Catalog Pro Privacy Policy

1. Scope

This Privacy Policy explains how VIXIV LLC d/b/a Catalog Pro ("Catalog Pro," "we," "our," or "us") collects, uses, discloses, retains, and protects personal information when you use Catalog Pro's website, mobile applications, software, marketplace features, communications, APIs, and related services (collectively, the "Platform").

This Policy applies to individuals who use the Platform as Organization users, Recipients, Merch Partner users, Product Brand or supplier contacts, visitors, prospective customers, and other authorized users. Supplemental privacy notices may apply to particular features, programs, jurisdictions, or relationships.

2. Our Privacy Principles

Catalog Pro is designed around data minimization, purpose limitation, role- and Organization-based access, server-side authorization, auditability, and separation of personal, Organization, Merch Partner, financial, security, governance, and product-intelligence information.

We seek to collect the minimum trustworthy information reasonably necessary to provide and improve the merchandise experience. Possession of information does not give Catalog Pro unrestricted rights to use it.

3. Information We Collect

Depending on how you use the Platform, we may collect the following categories of information:

• Account and identity information, such as name, email address, phone number, login and authentication information, role, Organization affiliation, and account settings.
• Organization information, such as company or team name, workspace settings, rosters, programs, artwork, budgets, approvals, order history, and authorized-user information.
• Recipient personal information, such as apparel sizes, fit information, preferences, shipping details, contact information, feedback, product history, wish lists, and other optional profile fields.
• Merch Partner information, such as business contact information, capabilities, product and supplier mappings, internal SKUs, private pricing, proposals, quotes, equipment, production information, purchasing sources, and operational records.
• Marketplace and transaction information, such as RFQs, invitations, quotes, counter-offers, awards, purchase orders, order items, shipping and fulfillment information, refunds, disputes, fees, processor identifiers, and related records where applicable.
• User Content and communications, such as messages, support requests, files, artwork, images, reviews, documents, comments, and feedback.
• Safety and abuse reports you submit through in-app reporting, including the content you report (such as an AI-generated Risp reply, or a Pulse question and the person who posted it) and any reason you provide, which we collect and review to keep the Platform safe and to enforce our policies. These reports are associated with your account and are removed when your account is deleted.
• Device and usage information, such as IP address, browser type, device type, operating system, app version, pages/screens viewed, timestamps, interactions, diagnostics, crash information, and security logs.
• Mobile permissions and device features you choose to enable, such as notifications, camera, photo library, files, or similar device resources needed for a feature.
• Integration information obtained through services you authorize Catalog Pro to connect to, subject to the permissions and scopes you approve.
• AI-feature information, including prompts, inputs, context, outputs, feedback, and related metadata when you use Risp or another model-assisted feature, to the extent needed to provide, secure, evaluate, and improve that approved feature.
• Cookies, local storage, SDKs, and similar technologies used for authentication, security, preferences, analytics, diagnostics, and Platform operation.

4. Sources of Information

We may collect information:

• directly from you;
• from your Organization or another authorized user who adds you to a workspace, roster, team, order, or program;
• from a Merch Partner, Product Brand, supplier, or other marketplace participant involved in an authorized workflow;
• from integrations or third-party services you or your Organization authorize;
• automatically from your device and use of the Platform;
• from public or licensed product and business sources where permitted;
• from information Catalog Pro generates through approved analytics, matching, recommendation, security, or governance processes.

5. How We Use Information

We may use information to:

• provide, operate, maintain, and secure the Platform;
• create and manage accounts, Organizations, permissions, and access;
• support merchandise programs, recipient profiles, sizing, preferences, RFQs, quotes, orders, production, shipping, reorders, and support;
• connect Organizations and Merch Partners and operate marketplace workflows;
• process or facilitate payments, fees, refunds, disputes, and payouts when those features are enabled;
• provide customer support and communicate about the Platform;
• prevent fraud, abuse, unauthorized access, and security incidents;
• maintain audit, governance, and compliance records;
• improve product data, workflows, recommendations, sizing support, Catalog Pro OS, Risp, and other approved intelligence systems;
• measure performance, analyze usage, and develop new features;
• produce aggregated or de-identified analytics, trends, benchmarks, and research;
• comply with legal, tax, accounting, contractual, security, and regulatory obligations.

