Who processes your data

Data controller: the catalog provider that created the AI agent you are interacting with. Each agent is linked to a specific provider.

Data processor: katalove.com (the technical platform hosting the chat) acts as a processor on behalf of the controller.

Data collected

Text of conversations with the AI agent
Email and phone number, if voluntarily provided during the conversation
IP address (for security and rate-limiting, not shared with the provider)

Purposes and legal basis

Contacts (email and phone) are collected at your explicit initiative to be contacted by the provider regarding catalog products. Legal basis: consent (art. 6.1.a GDPR).

Where the data lives and who processes it for us

We rely on external providers to run the service. Each one is appointed as a data processor. This is the full list.

Hetzner Online GmbH (Germany) — servers, database and catalog files. Data is stored on machines inside the European Union.
Anthropic PBC (United States) — receives the conversation text to generate the answer. Data sent through the API is not used to train the models.
OpenAI, L.L.C. (United States) — turns catalog text and questions into search indexes. Same rule: no training on data sent through the API.
Resend, Inc. (United States) — delivers the service emails: verification codes, order confirmations, supplier notifications. It processes the recipient address and the message content.

The three US providers process data outside the European Union. The transfer relies on the standard contractual clauses approved by the European Commission (art. 46.2.c GDPR).

The service only uses technical cookies: they keep the session open, tie the conversation to the catalog and remember the PIN of a private catalog. No profiling, no advertising, no data shared with anyone beyond the processors listed here.

Retention

An automatic routine applies the limits every day, with no one having to remember: conversations that produced no order are gone 30 days after the last message, the rest after 90, and the contacts you leave after 90. Agents not claimed within 72 hours are deleted along with everything they hold. You can ask for deletion sooner, at any time.

Orders follow a different rule. They stay in the provider's records, since accounting documents must be kept by law, but stripped of what identifies you: name, email, phone, shipping address and VAT number. What is left of the order is the date, the products and the amounts.

Your rights

You have the right to access, rectify, delete, and port your data.

To request the deletion of your data, send a request to: