Privacy Policy

Effective: 11 September 2026 · catalogvisible.com is operated by Yahya Acun ("we"). Contact: contact@catalogvisible.com

What we collect

• The store domain you submit. This is public information about a store; we use it to run the audit you requested and keep it as part of the audit record.
• A salted hash of your IP address. We never store your raw IP in the audit database. The one-way hash is used only to enforce fair-use limits (audits per day per network). It cannot be reversed to your IP and is not linked to any profile.
• Transient server logs. Like almost every website, our web server briefly logs request metadata (including IP addresses) for security and operations. These logs rotate and are not used for profiling or marketing.
• Anonymous first-party page counts. We record that a page was viewed (which page, when, and which external site linked to it). No IP address, no device identifier, no cookie — these counts cannot be tied to you.
• Your email — only if you ask. If you request updates from a report page, we store your address with a strict double opt-in: nothing is sent beyond a single confirmation email unless you click the confirmation link. Every email we send includes an unsubscribe link; unsubscribing takes one click and needs no login. Emails are delivered through a transactional email processor acting on our instructions.
• A checkout consent record — only if you buy a paid plan. When you tick the waiver box on the checkout page we store, as a permanent record of that consent, the version and hash of the text you agreed to, the time, the plan, a salted hash of your IP address and your browser's user-agent string. This record is legal evidence of the waiver and is not used for anything else.
• An account — only if you create one. Buying a paid plan requires an account. For an account we store your e-mail address, a salted argon2id hash of your password (never the password itself), the account status, and a one-time e-mail confirmation token that expires after 48 hours. Signing in sets one cookie holding a random session token; the database keeps only a SHA-256 hash of it, and the session expires after 7 days or when you sign out. A password-reset link is valid for 60 minutes and can be used once; using it signs out every session. A subscription you buy is linked to the account (plan, billing period, status, and the billing e-mail reported by our payment processor), and the account page shows it. When a scheduled measurement of your plan finishes, we e-mail that address a link to the report — a service notice, one per measurement, for as long as the subscription runs; receipts, payment issues and cancellation confirmations come from our payment processor. We send no marketing e-mail. We keep account data for as long as the account exists. To close your account, write to contact@catalogvisible.com from the account's e-mail address: we disable sign-in and stop using the address; the checkout consent record and the subscription record are kept as legal evidence of the purchase and are not deleted.

What we do NOT do

• No cookies, no trackers, no third-party analytics on this site.
• No selling or sharing of your data with third parties for their own purposes.
• No marketing to unconfirmed addresses — if you never click the confirmation link, you never hear from us again.

How audits work with third parties

To measure AI visibility we send shopping-style questions about the store's product category and brand to AI providers (OpenAI and Google) through their APIs. These queries describe the store being audited — they contain no personal data about you as a visitor.

Audit records

Audit results (scores, probe responses, coverage) are kept as immutable measurement records — that permanence is what makes our reports trustworthy. They describe a store's public visibility, not a person. Reports are reachable only through their unguessable link. We do not accept requests to delete audit records: they describe publicly available storefront data and contain no personal data about you. If a store's public catalog is later closed off, future audits simply cannot read it; existing records remain.

Your rights

Under GDPR and similar laws you may request access to or erasure of personal data we hold about you. In practice we hold very little: the salted IP hash cannot be linked back to you, store domains are public business information, and the only directly identifying data is the e-mail address of an account or of a confirmed update subscription. For any request or question, email contact@catalogvisible.com.

Hosting

The service is hosted on servers in the United States (Hetzner, Ashburn, VA). TLS encrypts all traffic.

Changes

We will update this page before any change in what we collect takes effect, and the effective date above will change accordingly.