Catalog Pro does not silently use private customer information to train unrestricted general-purpose models. Any use of private information for AI or model-improvement purposes must follow approved purposes, access controls, applicable agreements, notices, and law.

6. Recipient Profiles and Organization Access

A Recipient's sizes, fit information, preferences, shipping details, feedback, and product history are personal information. Catalog Pro provides mechanisms, within the Platform or through privacy requests, for Recipients to review or correct applicable profile information and exercise applicable privacy rights.

An Organization does not receive unrestricted access to a Recipient's entire profile simply because the person is an employee, player, member, volunteer, or participant. Catalog Pro seeks to limit Organization access to information reasonably necessary and authorized for legitimate merchandise programs and related purposes.

When a Recipient leaves an Organization, Catalog Pro's policy is to limit the Organization's ongoing access to current personal profile information, except where historical records must remain available for completed orders, legal obligations, audit, fraud prevention, or dispute resolution.

7. Merch Partner and Marketplace Information

Catalog Pro may share authorized order, recipient, artwork, specification, shipping, and other information with a Merch Partner when reasonably necessary for an RFQ, quote, awarded job, production, fulfillment, support, dispute, or other approved marketplace purpose.

Catalog Pro seeks to protect each Merch Partner's confidential business information, including private pricing, proposal details, supplier mappings, margins, purchasing sources, and operational information, from unrelated Organizations and competing Merch Partners except where disclosure is authorized or required by law.

8. How We Disclose Information

We may disclose information to:

• your Organization and its authorized users, subject to role, purpose, and minimum-necessary access;
• Merch Partners, suppliers, carriers, and other transaction participants as needed to request, quote, produce, fulfill, ship, support, or resolve an authorized merchandise transaction;
• service providers that help us with hosting, authentication, communications, analytics, support, security, AI/model services, payments, shipping, infrastructure, and other Platform functions, subject to appropriate contractual and security controls;
• third-party integrations you or your Organization authorize;
• professional advisers, auditors, insurers, financing sources, or transaction counterparties where reasonably necessary and subject to appropriate confidentiality obligations;
• law enforcement, regulators, courts, or other parties when required by law or when reasonably necessary to protect rights, safety, security, or the integrity of the Platform;
• a successor or potential successor in connection with a merger, financing, reorganization, acquisition, sale of assets, or similar transaction.

We may also disclose aggregated or de-identified information that does not reasonably identify an individual or expose confidential Organization or Merch Partner information.

9. Sale, Sharing, and Targeted Advertising

Catalog Pro does not sell Recipient personal information. Catalog Pro does not currently sell personal information for money.

If Catalog Pro later engages in practices that constitute a "sale," "sharing," or targeted advertising under an applicable privacy law, we will update this Policy, provide required notice, and provide any required opt-out or consent mechanism before or when the practice becomes effective.

10. Cookies, Analytics, and Similar Technologies

Catalog Pro may use cookies, local storage, mobile SDKs, pixels, and similar technologies for authentication, security, preferences, diagnostics, analytics, performance, and Platform operation.

Browser and device controls may allow you to limit some technologies. Disabling essential technologies may prevent parts of the Platform from functioning.

11. Mobile Application Permissions

The Catalog Pro mobile application may request access to device features such as notifications, camera, photos, files, or other permissions when needed for a feature. You can manage these permissions through your device settings.

Catalog Pro requests device permissions only when needed for a defined Platform purpose. If you deny a permission, the related feature may not work, but other parts of the Platform may remain available.

12. Artificial Intelligence and Risp

When you use Risp or another AI/model-assisted feature, Catalog Pro may process the prompts, files, context, product information, account context, and outputs needed to provide and secure the feature.

