the App, and is never used for advertising or shared for others’ purposes. We rely on legitimate interests for it.

7. Data retention and deletion

• While installed: we retain your edit history and undo snapshots for the life of your installation, because undo is available without expiry by design — that non-expiring safety net is a core feature. We minimize what we keep (a capped before/after sample plus the values needed to reverse a change).
• When you uninstall: Shopify notifies us. We delete your access token immediately and delete your store record, edit history, and snapshots within 30 days (in practice, on Shopify’s shop/redact signal ~48 hours after uninstall), except where we must retain limited records to meet a legal obligation.
• Shop redact: we erase a store’s data in response to Shopify’s shop/redact webhook (sent ~48 hours after uninstall) on the same schedule. One narrow exception: we retain a non-reversible one-way hash of your store domain (no store name, token, or catalog data) solely to prevent repeat abuse of the one-time free AI credits on reinstall. This is minimal, non-personal anti-fraud data we keep under our legitimate interest.
• Customer data requests/redaction: Shopify also sends customers/data_request and customers/redact. Because Catalogist stores no customer personal data, we have none to return or erase; we acknowledge these requests as required.
• On request: you may ask us to delete specific history or all data we hold for your store at any time (§11). (An in-app delete-history control is on our roadmap; until then, contact us.)

8. Security

We protect data with measures appropriate to its sensitivity: encryption in transit (TLS 1.2+); encryption at rest provided by our database and storage providers; application-level AES-256-GCM encryption of the stored Shopify access token, on top of provider at-rest encryption; scoped, least-privilege credentials; and access tokens treated as secrets that are never logged and are transmitted only to authenticate requests to the Shopify Admin API.

Breach notification. If a personal-data breach affects data we process for you, we will notify you without undue delay and within 72 hours of becoming aware, to the extent feasible, with the information you need to meet your own obligations. Notice goes to the email associated with your Shopify account.

No method of storage or transmission is 100% secure, but we work to protect your information and to address incidents in accordance with applicable law.

9. Your rights, roles, and transfers (GDPR / UK GDPR / CCPA / similar)

• Roles: For your store and catalog data, you are the controller and Catalogist is a processor acting on your instructions, under the DPA. We process such data only to provide the App.
• Your customers: Catalogist does not process your customers’ personal data, so we are not a processor of it. Your obligations to your customers under the GDPR, UK GDPR, CCPA/CPRA, or other laws are unaffected by Catalogist.
• Your rights: depending on your location you may have rights to access, correct, export, restrict, or delete the data we hold about your store, and to object to processing based on legitimate interests. Contact us (§11) to exercise them. We do not sell or “share” personal information as defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.
• International transfers: our providers may process data in the United States and the European Union. Where personal data leaves the EEA or UK to a country without an adequacy decision, transfers rely on the EU Standard Contractual Clauses (2021/914) and, for the UK, the UK IDTA / Addendum, or on equivalent safeguards in our subprocessors’ DPAs.
• Supervisory authority: Catalogist is operated by Iscovici Labs – by Ori Iscovici, based in Tel Aviv, Israel. If you believe we have not handled your data lawfully, you may lodge a complaint with a supervisory authority in your country of residence, place of work, or where the issue arose (in Israel, the Privacy Protection Authority; in the EU, your local DPA; in the UK, the ICO).

10. Children

The App is a business tool for Shopify merchants and is not directed to children. We do not knowingly collect personal data from children.

11. Contact

Questions, requests, or complaints about this Policy or your data:

• Email: support@catalogist.app
• Entity: Iscovici Labs – by Ori Iscovici
• Address: Hakishon St., Tel Aviv, Israel
• Data Protection Contact: Ori Iscovici, Iscovici Labs

12. Changes, severability, and entire agreement

We may update this Policy as the App or the law evolves. For material changes we will give at least 30 days’ notice through the App or by email before they take effect; if you object, you may uninstall before the effective date. The “Last updated” date above will change with each revision. If any provision of this Policy is found invalid, the rest remains in effect. This Policy, together with the Terms of Service and the DPA, is the entire understanding between you and Catalogist regarding data handling.