Privacy Policy

Effective date: August 29, 2026

This policy explains what CatalogVitals ("we", "us") collects, why, and what we do with it. The short version: we collect the minimum needed to run the product, we can only read your point-of-sale catalog, we never sell data, and you can have everything deleted by sending one email.

1. What we collect

• Account information. Name, email address, and a securely hashed password for each user login you or your store admin creates. Passwords are stored as salted bcrypt hashes; we cannot read them.
• Catalog data from your POS. When you connect Lightspeed Retail (R-Series) via OAuth with a read-only inventory scope, we sync your product catalog: items, descriptions, SKUs, barcodes, categories, brands, prices, costs, stock levels, and product image references. This scope does not give us access to your customers, sales transactions, or payment data, and we do not collect them.
• Content you upload. Product images and copy you add manually or through the bulk importer.
• Operational logs. Standard technical logs (timestamps, request paths, IP addresses) kept briefly for security and debugging.

We do not use advertising trackers, analytics cookies, or fingerprinting on this website. The application uses only the cookies required to keep you signed in and to protect forms against cross-site request forgery.

2. How we use it

• To provide the Service: computing your catalog health score, reports, dashboards, and worklists from your synced catalog.
• To send transactional email: password resets, account invitations, and the weekly catalog health digest to your store's admin users. These are part of the Service, and the digest can be disabled on request.
• To respond when you contact support.
• To secure and improve the Service using aggregate, non-identifying measurements.

We do not sell or rent your data, use your catalog to benchmark or advantage other customers, or send marketing email you didn't ask for.

3. Where your data lives, and who processes it

Your catalog cache and account data are stored on infrastructure we control, with access restricted to the operator of the Service. We use a small set of service providers ("subprocessors") to run CatalogVitals:

• Lightspeed Commerce Inc. — the source of your catalog data, accessed read-only under the authorization you grant.
• Cloudflare, Inc. — DNS, network security, this website, and email routing.
• Resend, Inc. — delivery of transactional email (recipient address, subject, and message content pass through their systems).
• Stripe, Inc. — payment processing for paid plans, when billing is enabled. We never see or store your full card details.

4. Security

All traffic to the Service is encrypted in transit (TLS). POS access tokens and databases are stored with restricted file permissions on hardened hosts, the application runs without administrative privileges, and the POS connection is read-only by both scope and code — the application contains no write path to your store. No system is perfectly secure, but the blast radius of this one is deliberately small.

5. Retention and deletion

• Catalog data is retained while your store is connected, so scores and history stay accurate. Items removed from your POS are removed from the cache at the next sync.
• Disconnecting your Lightspeed account (from either side) stops all syncing immediately.
• Email [email protected] and we will delete your account, cached catalog, uploaded content, and stored tokens — typically within 7 days, confirmed in writing.
• Operational logs rotate automatically on a short schedule.

6. Your rights

You can request a copy of the data we hold about your store, ask us to correct it, or ask us to delete it, by emailing [email protected]. We honor these requests regardless of where you live.

7. Children

The Service is a business tool and is not directed to children under 13; we do not knowingly collect their information.

8. Changes to this policy

If we make material changes, we will notify account holders by email before the changes take effect and update the date at the top of this page.

9. Contact

Privacy questions or requests: [email protected] · CatalogVitals, Wichita, Kansas, USA.