Privacy Policy

Last updated 24 September 2026

This document is also published in Bahasa Indonesia. The English version governs if the two differ.

The short version. We collect your email, the photos you upload, and a record of your credits and purchases. We do not track your IP address or device fingerprint, we do not use advertising or tracking cookies, and we do not sell your data. Your photos are shared with our AI and moderation providers only to generate your images. The images and videos we return are generated by AI.

1. Who is responsible

Katalogi is the data controller for the personal data described here. Katalogi is operated by Han, an individual business based in Surabaya, Jawa Timur, Indonesia. This policy is written to meet Indonesia’s Personal Data Protection Law (UU No. 27 of 2022). Contact us at hello.katalogi@gmail.com.

2. What we collect, why, and on what legal basis

Article 21 of the PDP Law requires us to tell you not just what we collect and why, but the legal basis we rely on. Of the six bases the law recognises, we rely on four: performance of our contract with you, compliance with a legal obligation, your consent, and our legitimate interest in knowing whether the product and public pages work.

Email address and name: To create your account, sign you in, and send you transactional email such as “your photo set is ready”. Collected when you sign up, or from Google if you sign in with Google.Legal basis: Contract, we cannot provide an account without it.
Product photos you upload: To generate your catalog photos and posters. These are the input to the service and cannot be omitted.Legal basis: Contract, this is the input to the service you asked for.
Images we generate for you: Generated by AI from your upload, and stored so you can return and download them from your gallery. Legal basis: Contract.
Your confirmation before each generation: Which version of our Terms you accepted with the checkbox before a generation, and when, stored on that project. It is the record that you saw the cost and agreed that the result is AI-generated and final.Legal basis: Contract, and our legitimate interest in resolving disputes about a charge.
Credit balance and history: An append-only record of credits granted, held, spent and returned. This is our accounting record and we are required to keep it accurate.Legal basis: Contract, and legal obligation, this is an accounting record.
Purchase records: Amount, payment method, status and timestamp. We do not receive or store your card number, bank credentials, or e-wallet PIN, those go directly to our payment processor.Legal basis: Contract, and legal obligation for tax and accounting.
Product usage events: A small set of events, account created; project created, completed or failed; purchase started, completed or failed; upload accepted or rejected; rate limit reached, recorded against your account id so we can tell whether the product is working. See section 3.Legal basis: Our legitimate interest in knowing whether the product works. You can object, see section 8.
Where your first visit came from: Once, when you sign up: the name of the website that sent you to us (for example google.com, never the full address you came from), which of our public pages you arrived on, and any campaign tag in the link (utm_source, utm_medium, utm_campaign). Recorded against your account id so we can see which channels bring sellers. We do not read advertising click identifiers. Held until sign-up in your browser’s session storage, see section 4.Legal basis: Our legitimate interest in knowing which channels bring sellers. You can object, see section 8.
Anonymous page views: The page path (query string stripped; admin user ids replaced), referrer, approximate location (country, region, city) and device type, collected by our host so we can see which public pages are used. No account id, no cookies, and the visitor hash is discarded after 24 hours.Legal basis: Our legitimate interest in understanding which pages are used. This data cannot identify you.

A note on payment data

The PDP Law treats personal financial data as “specific personal data”, a category carrying stricter obligations than ordinary personal data, alongside health, biometric, genetic, criminal and children’s data. We have deliberately minimised our exposure here: your card number, bank credentials and e-wallet PIN never reach our systems. They are collected by our payment processor directly. What we hold is a transaction record, amount, method, status, time, which we keep because tax and accounting law requires it.

3. What we deliberately do not collect

This is a design decision, not an omission. Our product analytics record no IP addresses and no device fingerprints, only your account id. Anonymous page views (section 2) likewise carry no IP and no fingerprint, a hash of the request is discarded after 24 hours. We do not build advertising profiles, we do not use tracking pixels or third-party advertising cookies, and we do not sell or rent personal data to anyone.

4. Cookies and local storage

Katalogi does not use advertising or analytics cookies. A first-party script from our host records the anonymous page views in section 2. Product usage events are recorded on the server against your account id. What the site does store on your device is limited to:

Session cookies: Set by our authentication provider to keep you signed in. Strictly necessary, the service cannot work without them.
Bot-protection cookie: Set during sign-up to distinguish real people from automated abuse. Strictly necessary for security.
Theme preference: A single value in your browser’s local storage remembering whether you chose light or dark mode. It never leaves your device.
Language preference: A cookie remembering whether you read the site in English or Bahasa Indonesia, so the next page opens in the same language. Kept for one year.
Visit source, this tab only: When you open a public page while signed out, your browser’s session storage notes the name of the site that sent you, the page you arrived on and any campaign tag in the link. It is not a cookie: it stays in that one tab and is deleted when you close it. It is sent to us only if you sign up in that tab, once, and then removed.

