Privacy Policy

Account information

When you create an account we collect your email address and a hashed version of your password. We never store your password in plain text.

Uploaded and generated images

We store the product images you upload (Input Images) and the studio shots we generate for you (Output Images). These are stored in encrypted cloud storage. Input Images are sent to Google's Vertex AI for processing to generate Output Images; they are not used for any other purpose without your consent.

Usage data

We collect usage logs — which studio you used, how many credits you consumed, timestamps, and basic device/browser information. This helps us diagnose issues and improve the service.

Payment information

We do not store your card details. Stripe processes all payments and stores your payment method securely under their own PCI-DSS compliance. We receive only a tokenised reference and high-level billing status from Stripe.

Communications

If you contact support, we retain those communications to provide assistance and maintain a record of interactions.

• To provide the service: Processing your images through AI and delivering Output Images back to you.
• To bill you: Tracking credit consumption and managing subscription payments via Stripe.
• To improve the service: Understanding which features are used most, diagnosing errors, and improving AI output quality.
• To communicate with you: Sending account verification emails, credit alerts, and product updates via Resend.
• To comply with law: Maintaining records as required by applicable regulations.

Your data is stored across the following infrastructure, all encrypted at rest and in transit:

• Supabase (EU / Asia regions): Account data, usage logs, and generated image metadata.
• Vercel (global edge network): Application hosting and serverless function execution.
• Google Vertex AI: Your Input Images are sent here for AI processing. Google processes them according to their enterprise data processing terms and does not use them to train models.

Free accounts

Input Images and Output Images on free accounts are deleted after 30 days. Account information and usage logs are retained for as long as your account is active.

Paid accounts

Images on paid accounts are kept indefinitely so you can re-download them at any time. You can delete individual images from your gallery at any time.

Account deletion

When you delete your account, all your images are deleted within 7 days and your personal data within 30 days, except where we are required to retain records by law (e.g., billing records for up to 7 years).

We only share your data with the third parties needed to operate the service:

• Supabase: Database and storage infrastructure.
• Vercel: Application hosting and deployment.
• Google Vertex AI: AI image generation engine.
• Stripe: Payment processing.
• Resend: Transactional email delivery (account verification, notifications).

We do not sell your data to advertisers or data brokers, and we never will.

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Delete: Ask us to delete your account and associated data.
• Export: Request an export of your images and usage history.
• Correct: Ask us to correct inaccurate data we hold about you.
• Object: Object to processing where we rely on legitimate interests.

To exercise any of these rights, email privacy@cateloom.com. We will respond within 30 days.

We use only essential cookies — specifically the session cookie that keeps you logged in. We do not use advertising cookies, analytics cookies, or tracking pixels of any kind.

If you block all cookies you will not be able to stay signed in to Cateloom.

If you are located in the European Economic Area, the UK, or California, you have additional rights under GDPR and CCPA respectively, including the right to data portability and, in some cases, the right to restrict processing. Our legal basis for processing your personal data is the performance of the contract between us (providing the service you signed up for).

For GDPR-related enquiries, contact privacy@cateloom.com.

We will notify you by email if we make material changes to this Privacy Policy. The updated policy will be effective from the date marked at the top of this page.

Privacy questions or requests: privacy@cateloom.com

General support: support@cateloom.com