Catalot Privacy Policy

Effective November 2, 2026.

1. Who we are

Catalot is an online auction marketplace and software service operated by CATALOT LLC, a Missouri limited liability company ("Catalot," "we," "us"), PO Box 13, Saint Charles, MO 63302. Auction companies ("sellers") use Catalot to run online auctions; buyers use it to find, bid on and pay for items. This policy explains what personal information we collect, how we use and share it, and your choices. Questions: support@catalot.com.

Each seller is a separate business. When you register for, bid in or buy from a seller's auction, that seller also receives your information and handles it under its own policies.

2. Information we collect

You give us:

Account details: name, email, phone number, postal address, password (stored only as a secure hash), and confirmation that you are 18 or older.
Auction activity: registrations and the terms you accepted, bids and maximum bids, watched lots, saved searches, follows, private notes and planned maximums on your watchlist (sellers cannot see these), and messages with sellers.
Payment information: cards are collected and stored by our payment processor, Stripe. We never see or store your full card number; we keep only the card brand, last four digits and a Stripe reference. We also keep a code Stripe gives us for each card. It can't be used to charge the card or reveal its number. We use it only to spot accounts that may belong to the same person.
Tax and regulated-item details, when you choose to provide them: resale or tax-exemption certificates (number, state, expiry and the uploaded file), and for certain regulated items your state of residence, age confirmation and the details of a receiving licensed dealer.
Pickup and shipping details: pickup bookings, the name of anyone you send to collect for you, and shipping addresses.
Referral requests: if you ask us to connect you with estate sale or auction companies, your ZIP code, town, what you are selling, timeline, notes, name, email, phone and contact preference. If a professional (such as a realtor or attorney) submits a request for a client, we also collect the professional's name, firm, role and contact details.
Seller and staff information: company details, staff names and emails, sign-in security settings, licenses, consignor records, and photos, voice notes and videos uploaded to catalog items.

We collect automatically:

Location you choose to share: a ZIP code or city you enter, or, only if you tap "Use my location," your device location rounded to about 1 km, saved in a cookie to show nearby auctions.
Usage and device information: pages and auctions viewed, how you arrived (for example a link from a seller or a search), and technical information such as IP address and browser type, used for security, rate limiting and abuse prevention. We do not use third-party advertising or analytics trackers.
Email engagement: marketing emails sent by sellers through Catalot record whether they were opened and which links were clicked.

3. How we use information

To run accounts, auctions, bidding, invoices, payments, pickup and shipping.
To send transactional messages (outbid, won, invoice, pickup, messages from sellers) by email, text or push, as you choose in your settings.
To send marketing you can opt out of at any time: Catalot's weekly auction digest, saved-search alerts, and seller announcements and campaigns.
To match referral requests with up to 3 nearby companies.
To prevent fraud and abuse, including limits for new bidders and reliability information shared with sellers (section 5).
To improve Catalot, measure which channels bring buyers to sellers, and comply with law.
AI-assisted cataloging: sellers' item photos and voice-note transcripts are processed by an AI model (Anthropic's Claude, run on Amazon Web Services) to draft item descriptions. This does not include buyers' personal information.

4. Cookies and similar technology

We use first-party cookies only: to keep you signed in, remember the location you chose, remember display preferences (such as grid or list view), and record how you first arrived at a seller's storefront. We use browser storage for preferences such as dismissed prompts. We do not use advertising cookies or sell browsing data. You can clear cookies in your browser; you will need to sign in again.

With sellers. When you register for a seller's auction, that seller receives your name, contact details, address, registration answers, bids, invoices, tax certificates you submit to them, and shipping or dealer details for your purchases. Seller staff see contact details masked until needed, and each reveal or export is logged. Sellers may export the list of bidders registered in their auctions.
Reliability information. To help sellers decide whom to approve, sellers can see a summary of your history across Catalot: auctions won, share of invoices paid on time, and unpaid invoices or missed pickups in the last 12 months. You can contact us at support@catalot.com if you believe it is wrong.
Referral requests go only to the companies we match you with (up to 3). They may contact you by the method you chose. We never sell referral information.
Service providers who process data for us under contract: Stripe (payments), Amazon Web Services (hosting, email, storage, transcription and AI processing), Twilio (text messages), EasyPost (address verification and shipping labels), and browser push services (to deliver notifications you enable). Map tiles are loaded from OpenFreeMap when you view a map.
Legal and safety: when required by law, to protect rights and safety, or in connection with a merger or sale of our business.

We do not sell your personal information and do not share it for targeted advertising.

6. Your choices

Change your profile, address, password and notification settings in your account.
Turn off each notification type by email, text or push (except essential messages about purchases you won, payments and pickup).
Unsubscribe from marketing emails with the link in each email. Reply STOP to any text to stop texts.
Request a copy of your information, or ask us to correct or delete it, at support@catalot.com. We may keep records we must retain by law or for a seller's accounting (see section 9).

7. Email and text messages

Text messages are sent only if you opt in. Message and data rates may apply; reply STOP to cancel and HELP for help. Consent to texts is not a condition of any purchase. We never sell or share your mobile number or your text-message opt-in with third parties or affiliates for their marketing or promotional purposes; the providers who send texts for us (Twilio) use them only to deliver our messages. Section 15 of our Terms of Use covers text messages in full. Marketing emails include an unsubscribe link and our mailing address. Some seller campaign emails use a small image and tracked links to record opens and clicks.

8. Security

We use encryption in transit and at rest, strict separation of each seller's data at the database level, a web application firewall, hashed passwords and session tokens, two-step sign-in for seller owners and managers, and audit logs of access to contact details. No system is perfectly secure; tell us at support@catalot.com if you suspect a problem.

9. How long we keep information

Inactive bidder accounts: after 24 months without activity we send a notice; after 27 months we remove your name, contact details, password, messages' text and Stripe customer record. Bids, registrations and invoices are kept under your anonymous paddle number for the seller's records.
Invoices and tax records: kept as long as needed for sellers' and our legal and tax obligations 7 years.
Referral requests: 24 months, then deleted.
Tax certificates: until they expire plus the period the law requires us to keep them.
Backups and logs expire on rolling schedules (for example database backups after 14 days).

10. Children

Catalot is for people 18 and older. We do not knowingly collect information from children under 13. Contact us if you believe a child has given us information.

11. Changes

We will post changes here with a new effective date and notify account holders of material changes by email or on the site.

12. Contact

CATALOT LLC, PO Box 13, Saint Charles, MO 63302, support@catalot.com.