In the mobile app, Risp is optional and off until the player or employee gives explicit AI-sharing permission. For a player aged 13–17, Risp accepts only selected questions about that player's Catalog actions, gear sizes, and order status; free-text chat is unavailable. When Risp is used, the selected question and relevant authorized account information may be sent to Anthropic's Claude service, sometimes through Vercel AI Gateway. Turning AI sharing off stops future requests but cannot recall information already sent. You can report an unsafe reply from the Risp screen or contact cy@catalogpro.ai.

When an employer or coach creates or edits a Pulse, the text they write — the question, the answer options, and any captions — is sent to an automated AI safety service (Anthropic's Claude) to be checked for harmful content before the Pulse can publish to recipients. This automated screening runs on the author's own typed text, at the time they create or change it. No recipient profile information, votes, or comments are automatically added to what is sent — only the text the author typed. If an author chooses to type someone's name or other details into that text, those words are part of the text that is checked.

AI access to private information is subject to Catalog Pro's permissions and approved purposes. Catalog Pro applies access controls intended to prevent AI features from receiving broader access than the requesting user or workflow is authorized to access.

Catalog Pro does not treat private conversations as automatic institutional truth, and private customer information does not automatically become unrestricted Catalog Pro or general-model training data.

13. Data Retention

Catalog Pro retains information for as long as reasonably necessary for the purpose for which it was collected, to provide the Platform, maintain accurate transaction and audit history, protect security, resolve disputes, enforce agreements, and comply with legal, tax, accounting, and contractual requirements.

Retention periods may vary by data category. Catalog Pro may retain some historical transaction, financial, security, governance, and audit records after an account or Organization relationship ends when necessary for legitimate legal or operational purposes.

When information is no longer needed and no retention obligation applies, Catalog Pro may delete, anonymize, or de-identify it.

For a confirmed deletion request from an employee or player using our mobile app or our web deletion page, we close that person's access and aim to finish routine requests within 24 hours. We remove the account and associated personal information from our active systems within seven calendar days. We remove or de-identify that person's information in shared records while preserving other people's accounts and the Organization or team. We send a request receipt and a completion notice. If a specific open transaction or legal obligation prevents routine completion, we restrict access and review only the information needed for that obligation.

We retain a minimal record of the deletion request and outcome for up to 24 months after completion. Routine authentication-security events stored in our database are kept for 12 months; we remove a deleted person's identifying fields during account erasure. A specific event may be kept longer only under a documented incident or legal hold with an expiry. Other transaction or compliance records are retained only for an applicable, documented purpose and period.

Restricted backup copies and records held by our service providers may remain for their separate lifecycles after active-system erasure. We do not use them to operate a deleted account. If we restore a backup, we reapply completed deletion decisions before giving users access to the restored system. Copies already downloaded to a device or held independently by an Organization, team, supplier, or other recipient are subject to that party's own practices.

14. Security

Catalog Pro uses administrative, technical, and organizational safeguards designed to protect information. Depending on the system and data involved, safeguards may include role- and Organization-based access controls, server-side authorization, least privilege, authentication controls, encryption, security logging and monitoring, secure credential practices, and other measures appropriate to the sensitivity of the information.

No system is completely secure. You are responsible for protecting your credentials and promptly notifying Catalog Pro if you believe your account or information has been compromised.

15. Your Choices and Privacy Rights

Depending on your location and relationship with Catalog Pro, you may have rights to access, correct, delete, obtain a copy of, or restrict certain uses of personal information, and to appeal certain privacy decisions. You may also be able to update profile information directly in the Platform.

To make a privacy request, contact cy@catalogpro.ai. We may need to verify your identity or authority before completing a request. Authorized agents may submit requests where permitted by law, subject to verification requirements.

Employees and players can request deletion of their entire mobile account in the app under You → Account privacy → Delete account, or on the web at https://www.catalogpro.ai/delete-account. A code sent to the account email confirms the request. You do not need to contact support to start ordinary account deletion.

