Privacy Policy

This policy explains what information OZONE Catalog handles, why, and how long it is kept. The service is provided by the operator of OZONE Catalog (legal entity to be confirmed) (“we”). It covers the account holders and team members who use the service, people who visit published catalogs, and people who use this website and its contact form.

1. Accounts and teams

• What we collect: your name, email address and password when you sign up. The password is stored only as a one-way hash; we never store or log it in readable form. We record when you confirmed your email.
• Why: to create your account, confirm your email, let you sign in and reset your password, and send invitations from your team. These emails are only about your account; we send no marketing email.
• Sessions: while you are signed in, we keep a session record with your IP address and browser description, so you can see and sign out your other sessions. It ends when you sign out or after a period without activity.
• Teams: the businesses you belong to and your role in each are visible to the Owners and Admins of those businesses.

2. Business and catalog content

• We store the business profile, catalogs, sections, items, prices and images that you and your team add, to run the service for you.
• Drafts are private to your business’s team. Only what you publish is public: anyone with the link or QR code can see a published catalog, including the business details you choose to show (for example, a phone or WhatsApp number or an address).
• Images are stored in private storage. They are shown to your team through access-checked links, and to visitors only as published copies.
• Each business’s data is kept separate from other businesses’ at the database level.

3. Catalog visitors and analytics

• Published catalog pages set no cookies and load no third-party scripts, trackers or advertising.
• We count events in aggregate, per catalog and per hour: page views, QR redirect requests, item detail opens and contact taps. We store no IP address, browser description, cookie, referrer or visitor identifier with these counts, and no record of individual visits.
• To avoid counting the same visit repeatedly, a short-lived key is derived from the request (with a secret that changes every day) and kept in temporary memory for at most 30 minutes. It is never written to the database.
• Browsers that send Global Privacy Control or Do Not Track are not counted. Known bots and link-preview tools are not counted.
• When a visitor taps WhatsApp or Call, they contact the business directly through their own app; we only count the tap.

4. This website, cookies and the contact form

• This website and the workspace use two strictly necessary cookies: a session cookie (sign-in and your language choice) and a security token that protects forms. While a session exists, its record includes your IP address and browser description. We use no analytics or advertising cookies, and fonts and images are served from our own site.
• The contact form sends your name, email address and message by email to our support inbox, so that we can reply. The website does not store the message. To prevent abuse, a one-way hash of your network address is kept temporarily to limit the number of messages.

5. Platform administration

• Our platform administrators use a separate, protected console (with two-step sign-in). It shows operational information such as business names, members, catalog names and status. It does not show your draft content, media or analytics.
• Administrators can suspend or restore a business and change its plan. Every such action is recorded in an audit trail with who did it, when and why.

6. Security

Connections are encrypted. Access is limited by role, and each business’s data is isolated in the database. Passwords, sign-in codes, reset links and signed links are never written to logs. No method of storage or transmission is completely secure, but we work to protect your information and will act promptly on any incident.

7. How long we keep information

• Account and business data: while the account or business exists, and until a deletion request has been processed.
• Sessions: until you sign out, or after a period without activity (currently two hours).
• Aggregate analytics: 400 days, then deleted automatically.
• Published versions: each publish is kept as a fixed version so a catalog can be shown and restored reliably; published image copies are kept while a current version uses them.
• Audit trail: kept as a permanent record of changes and administrative actions.
• Contact messages: in our support inbox for as long as needed to answer them.

Final retention periods, including for deleted accounts and backups, will be confirmed during legal review.

8. Who we share it with

We do not sell personal information or share it for advertising. We use service providers to host the service and its storage and to send email; they process information only on our instructions. The list of providers and the countries where information is stored will be published here after legal review. We may disclose information when the law requires it.

9. Your rights and requests

• You can view and correct your name, and your business and catalog content, in the workspace at any time. To change your account’s email address, contact us.
• To ask for a copy of your information, its deletion (including closing your account), or to object to how we use it, use the contact form. Give your account’s email address; we may ask you to confirm the request from it. We will reply by email.
• Visitors to a published catalog: the business that publishes it is responsible for its content. Contact the business directly about it; contact us about this service.
• Depending on where you live, you may have further rights under data protection law, including complaining to a regulator. These will be set out here after legal review.

The service is meant for businesses and is not directed at children. See also the Terms of Service.