Who processes your data

Data controller: the catalog provider that created the AI agent you are interacting with. Each agent is linked to a specific provider.

Data processor: katalove.com (the technical platform hosting the chat) acts as a processor on behalf of the controller.

Data collected

Text of conversations with the AI agent
Email and phone number, if voluntarily provided during the conversation
IP address (for security and rate-limiting, not shared with the provider)

Purposes and legal basis

Contacts (email and phone) are collected at your explicit initiative to be contacted by the provider regarding catalog products. Legal basis: consent (art. 6.1.a GDPR).

Where the data lives and who processes it for us

We rely on external providers to run the service. Each one is appointed as a data processor. This is the full list.

Hetzner Online GmbH (Germany) — servers, database and catalog files. Data is stored on machines inside the European Union.
Anthropic PBC (United States) — receives the conversation text to generate the answer. Data sent through the API is not used to train the models.
OpenAI, L.L.C. (United States) — reads the pages of catalogs, price lists and manuals to extract products, tables and images, and turns text and questions into search indexes. Same rule: no training on data sent through the API.
Resend, Inc. (United States) — delivers the service emails: verification codes, order confirmations, supplier notifications. It processes the recipient address and the message content.
Plausible Insights OÜ (Estonia, European Union) — website visit statistics, anonymous and cookie-free.

The three US providers process data outside the European Union. The transfer relies on the standard contractual clauses approved by the European Commission (art. 46.2.c GDPR).

The service only uses technical cookies: they keep the session open, tie the conversation to the catalog and remember the PIN of a private catalog. No profiling, no advertising, no data shared with anyone beyond the processors listed here.

Retention

An automatic routine applies the limits every day, with no one having to remember: conversations that produced no order are gone 30 days after the last message, the rest after 90, and the contacts you leave after 90. Agents not claimed within 72 hours are deleted along with everything they hold. You can ask for deletion sooner, at any time.

Orders follow a different rule. They stay in the provider's records, since accounting documents must be kept by law, but stripped of what identifies you: name, email, phone, shipping address and VAT number. What is left of the order is the date, the products and the amounts.

If you are a business customer

For your account data, billing data and the documents you send us, the data controller is Fabio Vezzoli, ditta individuale, P.IVA 04370730980, PEC vezzoli.f@legalmail.it.

We process: name, email and company of dashboard users; billing data; the catalogs, price lists, commercial terms and manuals you send us and what we derive from them (products, codes, prices, images); your sales reps' seats.

Legal basis: performance of the contract (art. 6.1.b GDPR) and tax obligations (art. 6.1.c). When you send us a document you confirm you have the right to have it processed; the confirmation is recorded with date and time.

The documents you send us, including confidential terms and price lists, are processed by third-party AI models: OpenAI to read pages and extract products and images, Anthropic to answer questions. Their servers are in the United States. We use their paid APIs, whose data by contract is not used to train models and is kept only for the period their terms set for abuse monitoring. If a document contains information you do not want processed this way, tell us before sending it.

Documents and derived data are kept for the whole duration of the service and deleted at your request when the relationship ends. Catalogs uploaded as a trial and never activated are deleted automatically after 72 hours. Billing data is kept for 10 years, as required by law.

The corrections we make to answers and extracted products are used to improve the service. They can become training material for models only with your written consent; without consent we only derive general rules that contain none of your data.

If you connect your CRM (webhook or CSV export), your customers' requests and orders are sent to the system you choose: from then on you process them as controller.

For any request about your data: PEC vezzoli.f@legalmail.it.

Your rights

You have the right to access, rectify, delete, and port your data.

To request the deletion of your data, send a request to:

Privacy Policy