Privacy Policy

Last updated 4 September 2026

This document is also published in Bahasa Indonesia. The English version governs if the two differ.

The short version. We collect your email, the photos you upload, and a record of your tokens and purchases. We do not track your IP address or device, we do not use advertising or tracking cookies, and we do not sell your data. Your photos are shared with our AI and moderation providers only to generate your images.

1. Who is responsible

Katalogi is the data controller for the personal data described here. This policy is written to meet Indonesia’s Personal Data Protection Law (UU No. 27 of 2022). Contact us at hello.katalogi@gmail.com.

2. What we collect, why, and on what legal basis

Article 21 of the PDP Law requires us to tell you not just what we collect and why, but the legal basis we rely on. Of the six bases the law recognises, we rely on three: performance of our contract with you, compliance with a legal obligation, and your consent.

Email address and name: To create your account, sign you in, and send you transactional email such as “your photo set is ready”. Collected when you sign up, or from Google if you sign in with Google.Legal basis: Contract — we cannot provide an account without it.
Product photos you upload: To generate your catalog photos and posters. These are the input to the service and cannot be omitted.Legal basis: Contract — this is the input to the service you asked for.
Images we generate for you: Stored so you can return and download them from your gallery. Legal basis: Contract.
Token balance and history: An append-only record of tokens granted, held, spent and returned. This is our accounting record and we are required to keep it accurate.Legal basis: Contract, and legal obligation — this is an accounting record.
Purchase records: Amount, payment method, status and timestamp. We do not receive or store your card number, bank credentials, or e-wallet PIN — those go directly to our payment processor.Legal basis: Contract, and legal obligation for tax and accounting.
Product usage events: A small set of events — project created, completed or failed; purchase started, completed or failed; upload accepted or rejected; rate limit reached — recorded against your account id so we can tell whether the product is working. See section 3.Legal basis: Our legitimate interest in knowing whether the product works. You can object — see section 8.

A note on payment data

The PDP Law treats personal financial data as “specific personal data” — a category carrying stricter obligations than ordinary personal data, alongside health, biometric, genetic, criminal and children’s data. We have deliberately minimised our exposure here: your card number, bank credentials and e-wallet PIN never reach our systems. They are collected by our payment processor directly. What we hold is a transaction record — amount, method, status, time — which we keep because tax and accounting law requires it.

3. What we deliberately do not collect

This is a design decision, not an omission. Our analytics record no IP addresses and no device fingerprints — only your account id. We do not build advertising profiles, we do not use tracking pixels or third-party advertising cookies, and we do not sell or rent personal data to anyone.

4. Cookies and local storage

Katalogi does not use advertising or analytics cookies, and there is no tracking script in your browser — our usage events are recorded on our own servers. What the site does store is limited to:

Session cookies: Set by our authentication provider to keep you signed in. Strictly necessary — the service cannot work without them.
Bot-protection cookie: Set during sign-up to distinguish real people from automated abuse. Strictly necessary for security.
Theme preference: A single value in your browser’s local storage remembering whether you chose light or dark mode. It never leaves your device.

Because none of these are used for advertising or cross-site tracking, we do not show a cookie consent banner. If that ever changes, we will ask first.

5. Who else processes your data

We use the following providers to run the service. Each receives only what it needs, and none are permitted to use your data for their own purposes.

Authentication: Email address, name. Manages your login and session.
Database and file storage: Your account record, tokens, uploads and generated images. Hosted on managed cloud infrastructure.
AI image generation: Your uploaded product photo and the generated result, for as long as the generation takes. Shared via a time-limited link, not a public URL.
AI text generation: A description of your product and chosen scene, used to write the instructions for the image model. Not your account details.
Content moderation: Your uploaded image, checked automatically against our content rules before it is stored.
Payments: Handled by an Indonesian payment processor. They receive the transaction details and your payment credentials directly; we receive only the result.
Transactional email: Your email address and the contents of the notification.
Hosting and product analytics: Serving the site, and the usage events in section 2 keyed to your account id.

Some of these providers operate outside Indonesia, so your data may be processed abroad. The PDP Law allows this where the destination offers protection at least equivalent to Indonesia’s, or where there are adequate binding safeguards in place. We rely on the second basis: each provider is engaged under contractual data-protection terms, and we share only the minimum each one needs. We do not rely on your consent for these transfers, so you are not asked to waive anything to use the service.

6. Automated decisions about your uploads

One part of Katalogi makes an automated decision that affects you: every upload is checked by an automated content-moderation service before it is stored, and an image that fails is refused without a human looking at it. No other part of the service makes automated decisions about you, and we do not profile you.

We do not tell you which rule an upload triggered — a per-category readout would tell someone exactly how far content can be pushed. But an automated check can be wrong, and you have the right not to be subject to a decision made solely by automated means. If your upload was refused and you believe that is a mistake, email hello.katalogi@gmail.com and a person will review it.

7. How long we keep it

Account data — while your account is open, and deleted when you close it.
Uploads and generated images — until you delete them or close your account.
Token and purchase records — retained after account closure where we need them for accounting, tax or dispute records.
Backups — our database is backed up nightly and each backup is kept for 30 days, after which it is destroyed. Data you delete can therefore persist in a backup for up to 30 days.

8. Your rights

Under Indonesia’s Personal Data Protection Law you may:

ask what data we hold about you, and get a copy of it;
have data that is wrong or incomplete corrected;
have your data deleted, and your account closed;
receive your data in a structured, machine-readable form, or have it transferred to another provider;
restrict or object to a particular use of your data;
object to a decision made about you solely by automated means — see section 6;
withdraw consent where our processing relies on it;
seek compensation for loss caused by a breach of the law.

Email hello.katalogi@gmail.com. We may need to verify your identity before we act, so that someone else cannot use this route to reach your data. We aim to respond within 30 days — that is our own commitment rather than a statutory deadline, since the PDP Law does not set one. If you are unhappy with our response you may complain to the Indonesian personal data protection authority.

We are not currently required to appoint a Data Protection Officer — that obligation applies to large-scale monitoring or large-scale processing of specific personal data, and we are below that threshold. The address above reaches the people responsible.

9. Security

Data is encrypted in transit. Stored images are private and reached only through short-lived links tied to your account, never public URLs. Access to production data is limited to those who need it.

No system is perfectly secure. If a breach affects your personal data, the PDP Law requires us to notify both you and the supervisory authority in writing within 3 × 24 hours of becoming aware of it, and we will. The notice will tell you what data was involved, when it happened, and what we are doing about it.

10. Children

Katalogi is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone below the age at which they can consent for themselves. If you believe a child has given us data, contact us and we will delete it.

11. Changes

We may update this policy. The date at the top tells you the current version. If a change materially affects how we use your data, we will tell you rather than change it quietly.

12. Contact

hello.katalogi@gmail.com. Our service terms are in the Terms of Service.

Questions about this page? Email hello.katalogi@gmail.com. See also our Terms of Service.