Some information may be exempt from a request or may need to be retained for legal, security, transaction, fraud-prevention, audit, or other permitted purposes.

16. U.S. State Privacy Rights

Residents of certain U.S. states may have additional rights under applicable privacy laws, including rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, opt out of certain sales, sharing, targeted advertising, or profiling, and appeal a denied request.

Catalog Pro will honor applicable rights based on the law that applies to the individual and the relevant processing activity. Catalog Pro will not unlawfully discriminate against you for exercising a privacy right.

17. International Users

If you use Catalog Pro from outside the United States, your information may be processed in the United States or other countries where Catalog Pro or its service providers operate. Those countries may have different data-protection laws.

Where required, Catalog Pro will use appropriate legal mechanisms and safeguards for international transfers and will provide additional jurisdiction-specific notices when applicable.

18. Children and Minors

Catalog Pro does not offer accounts to children under 13. Player accounts are for people 13 or older; employee and business-role accounts are for adults 18 or older. Before mobile account creation, Catalog asks for a birth date to calculate eligibility on the device. The app sends the resulting completed age in years for a server-side admission check; Catalog retains an age band and declaration/recheck dates in the account rather than the full birth date. An existing mobile account may be asked to make the same declaration before continuing.

For an authorized player program, a team or school may supply roster information before the player creates an account. That information can include a player's name, team affiliation, contact details, and program information. The Organization can view and manage its own roster and information needed for its merchandise program; a Merch Partner receives only information needed for an authorized quote, order, or fulfillment task. School-supplied student information requires a separate agreement or other lawful basis defining permitted purpose, access, service providers, retention, and deletion before it is imported. A roster entry or invitation does not establish the player's age or authorize optional AI sharing.

Players may provide their own email, fit/sizing information, shipping details where requested, Pulse votes and private comments, and optional Risp permission. A Pulse comment can be shown to the responsible Organization; it is not a peer-to-peer comment feed. Individual votes are not shown to other players. The player can use account privacy controls and contact cy@catalogpro.ai about access, correction, or deletion, subject to applicable record-retention duties.

If you believe Catalog Pro has collected personal information from a child in a manner that does not comply with applicable law, contact cy@catalogpro.ai.

19. De-Identified and Aggregated Information

Catalog Pro may create and use aggregated or de-identified information for analytics, benchmarking, research, product development, marketplace health, and commercial insights where permitted by law and applicable agreements.

Catalog Pro seeks to prevent de-identified or aggregated information from being used to reveal identifiable Recipients, confidential Organizations, or private Merch Partner economics.

20. Third-Party Links and Services

The Platform may contain links to or integrations with third-party services. Their privacy practices are governed by their own policies, not this Privacy Policy, when they process information independently.

Catalog Pro encourages you to review the privacy terms of any third-party service you choose to connect to or use.

Data from connected services (for example, Google Workspace). When an administrator connects a third-party service such as Google Workspace, Catalog Pro accesses, with the administrator's explicit consent, a read-only copy of that organization's employee directory profile data — names and email addresses — through that service's API (for Google, the Admin SDK Directory API using the admin.directory.user.readonly scope). Catalog Pro uses this data solely to add those employees to the administrator's roster and to send them Catalog invitations.

Catalog Pro does not sell this data, use it for advertising, or share it with third parties other than sub-processors that operate the Platform on Catalog Pro's behalf. Catalog Pro's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. An administrator may disconnect a connected service, or remove imported people, at any time, which stops further access.

21. Changes to This Privacy Policy

Catalog Pro may update this Privacy Policy as the Platform, law, or our practices change. If a change is material, we will provide notice as required by law, which may include posting the updated Policy, providing in-product notice, or sending an email.

The Effective Date at the top identifies the current version.

22. Contact Us

VIXIV LLC d/b/a Catalog Pro
646 W 1080 North Cir
American Fork, UT 84003
Email: cy@catalogpro.ai
Website: https://catalogpro.ai