Catalog Privacy Policy
Controller: Roberto Bourgonjen, a private individual in the Netherlands, operating the Catalog services under operator code fndr ("Operator")
Address: Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands
Contact: [email protected]
Websites: catalog.org, catalog.id, bit.cash
Last updated: 2026-10-16
This Privacy Policy explains how the Operator collects, uses, stores, and protects personal data in all Catalog services:
- the websites catalog.org, catalog.id and bit.cash, and the other websites the Operator publishes with Catalog Publisher (the "Websites");
- Catalog.ID, the identity network, reachable at fndr.catalog.id (the "Network");
- the Catalog Provenance Registry (the "CPR");
- the Catalog Cloud Services, including Encrypted Filestorage (the "Cloud Services");
- Bitcash: the ledger, the browser wallet on the Websites, and the Bitcash Wallet Manager ("Bitcash"); and
- the Catalog desktop software, the Catalog Dashboard and its modules (the "Software").
The same policy is published at catalog.org/privacy_policy/, catalog.id/privacy_policy/ and bit.cash/privacy_policy/. Section 2 describes, service by service, which personal data each one processes. This policy should be read alongside the Catalog.ID Membership Agreement, the Catalog EULA and Cloud Services Terms, and the CPR Terms.
1) Who is responsible
Roberto Bourgonjen created the Catalog software and operates all Catalog services himself, as a private individual. For the purposes of the General Data Protection Regulation (GDPR), he is the data controller for the personal data described in this policy, and is referred to in it as the Operator. One controller is responsible for every service, so this one policy covers them all.
2) What personal data the Operator collects
2.1 Visitors of the Websites
- Delivery and protection. The Websites are delivered through Cloudflare, which processes connection data, such as your IP address and request headers, to deliver the pages and to protect the Websites against attacks and automated traffic (see Section 6.2).
- Server logs. The Operator's web servers log each request: your IP address, the page requested, the time, the referring page, and your browser's identification.
- Visitor statistics. The Websites count visits with their own statistics code, not with a third-party analytics service. For the duration of a visit, a random session identifier is kept in your browser's session storage, together with the pages you view, the time you spend actively on them, and your screen size. This record is sent to the Operator's own server, which logs it with your IP address and browser identification. Your browser also keeps the records of your last 100 visits in its local storage; you can clear them at any time. No cookies are used for this, the statistics are shared with no one, and the Operator does not use them to identify you or link them to your Catalog.ID or your wallet.
2.2 Catalog.ID
-
Account and registration data. When you create an account, the Operator may collect:
- name or pseudonym;
- email address;
- telephone number;
- postal address;
- public/private encryption keypair metadata (the public key is stored; the private key remains on your device).
Your email address and telephone number are validated by the Validator Black Box, an isolated validation service, and are then stored as end-to-end encrypted Attributes. The Operator's core systems do not receive them in plaintext unless you share a decryption key with the Operator (see Section 4). Verification emails are sent by the Validator Black Box's own mail server. To validate your telephone number, the Validator Black Box passes it to Twilio, which generates the verification code, sends it to you by SMS and checks the code you enter (see Section 6.2). The Validator Black Box keeps only Twilio's reference to the verification, not your telephone number.
-
Public claims. Attributes you ask the Operator to publish as public claims (such as a display name, professional role, website or CPR signing key), as described in the Catalog.ID Membership Agreement Section 9.9 to 9.14.
-
Member Shared Data. Data shared between Members via the Network, including encrypted attributes, messages, files, links, provenance records, decryption keys, and identity assertions.
-
Third-party login. When you use "Log in with Catalog.ID" at another website (a Relying Party), the Operator records which Relying Parties you have authorised, the claims you consented to disclose, and the tokens issued to them. The claims themselves are prepared on your device and go to the Relying Party (see Section 6.1).
-
Organization and Delegate Identities. The data of Organization Identities and of the Delegate Identities operated for them, as described in the Catalog.ID Organization Identity Agreement and the Catalog.ID Delegate Terms.
-
Sanction records. Where a Member is expelled or permanently banned, the information needed to recognise that person if they apply again (see Section 6.5).
