Data Processing Agreement
Catalog Pro Business API. This agreement sets out how we process personal data that you send us through the Business API, on your behalf and on your instructions.
Last updated:1. Parties and Status
| Party | Details |
|---|---|
| Service | Catalog Pro (catalogpro.app) |
| Operated by | Lokesh Badolia, trading as Codex Collab |
| Country | India |
| Contact | [email protected] |
| Customer | The business that holds a Catalog Pro Business account and uses the Business API ("you"). |
Our current status. Catalog Pro is a software service in its startup stage. It is run by Lokesh Badolia as a sole proprietorship under the name Codex Collab, and is not yet registered as a private limited company. When the business is incorporated, the new company will take over this agreement as the party in our place, and we will tell you by email.
This agreement forms part of our Terms & Conditions and applies automatically whenever you send personal data to us through the Business API. If you need a countersigned copy, email us.
2. Definitions
| Term | Meaning |
|---|---|
| Data Protection Law | Any law that applies to the processing of Customer Data, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and India's Digital Personal Data Protection Act, 2023 (DPDP Act). |
| Customer Data | Personal data contained in the photos, user ids and other content you send through the Business API, and in the images we generate from them. |
| Controller / Processor | As defined in the GDPR. Under the DPDP Act, "Controller" means "Data Fiduciary" and "Processor" means "Data Processor". |
| Sub-processor | A third party we engage to process Customer Data on your behalf. |
| End user | A customer of yours on whose behalf you send a request. |
| Personal Data Breach | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Data. |
3. Roles
You are the controller of Customer Data: you decide which photos and user ids to send and why. We are your processor, and we process Customer Data only to provide the Business API to you.
For the details of your Business account itself — your sign-in, business profile and payments — we are an independent controller, and our Privacy Policy applies.
4. Our Obligations
| We will | What it means |
|---|---|
| Follow your instructions | Process Customer Data only to fulfil your API requests and as set out in the Terms and this agreement. If we believe an instruction breaks Data Protection Law, we will tell you. |
| Use it for nothing else | We do not sell Customer Data, use it for marketing, or use it to train AI models. |
| Keep it confidential | Only people who need access to operate the service can access Customer Data, and they are bound by confidentiality. |
| Keep it secure | Apply the security measures in Annex 2. |
| Help you with requests | Help you, as far as we reasonably can, to respond to requests from end users exercising their rights, and with data protection impact assessments or consultations with regulators. |
| Report breaches | Notify you without undue delay, and where possible within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data, with the information we have at the time. |
| Delete it | Delete Customer Data on the schedule in Annex 1, and delete any that remains within 30 days of your Business account being closed, unless the law requires us to keep it. |
| Show our compliance | Answer a reasonable written security questionnaire once a year, and make available the information needed to show we meet this agreement. Given our size, we do not offer on-site audits, except where Data Protection Law requires one. |
5. Your Obligations
| You will | What it means |
|---|---|
| Have a lawful basis | Have a lawful basis for sending Customer Data to us, and give your end users the notices and obtain any consents the law requires. |
| Send pseudonymous ids | Send an opaque user id for each end user — not an email address, phone number or name. |
| Send products, not people | Send photos of products and garments. Do not send photos of identifiable people without their consent, as set out in our Terms. |
| Avoid sensitive data | Do not send special categories of personal data, or data about children. |
| Give lawful instructions | Make sure your instructions to us comply with Data Protection Law. |
6. Sub-processors
You authorise us to use the sub-processors listed in Annex 3. We bind each of them by contract to data protection obligations no less protective than this agreement, and we remain responsible for them.
We will update Annex 3 and email your account address at least 14 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us within that period and we will work with you to resolve it. If we cannot, you may stop using the Business API and close your account.
7. International Transfers
We operate from India, and our servers and storage are in the United States (Google Cloud, us-central1, and our database on Neon in AWS us-west-2, Oregon). Image generation uses Google's global AI endpoint, which may process a request in any Google Cloud region.
EU, EEA and Swiss data. Where Customer Data is transferred from the EEA or Switzerland, the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this agreement by reference, with you as data exporter and us as data importer, and with these choices:
| Clause | Choice |
|---|---|
| Clause 7 (docking) | Not included. |
| Clause 9 (sub-processors) | Option 2, general written authorisation, with 14 days' notice as in section 6. |
| Clause 11 (redress) | The optional wording is not included. |
| Clause 13 (supervision) | The supervisory authority that is competent for you. |
| Clauses 17 and 18 (law and courts) | The law and courts of Ireland. |
| Annexes I, II and III | Annexes 1, 2 and 3 of this agreement. The parties are as set out in section 1. |
For Swiss data, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.
UK data. Where Customer Data is transferred from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies. Its Tables 1 to 3 are completed with the information in this agreement, and in Table 4 neither party may end the Addendum.
8. Liability
Each party's liability under this agreement is subject to the limitation of liability in our Terms & Conditions. Nothing in this agreement limits a party's liability under the Standard Contractual Clauses where they apply, or any liability that cannot be limited by law.
9. Term and Precedence
This agreement lasts for as long as we process Customer Data. If it conflicts with the Terms on a data protection matter, this agreement prevails. If it conflicts with the Standard Contractual Clauses or the UK Addendum, those prevail.
We may update this agreement to reflect changes in the law or in our service. We will email your account address about significant changes, and we will not reduce the protection it gives Customer Data.
A1. Annex 1 — Details of Processing
| Item | Details |
|---|---|
| Subject matter and purpose | Generating catalog images of products and garments from photos you send, including on AI-generated models, and returning them to you. |
| Nature of processing | Receiving, storing, analysing with AI, generating images, automated content screening, delivering results, and deleting. |
| Data subjects | Your end users, and your own staff who use the API. |
| Categories of data | Product and garment photos, which may incidentally contain personal data; the pseudonymous user id you send for each end user; job details and timestamps. |
| Special categories | None intended. You agree not to send them. |
| Frequency | Continuous, whenever you send a request. |
| Duration and retention | Photos you send are deleted as soon as the job finishes. Generated images are deleted 30 days after they are made. Models you create are kept until your Business account is closed. Usage records are kept until your account is closed. |
A2. Annex 2 — Security Measures
| Area | Measure |
|---|---|
| Encryption | All traffic is encrypted in transit with TLS. Data is encrypted at rest by Google Cloud. |
| API keys | Stored only as a hash and in encrypted form, never in plain text. Keys can be rotated at any time from the dashboard. |
| Separation | Each business's files are stored under its own path, and every request is checked against the business that owns the key. |
| Access control | Administrative access is limited to the operator, through Google sign-in, with a recent sign-in required before any change. |
| Data minimisation | Photos you send are deleted when the job finishes, and generated images are deleted automatically after 30 days. |
| Abuse protection | Rate limits on every key, and automated screening of content sent to the API. |
| No secondary use | Customer Data is not used to train AI models, by us or by our AI provider. |
A3. Annex 3 — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud and Firebase (Google LLC) | Servers, file storage, job queue and API gateway | United States (us-central1) |
| Neon (Neon, Inc.) | Database: account records, job details and end-user ids | United States (AWS us-west-2, Oregon) |
| Google Cloud Vertex AI (Google LLC) | AI image analysis and generation | Global (any Google Cloud region) |
Dodo Payments (payments) and Google sign-in handle only your Business account and billing details, not Customer Data, so they are covered by our Privacy Policy rather than listed here.
10. Contact Us
For any question about this agreement, to request a countersigned copy, or to report a concern about Customer Data, email us at [email protected].