Privacy Policy

GUY MENTESH LTD, trading as Catalog Manager. Effective Date: April 1, 2026 · Version 2.0

1. Introduction

This Privacy Policy explains how personal data is collected, used, stored, and protected when you use Catalog Manager ("the Service"). Catalog Manager is a standalone music catalog management platform for record labels, artists, managers, and rights holders. The Service is offered globally and may be accessed by users worldwide.

This policy complies with the GDPR (EU), CCPA/CPRA (California), LGPD (Brazil), PIPEDA (Canada), and other applicable privacy laws. Where you act as Data Controller, you are responsible for compliance with applicable data protection laws in your jurisdiction.

2. Roles and Responsibilities

2.1 Data Controller Identity

Catalog Manager is operated by GUY MENTESH LTD, a company incorporated in Israel, trading as Catalog Manager. Privacy inquiries: legal@catalogmanager.app.

2.2 Catalog Manager as Data Processor

Catalog Manager acts as a Data Processor. We provide the technology platform and infrastructure. We process personal data only on your instructions, and as necessary to provide, maintain, and secure the Service. We do not decide what data to collect or how to use it. You do.

2.3 You as Data Controller

When you create an account and upload data to Catalog Manager, you are the Data Controller:

• You decide what personal data to upload (artist names, financial figures, rights holder splits, statement data).
• You are responsible for having the legal right to upload and process that data.
• You are responsible for the accuracy of all data you enter.
• If you upload personal data about third parties, you must have a lawful basis (typically a contract with those individuals).

2.4 Independent Artists

If you are an independent artist managing your own catalog, you are both the Data Subject and Data Controller of your own data.

3. Data We Collect

3.1 Data We Collect Directly (as limited Controller)

• Account credentials: email address, hashed password, organization name.
• Usage data: login timestamps, feature usage, browser/device type.
• Consent records: timestamp and version of Terms and Privacy Policy accepted.

For this data, Catalog Manager is the Data Controller. Lawful basis: contractual necessity (GDPR Art. 6(1)(b)).

3.2 Data You Upload (You as Controller, We as Processor)

What we do NOT collect: We do not collect or store the following GDPR Art. 9 special categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or data concerning sex life or sexual orientation. We also do not store full payment card numbers (billing is handled by our merchant of record, Paddle).

3.3 Identity Verification (KYC)

If you are required to verify your identity (for example, before receiving payouts or accessing certain features), we collect identity verification data through our processor Shufti Pro:

• What we collect: An image of a government-issued identity document and a facial or liveness image used to confirm that the document belongs to you.
• Purpose: Identity verification and fraud prevention.
• Legal basis: Compliance with a legal obligation (Art. 6(1)(c)) and our legitimate interest in preventing fraud (Art. 6(1)(f)). The biometric facial and liveness check is a GDPR Art. 9 special category, processed only on the basis of your explicit consent (Art. 9(2)(a)), which we obtain at the verification step.
• Processing and transfers: Verification is performed by Shufti Pro as a sub-processor. Any international transfer is carried out under appropriate safeguards (such as Standard Contractual Clauses).
• Retention: Verification data is retained only as long as needed to complete verification and to keep any legal record we are required to keep, then deleted.

4. Lawful Basis for Processing

4.1 Account Data (We as limited Controller)

• Contractual Necessity (Art. 6(1)(b)): To provide the Service.
• Legitimate Interest (Art. 6(1)(f)): Security and service improvement.
• Consent (Art. 6(1)(a)): Optional features like marketing.

4.2 User-Uploaded Data (You as Controller)

You determine the lawful basis for data you upload. We process it solely on your instructions as Processor, governed by the DPA.

5. How We Use Your Data

• Providing the Service: hosting, storing, displaying your data.
• Authentication and account management.
• Optional third-party integrations when you authorize them.
• Platform security and integrity.
• Service improvement (aggregated, anonymized patterns only).
• Critical service communications.

6. Data Sharing and Sub-Processors

We do not sell, rent, or share your personal data with any third party. We use the sub-processors below to operate the Service. Each one is bound by a data processing agreement and receives only the data necessary for its function.

Core infrastructure:

• Supabase (database, authentication, file storage): hosts your account and catalog data. SOC 2 Type II, AES-256 at rest, TLS in transit.
• Vercel (application hosting and cookieless analytics): serves the application and collects privacy-friendly, cookieless usage metrics.
• Upstash (rate limiting): protects the Service against abuse.
• Sentry (error monitoring): captures application errors for debugging. Session Replay is disabled.

Communications and billing:

• Resend (transactional email): sends account and service emails.
• Paddle (billing, merchant of record): processes payments. Paddle is the merchant of record and handles card data, so we do not store full card numbers.

Identity verification:

• Shufti Pro (identity verification): processes the government ID document and facial or liveness image you submit at the verification step. See section 3.3.

Optional integrations you connect:

• Google and Gmail (optional): OAuth login and, if you enable the Gmail Scanner, read-only inbox access using the gmail.readonly scope to detect and parse music distributor royalty statement emails. See section 6.1 below for the full Limited Use disclosure.
• Spotify (optional): OAuth token and display name only.

