Privacy Policy
1. Data Controller
The Data Controller is Guido Di Pace, based in Naples, Italy.
Privacy contact: privacy@katapic.com
2. Personal Data Collected
We collect the following categories of personal data:
- Registration data: email address, name, optional company name, password (stored encrypted via bcrypt)
- Technical data: IP address, browser user agent, login and security data
- Payment data: processed through Stripe; credit card details are never stored on our servers
- User content: product images and data uploaded, AI-generated content
- AI usage data: technical logs (feature used, model, token counts, cost, outcome); the content of your requests is not stored in these logs
- Preferences: selected language, account settings
3. Purposes and Legal Basis for Processing
- Performance of contract (Art. 6(1)(b) GDPR): service delivery, including AI features, account management, payment processing, customer support
- Consent (Art. 6(1)(a) GDPR): sending promotional and marketing communications
- Legitimate interest (Art. 6(1)(f) GDPR): platform security, fraud prevention, service improvement
- Legal obligation (Art. 6(1)(c) GDPR): tax and accounting compliance
4. Artificial Intelligence Features
Katapic uses artificial intelligence systems to generate product descriptions and images, and to analyse the product photos you upload. For this purpose, the content you upload or enter (product text and images) is transmitted to the following providers for processing only:
- OpenRouter, Inc. (USA): gateway to the language and image generation models we use (including Qwen, Anthropic Claude and Black Forest Labs Flux models). Requests are sent with the setting that excludes providers which use data for model training.
- NanoBanana API: image generation via Google Gemini models.
In accordance with Article 50 of Regulation (EU) 2024/1689 (AI Act):
- AI-generated content is labelled "AI-generated" within the application;
- generated images embed a machine-readable marking (standard IPTC metadata) identifying them as artificially generated;
- AI-based features are clearly identified as such in the interface.
Katapic does not make decisions based solely on automated processing which produce legal effects concerning you (Art. 22 GDPR). Generated content is always subject to your review and approval before any publication.
5. Anonymous Store Scan
The katapic.com website offers a public store analysis tool that can be used without an account. If you use this tool, we process:
- IP address: used solely to enforce anti-abuse limits; it is kept for a maximum of 24 hours in volatile memory and is never stored permanently
- The store URL you provide and the public catalogue data: analysis results are cached for up to 48 hours, then automatically deleted; no data is stored permanently
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in protecting the service from abuse and in efficiently delivering the requested analysis.
6. AI Visibility Check
Registered users can use the feature that checks the visibility of their catalogue on AI-powered search engines. When you use this feature, the service queries such engines about public categories and domains and retains the results (answer excerpts and cited domains) for 12 months.
7. Third-Party Data Sharing
Your personal data may be shared with the following recipients, acting as processors or independent controllers:
- Stripe, Inc.: payment processing and subscriptions
- OpenRouter, Inc.: AI content processing (see section 4)
- NanoBanana API: AI image generation (see section 4)
- Tavily, Inc. (USA): web search service used to enrich product sheets; only the product name or title, the brand and the EAN/MINSAN code are transmitted, never any personal data of our users
- Meta Platforms, Inc.: only if you connect your channels
- Shopify / WooCommerce: only if you connect your e-commerce store
- Hostinger: hosting infrastructure and domain email (servers in Europe)
- Hetzner Online GmbH: encrypted backup storage (datacenters in Europe)
8. Data Transfers Outside the EU
Some providers are based in the United States. Transfers to these providers take place, where the provider is certified under the EU-U.S. Data Privacy Framework, on the basis of that certification, alternatively on the basis of the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). The following table summarises the subprocessors we use:
| Provider | Location | Role | Transfer safeguard |
|---|---|---|---|
| OpenRouter, Inc. | USA | AI text generation | Standard Contractual Clauses and DPA |
| NanoBanana API (based on Google Gemini) | USA | AI image generation | Standard Contractual Clauses |
| Stripe, Inc. | USA | Payments | Data Privacy Framework |
| Meta Platforms, Inc. | USA | Only if you connect your channels | Data Privacy Framework |
| Tavily, Inc. | USA | Product sheet enrichment | Standard Contractual Clauses and DPA |
| Hostinger | EU | Domain email | Processing entirely within the EU |
| Hetzner Online GmbH | EU (Germany) | Encrypted backups | Processing entirely within the EU |
Your data is stored on servers located in Europe (Hostinger). Backups are encrypted and stored in European datacenters (Hetzner).
9. Data Retention Period
- Account data: retained for the duration of the contractual relationship; within 30 days of a deletion request, personal data is automatically and irreversibly deleted or anonymised
- Billing data: retained for 10 years as required by Italian tax law
- Security and activity logs (including IP address): retained for 12 months, then automatically deleted
- AI usage logs: anonymised after 12 months (user association removed)
- Consent records: retained for the duration of the relationship and 5 years thereafter, for evidentiary purposes
- Backups: encrypted, with automatic rotation
10. Your Rights
Under the GDPR, you have the right to:
- Access (Art. 15): obtain confirmation and access to your personal data
- Rectification (Art. 16): correct inaccurate or incomplete data
- Erasure (Art. 17): request deletion of your data; you can do this yourself from your account Settings
- Restriction (Art. 18): restrict processing in certain circumstances
- Portability (Art. 20): receive your data in a structured format; you can download it yourself as JSON from your account Settings
- Objection (Art. 21): object to processing based on legitimate interest
- Withdrawal of consent (Art. 7(3)): withdraw marketing consent at any time from Settings or via the unsubscribe link in our emails
To exercise your rights, contact privacy@katapic.com. We will respond within 30 days.
11. Right to Lodge a Complaint
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):
- Piazza Venezia, 11 - 00187 Rome, Italy
- Website: www.garanteprivacy.it
12. Cookies
Katapic only uses strictly necessary technical cookies and preference cookies (language, session). We do not use analytics, advertising or profiling cookies. See the Cookie Policy for details.
13. Minimum Age and Professional Use
The Service is reserved for persons aged 18 or over who use it for professional or commercial purposes. The Service is not intended for minors; under the Italian AI law (L. 132/2025), access to AI features by children under 14 would require parental consent and is not permitted on Katapic.
14. Changes to This Policy
We reserve the right to modify this policy. In case of substantial changes, you will be asked to review and accept the new version upon your first access after publication.
Last updated: 9 July 2026 (Version 3)