Privacy Notice

1. Who we are

Catalogue is operated by inteliFutures Group Pty Ltd ("we", "us", "our"). We are the data controller for the personal data you provide when using Catalogue (the "Service").

2. Data we collect

We collect the following categories of personal data:

• Account data: email address and password (hashed)
• Collection data: item details, photos, condition notes, grading records, valuations, cost information, custom fields and notes you enter
• Settings: currency preference and subscription status
• Usage data: device type, browser, and interaction logs for service improvement

We do not collect payment card details — these are handled entirely by our payment provider, Paddle.

3. How we use your data

• To create and manage your account
• To store, display and organise your collection data
• To process subscription payments (via Paddle)
• To provide customer support
• To improve and maintain the Service
• To send service notifications (e.g. security, billing)

4. Legal basis

We process your data on the following legal bases: contract performance (providing the Service you signed up for), legitimate interests (service improvement and security), consent (marketing communications, if you opt in), and legal obligation (tax records, where applicable).

5. Data sharing

We share data with the following categories of recipients:

• Paddle (Merchant of Record): for subscription management, payments, tax compliance and invoicing. Paddle processes your payment information independently — we do not see or store card details.
• Hosting providers: for database and file storage infrastructure
• Professional advisers: legal and accounting, where necessary
• Authorities: where required by law

We never sell your data to third parties.

6. Data retention

We retain your collection data for as long as your account is active. If you delete your account, your data is permanently deleted within 30 days. Subscription records are retained for the period required by tax law in your jurisdiction.

7. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent for marketing communications
• Complain to your local data protection authority

To exercise any of these rights, contact us. We respond within one month.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, row-level security on all database tables, and private file storage with signed URLs. Each user can only access their own data.

9. Cookies

The Service uses essential cookies for authentication and session management. We do not use third-party advertising or tracking cookies. Analytics cookies, if used, require your consent.

10. International transfers

Your data may be processed by our hosting and payment providers in countries outside your own. We rely on standard contractual clauses and adequacy decisions to ensure appropriate safeguards are in place for any such transfers.

11. Changes to this notice

We may update this Privacy Notice from time to time. We will notify you of material changes via email or in-app notice.

12. Contact

If you have questions about this Privacy Notice or your data, please contact us.