Because none of these are used for advertising or cross-site tracking, we do not show a cookie consent banner. If that ever changes, we will ask first.

5. Who else processes your data

We use the following providers to run the service. Each receives only what it needs, and none are permitted to use your data for their own purposes.

Authentication: Email address, name. Manages your login and session.
Database and file storage: Your account record, credits, uploads and generated images. Hosted on managed cloud infrastructure.
AI image generation: Your uploaded product photo and the generated result, to run the generation. Shared via a time-limited link, not a public URL. The provider may keep generated files for a limited period under its own retention terms before deleting them.
AI text generation: Your uploaded product photo, and the scene you chose, used to write the instructions for the image model. Not your account details.
Content moderation: Your uploaded image, checked automatically against our content rules before it is stored.
Payments: Handled by an Indonesian payment processor. They receive the transaction details and your payment credentials directly; we receive only the result.
Transactional email: Your email address and the contents of the notification.
Hosting: Serves the site, and records the anonymous page views in section 2.
Product analytics: The usage events and first-visit source in section 2, keyed to your account id.

Some of these providers operate outside Indonesia, so your data may be processed abroad. The PDP Law allows this where the destination offers protection at least equivalent to Indonesia’s, or where there are adequate binding safeguards in place. We rely on the second basis: each provider is engaged under contractual data-protection terms, and we share only the minimum each one needs. We do not rely on your consent for these transfers, so you are not asked to waive anything to use the service.

6. Automated decisions about your uploads

One part of Katalogi makes an automated decision that affects you: every upload is checked by an automated content-moderation service before it is stored, and an image that fails is refused without a human looking at it. No other part of the service makes automated decisions about you, and we do not profile you.

We do not tell you which rule an upload triggered, a per-category readout would tell someone exactly how far content can be pushed. But an automated check can be wrong, and you have the right not to be subject to a decision made solely by automated means. If your upload was refused and you believe that is a mistake, email hello.katalogi@gmail.com and a person will review it.

7. How long we keep it

Account data, while your account is open, and deleted when you ask us to close it (section 8).
Uploads and generated images, until you ask us to delete them or to close your account. Deletion is currently done on request by email, not from a button in the app.
Credit and purchase records, retained after account closure where we need them for accounting, tax or dispute records.
A marker that your email has used the free trial, a normalised form of the address, kept after your account is closed so the free trial cannot be claimed again. It is used for nothing else.
Backups, our database is backed up nightly and each backup is kept for 30 days, after which it is destroyed. Data you delete can therefore persist in a backup for up to 30 days.

8. Your rights

Under Indonesia’s Personal Data Protection Law you may:

ask what data we hold about you, and get a copy of it;
have data that is wrong or incomplete corrected;
have your data deleted, and your account closed;
receive your data in a structured, machine-readable form, or have it transferred to another provider;
restrict or object to a particular use of your data;
object to a decision made about you solely by automated means, see section 6;
withdraw consent where our processing relies on it;
seek compensation for loss caused by a breach of the law.

Email hello.katalogi@gmail.com. We may need to verify your identity before we act, so that someone else cannot use this route to reach your data. We aim to respond within 30 days - that is our own commitment rather than a statutory deadline, since the PDP Law does not set one. If you are unhappy with our response you may complain to the Indonesian personal data protection authority.

We are not currently required to appoint a Data Protection Officer, that obligation applies to large-scale monitoring or large-scale processing of specific personal data, and we are below that threshold. The address above reaches the people responsible.

9. Security

Data is encrypted in transit. Stored images are private and reached only through short-lived links tied to your account, never public URLs. Access to production data is limited to those who need it.

No system is perfectly secure. If a breach affects your personal data, the PDP Law requires us to notify both you and the supervisory authority in writing within 3 × 24 hours of becoming aware of it, and we will. The notice will tell you what data was involved, when it happened, and what we are doing about it.

10. Children

Katalogi is a tool for businesses and is not directed at children. You must be at least 18 to create an account. We do not knowingly collect data from anyone below the age at which they can consent for themselves. If you believe a child has given us data, contact us and we will delete it.

11. Changes

We may update this policy. The date at the top tells you the current version. If a change materially affects how we use your data, we will tell you rather than change it quietly.

12. Contact

hello.katalogi@gmail.com. Our service terms are in the Terms of Service.

Questions about this page? Email hello.katalogi@gmail.com. See also our Terms of Service.