Privacy Policy

1. Who we are and what we collect

CatalogNexus is the service name for our catalog aggregation, price/data pipeline, and developer utility project. For the processing described here, CatalogNexus is the responsible service operator. Contact: support@catalognexus.com.

• Website requests: the hosting provider, GitHub Pages, receives information necessary to deliver and secure the website, such as your IP address, request time, browser information, and requested URL. CatalogNexus does not operate a separate visitor analytics database.
• CDN requests: the homepage loads Tailwind CSS browser code from jsDelivr. That provider receives network information such as IP address and browser request metadata. The legal pages do not load third-party scripts.
• Support correspondence: when you email us, we receive your email address, message content, and any information you choose to provide. Messages are forwarded through Spaceship email forwarding and handled in Gmail.
• Cookies and local storage: our website code does not set cookies, use local storage, embed advertising, or install tracking pixels. Infrastructure providers may process requests under their own policies.

Please do not send passwords, API keys, OAuth tokens, payment details, or unnecessary sensitive personal information in support requests.

2. API data and permission boundaries

No third-party account data is collected through this public website. Before enabling an account-connected integration, we will disclose the provider, exact requested scopes and data categories, purpose, recipients, and retention period in this policy and the relevant consent flow. We will obtain required authorization before access and seek fresh consent before materially expanding access or use.

Catalog integrations are intended to process permitted product identifiers, titles, availability, prices, source URLs, and timestamps. Public catalog data and private account data have different permissions. We will not treat public availability as permission to bypass API restrictions or republish licensed content. Catalog sources, credential storage, logs, and persistent outputs must be documented for the specific integration before launch.

3. Purposes and legal bases

We use website delivery metadata to provide and protect the site, and support correspondence to answer requests, investigate issues, and honor privacy rights. Where applicable law requires a legal basis, these activities rely on our legitimate interests in operating a secure service, steps taken at your request, or compliance with legal obligations. Future optional account connections require your authorization and, where applicable, consent. We do not sell or rent personal information, share it for cross-context behavioral advertising, or use it to make decisions with legal or similarly significant effects.

4. Ephemeral processing and retention

The static site stores no API payloads or access tokens. For future API workflows, ephemeral processing means raw payloads are processed only for the requested task and discarded when the task completes, unless an explicitly disclosed feature needs a permitted output to persist. Ephemeral processing does not describe third-party infrastructure logs, support email, or user-requested persistent catalog outputs.

Our retention policy is to delete routine support correspondence within 90 days after the request closes, unless an unresolved dispute, security investigation, or legal requirement justifies longer retention. We restrict longer-retained information to that purpose and delete it when the requirement ends. Hosting, CDN, email forwarding, and email storage providers control their own service logs and backup schedules; we cannot promise immediate erasure from their backups. No fixed API token or payload retention period is represented as operational before the relevant integration exists.

5. Sharing and service providers

Information is disclosed only as necessary to operate the service, handle your request, meet legal obligations, or protect against fraud and security threats. Current infrastructure includes GitHub Pages for hosting, jsDelivr for the homepage CSS utility runtime, Spaceship for email forwarding, and Google Gmail for support email. Their linked policies explain their processing. We do not give these providers your connected API account data through this website.

We may disclose information in response to a binding legal requirement or to address a concrete security issue, limited to what is necessary and legally permitted. If service ownership changes, applicable privacy promises continue to govern transferred personal data; additional authorization will be obtained where required. We do not sell credentials or customer API data.

6. Google API Services: Limited Use

CatalogNexus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This commitment is prospective: no Google account connection is available on this website. If introduced, Google user data will be used only to provide or improve the prominently disclosed, user-facing feature you authorize. We will not use Google user data for advertising or retargeting, sell it to data brokers, transfer it to information resellers, use it for creditworthiness or lending decisions, or train generalized artificial intelligence or machine-learning models.

Transfers will be limited to those necessary for that authorized feature, security purposes, legal compliance, or a permitted business transfer with the required prior user consent. Humans will not read Google user data except with your affirmative agreement for specific data, where necessary for security, to comply with applicable law, or for internal operations using data aggregated and anonymized as permitted by Google’s policy. Providers and personnel handling such data must observe these restrictions.

Any future Google integration will publish the specific scopes, data fields, deletion behavior, and storage duration before requesting access. This disclosure does not claim Google verification or certification.

7. Other API providers

Any integration with Meta, Reddit, X, retail APIs, or affiliate networks must use authorized access methods, honor rate limits and deletion/revocation requirements, and comply with the provider’s current terms. We do not bypass access controls, solve CAPTCHAs to evade restrictions, automate unauthorized login, or sell credentials. We do not claim that any provider has approved, partnered with, or endorsed CatalogNexus. Any affiliate relationship will be disclosed clearly alongside the affected links before use.

8. Security and international processing

Supported network connections must use HTTPS/TLS for transport. TLS protects network transmission and is not a claim of end-to-end encryption that excludes service providers. The public site contains no account credentials. Providers may process website requests and support correspondence in the United States and other countries under their applicable transfer safeguards. No security measure provides an absolute guarantee; report suspected exposure promptly without emailing live secrets.

9. Access, deletion, revocation, and privacy rights

Email support@catalognexus.com with the subject “Privacy or data deletion request.” Identify the email address used to contact us and the information or integration concerned. Do not include passwords or tokens. We will verify your request using proportionate steps, normally by replying to the associated address, and request additional information only when needed.

Our initial-response SLA is under 48 hours. We aim to complete verified deletion requests within 30 days, or earlier where law or provider policy requires. If an applicable law permits an extension, we will explain the reason and timing. We will delete information under our control unless retention is legally required, and explain any exception. Data independently controlled by a provider requires a request to that provider; copies already lawfully exported to you remain under your control.

Depending on your location, you may have rights to access, correction, deletion, portability, restriction, objection, withdrawal of consent, appeal, and complaint to your privacy regulator. We do not discriminate for exercising privacy rights. You may use an authorized agent where permitted by law. If a Google connection is offered later, you can revoke it through Google Account permissions; revocation stops future authorized access but is distinct from deleting previously stored information. Other providers offer corresponding account controls.

10. Children and external links

CatalogNexus is intended for adults and is not directed to children under 18. We do not knowingly collect children’s personal information. Contact us if you believe a child has supplied personal data. External links lead to independent services whose terms and privacy practices apply.

11. Changes to this policy

We will update the date above when this policy changes. Material changes affecting previously collected information will be communicated through an appropriate notice and, where required, renewed consent before the new use begins. New integrations will not silently expand this website’s data access.

12. Contact

For support, security concerns, privacy rights, or deletion requests: support@catalognexus.com. Service name: CatalogNexus. Website: catalognexus.com.