Privacy Policy
Last updated: 18 October 2026
Who we are
haatlabs is a sole proprietorship based in India. It runs this website and four products: Catalogpix, Catalogscout, MarginLedger and the haatlabs API. In this policy "we" means haatlabs. You can reach us at [email protected].
This policy explains what data we handle, why, who helps us process it, how long we keep it, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
This website
haatlabs.shop is a set of static pages. It sets no cookies and uses no analytics or tracking. Our host, Cloudflare, processes request data such as your IP address to deliver and protect the site. If you email us, we receive your email address and message; mail to [email protected] is forwarded by Cloudflare Email Routing, and we keep it as long as we need it to answer you.
Where our products run
Our products run on servers rented from DigitalOcean in Bengaluru, India. We keep logs and performance traces on our own monitoring system to run and fix the service; they are kept for a limited time.
Catalogpix
What we handle
- Your email address, used to send you a one-time sign-in code. There are no passwords.
- Your Shopify store's product data, images and settings, read through Shopify's API.
- Images found on the web for your products, previews of them, copies of images we replace (so a change can be undone), supplier catalogs you upload, and the text of web pages read to write product content. These are stored privately and never made public.
How long we keep it
- Candidate images nobody chose: removed within 15 minutes of the job ending.
- The rest of an image job's files: 30 days after the job ends.
- Copies of replaced images: 90 days after the change.
- Uploaded catalogs and the text of web pages read: 30 days after the import or content job ends.
- Your account details: kept until you delete your account, then removed within 30 days.
- When Shopify asks us to erase a store's data after the app is uninstalled, we delete everything of that store.
Who helps us
AI models reached through OpenRouter (to judge images and write product content), our own image search service, Stripe and Razorpay for payments, Shopify for payments made inside Shopify, and an email delivery service for sign-in codes.
Catalogscout
What we handle
- Your email address, used to send you a one-time sign-in code, and the members and roles of your organization.
- If you connect a Shopify store: its access token, kept encrypted, and the products you add to it.
- Your searches, the product pages you open, your lists and notes, and the products you track with their price, rating, rank and stock history.
How long we keep it
- Pages read from a source such as Amazon are cached for one hour.
- Your lists, notes, tracking history and account details: kept until you delete your account, then removed within 30 days.
- When Shopify asks us to erase a store's data after the app is uninstalled, we delete everything of that store.
Who helps us
Our own scraping service, which reads public product pages; Stripe and Razorpay for payments; Shopify for payments made inside Shopify; and an email delivery service for sign-in codes.
MarginLedger
What we handle
- Your email address and the details of your organization.
- Your Shopify store's orders, products, refunds and fulfilments, read through Shopify's API.
- Supplier and courier invoices you upload (PDF, JPEG or PNG), stored privately, and the data read from them.
- An audit record of who changed what.
How long we keep it
- Invoice files are deleted after your store's retention period (seven years unless you set another) once the invoice is confirmed or rejected. The figures read from them stay in your books.
- Your account details: kept until you delete your account, then removed within 30 days.
- When Shopify asks us to erase a store's data after the app is uninstalled, we delete everything of that store.
Who helps us
An AI vision model that reads invoices, Stripe and Razorpay for payments, Shopify for payments made inside Shopify, and an email delivery service.
haatlabs API
What we handle
- RapidAPI signs you up, holds your API key and bills you. We receive your RapidAPI user id and plan.
- The inputs you send (public https links and product details), the results we produce, and a webhook secret of your own, kept encrypted.
- A usage record of each billable call, with no inputs, outputs or image links in it.
How long we keep it
- Jobs, their inputs and results, and result images: deleted 7 days after the job was made.
- Usage and cost records: 400 days.
Who helps us
RapidAPI, AI models reached through OpenRouter, image search providers (our own search service, Brave or SerpApi), and DigitalOcean Spaces for result images.
Shopify customer data
Our Shopify apps do not store your customers' personal data. When Shopify sends a request to export or erase a customer's data, we record it; there is nothing of theirs to export or erase. When Shopify asks us to erase a store's data, we delete it.
Why we use data
To provide the product you signed up for, to keep it secure, to bill you, to answer you, and to meet our legal duties. We do not sell personal data and we do not use it for advertising.
Transfers outside India
Some of the services named above, such as payment and AI providers, may process data outside India. We share with them only what they need to do their part.
Security
Data travels over encrypted connections. Files are stored privately and served only through short-lived links or our own API. Store access tokens and secrets are kept encrypted. Each organization can reach only its own data.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask us for a summary of the personal data we hold about you, ask us to correct or erase it, withdraw consent, and name someone to act for you. Write to [email protected]; we answer within 30 days. Deleting your account erases your account data as described above.
Grievance Officer
If you have a complaint about how we handle your data, write to the Grievance Officer, haatlabs, at [email protected]. We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Children
Our products are for businesses and are not meant for anyone under 18.
Changes
We will update this page when our practices change and change the date at the top. For a significant change we will also tell account holders by email.