AI features:

• Anthropic, Groq, and Google Gemini: power optional AI features and receive only the content you submit to the relevant feature.

Music distribution and audio:

• LabelGrid (distribution): delivers releases you choose to distribute.
• ACRCloud (audio fingerprinting): identifies audio you submit for fingerprint matching.

Read-only metadata sources: The following receive only non-personal search terms (such as a track title, ISRC, artist name, or company name) to look up public catalog or registry metadata, and receive no account data: Spotify, Apple Music and iTunes, Beatport, Songstats, Soundcharts, Deezer, Discogs, UK Companies House, and data.gov.il.

OAuth tokens (for example, from Spotify and Google) are stored securely (AES-256-GCM encryption at rest) and used only to enable the integrations you request. Tokens are deleted when you disconnect an integration or close your account.

We will notify users of material sub-processor changes via email or in-app notification. We may disclose data if required by law.

6.1 Google API Services: Limited Use Disclosure

Catalog Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Gmail, Catalog Manager requests the gmail.readonly scope solely to detect and parse royalty statement emails sent by music distributors (e.g., DistroKid, TuneCore, CD Baby, Believe, Symphonic, AWAL). Specifically:

• What we read: Only emails matching distributor sender addresses and statement-related keywords. Other emails are not read, indexed, or stored.
• What we extract: Royalty figures (track title, period, payout amount) and attached statement files (PDF/CSV) referenced in matching emails.
• What we store: Parsed financial figures, encrypted at rest in our database, scoped to your account. Raw email bodies are not stored on Catalog Manager's servers.
• What we never do: We do not send email on your behalf, modify or delete your inbox, transfer Gmail data to third parties, use Gmail data to serve advertising, or allow humans to read your Gmail data except as required for security investigations or with your explicit consent.
• Disconnect: You can disconnect Gmail any time inside Catalog Manager (Settings → Connected accounts) or at myaccount.google.com/permissions. Disconnecting revokes our refresh token and stops all further access immediately.

7. Data Security

We rely on third-party infrastructure providers (such as Supabase) that implement industry-standard security measures, including encryption at rest and in transit. We also implement application-level controls:

• Row-Level Security: database-enforced organizational isolation.
• Statement protection: secondary password, session-scoped access.
• Financial blur: option to hide amounts for screen privacy.
• Session-based access: expires on session end.

8. Data Retention

• Account Data: While active. Deleted within 30 days on request.
• Catalog Data: While active. Exportable, deletable on request.
• Financial Data: Up to 7 years per record-keeping law. Exportable anytime.
• Splits: While active. Deletable subject to record-keeping.
• Usage Logs: Up to 12 months, then anonymized/deleted.
• Tokens: Deleted on disconnect or account closure.

9. Your Rights

Depending on your jurisdiction, you may have rights under applicable data protection laws, including the right to access, correct, delete, restrict, port, and object to the processing of your personal data.

9.1 Account Data (We as Controller)

GDPR/CCPA/LGPD/PIPEDA and equivalent local laws: access, rectify, erase, restrict, port, object. Contact us and we will respond within 30 days.

9.2 Uploaded Data (You as Controller)

You control it. Edit, export, delete anytime. Third-party requests redirected to you; we assist.

9.3 US Privacy Laws

We do not sell or share personal data as defined under applicable US privacy laws, including the CCPA/CPRA.

10. International Transfers

Personal data may be transferred and processed outside your country of residence. Where required, appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms are implemented in accordance with applicable law.

11. Cookies

We use only strictly-necessary cookies required for the operation of the Service (authentication, session management, and billing). We do not use advertising or cross-site tracking cookies, and we do not build advertising profiles.

• Vercel Analytics: cookieless. It measures usage without setting cookies or tracking you across sites.
• Sentry: cookieless error monitoring. Session Replay is disabled.
• Paddle: sets strictly-necessary cookies required to process billing during checkout.

Because we set no advertising or tracking cookies and our analytics are cookieless, no cookie consent banner is required.

12. Children

Not for under-16s. No knowing collection from children.

13. Policy Changes

Material changes: email/in-app notice, updated date/version, renewed consent where required.

14. Breach Notification

Authority notified within 72 hours. Users notified if high risk. All applicable laws followed.

15. Complaints

Our lead supervisory authority is the Israeli Privacy Protection Authority (PPA). You may lodge a complaint with them at gov.il/en/departments/the_privacy_protection_authority. If you are in another jurisdiction, you may also have the right to complain to your local data protection authority.

16. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Israel, without regard to conflict of law principles. The competent courts of Tel Aviv-Yafo, Israel shall have exclusive jurisdiction over any dispute arising from this policy. Nothing in this policy limits any rights you may have under mandatory local law in your jurisdiction.

17. Contact

GUY MENTESH LTD (trading as Catalog Manager)
Israel
Email: legal@catalogmanager.app