2.3 Catalog Provenance Registry
- CPR claims. Signed claims you submit to the CPR, which identify assets by Asset ID and parties by Catalog.ID username. CPR claims must not contain names, contact details or other directly identifying data (see the CPR Terms, Section 10).
- Licence records. When you obtain a licence for an Asset ID, the Operator records the public key named as its owner key, and any later change of owner key.
2.4 Cloud Services
- User Content. Files, media, recordings, metadata, tags, comments, messages, and other content you create, import, record, or upload to the Cloud Services, including Encrypted Filestorage. User Content may be encrypted or unencrypted depending on your choices.
2.5 Bitcash
- Ledger records. For every wallet, the ledger keeps a balance and a signed history of rows: amounts, fees, timestamps, the counterparty identified by its wallet reference, the service type and tax category, and, for a payment for content, the site and the content paid for. In privacy mode the content paid for is left out. The ledger also records the country of a wallet at its creation, for tax purposes, and keeps per asset and per day a usage record that names no wallet and no payer. Wallets are bearer codes: the ledger does not record who holds a wallet. Where your Catalog.ID account pays for services, Catalog.ID keeps the authorised-spend token your account pays with.
- Purchases. Where the Operator sells BIT, purchase records and payment details (processed by a payment provider; the Operator does not store full payment card numbers).
- Wallet software. The Bitcash Wallet Manager keeps your wallet codes only on your device, encrypted in your operating system's secret store. The browser wallet on the Websites keeps your wallet codes and settings in your browser's local storage, protected with a PIN if you set one. Neither sends a wallet code to the Operator except to carry out a payment or transfer you confirm.
2.6 Software
The Software runs on your own device, and what you do with it in standalone/local mode stays there. The XRPL Wallet module reads from and submits to a public XRP Ledger server operated by a third party, which sees your IP address and the XRPL addresses you query. That third party is not a processor of the Operator.
2.7 Technical and operational data
- IP addresses, device identifiers, browser type, operating system;
- timestamps, file sizes, service usage logs, security logs;
- network and connection data;
- error reports and diagnostics.
2.8 Communication and dispute data
- messages you send to the Operator (for example support requests);
- dispute filings and arbitration correspondence;
- recordings of the personal conversations that precede arbitration under the Catalog.ID Membership Agreement Section 17.2.
3) How the Operator uses your data
The Operator processes personal data for the following purposes and on the following legal bases:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Delivering and securing the Websites, and keeping server logs | Legitimate interest (Art. 6(1)(f)): operating and protecting the Websites |
| Visitor statistics on the Websites | Legitimate interest (Art. 6(1)(f)): understanding how the Websites are used; keeping the session record in your browser relies on the exemption in the Dutch Telecommunications Act (Telecommunicatiewet) for analytics with little or no impact on privacy |
| Providing and operating the Network, the CPR and the Cloud Services | Performance of contract (Art. 6(1)(b)) |
| Account creation, validation, authentication, and security | Performance of contract (Art. 6(1)(b)) |
| Publishing the public claims you request | Consent (Art. 6(1)(a)); you withdraw it by deleting the claim, at any time |
| Keeping the Bitcash ledger and processing payments and transfers | Performance of contract (Art. 6(1)(b)) |
| Tax and accounting records of payments and sales | Legal obligation (Art. 6(1)(c)) |
| Permanent archival of User Content (Cloud Services) | Legitimate interest (Art. 6(1)(f)): preserving cultural and intellectual works; consent where applicable |
| Provenance recording, CPR claims, licence records, and process archiving | Performance of contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)): supporting IP claims and creative attribution |
| Enforcing the terms, dispute resolution (including recorded conversations), and trust and safety | Performance of contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Maintaining the Sanctions Registry | Legitimate interest (Art. 6(1)(f)): network safety and preventing re-registration by expelled Members |
| Security monitoring, fraud prevention, and abuse detection | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations (for example tax, law enforcement) | Legal obligation (Art. 6(1)(c)) |
| Communicating service updates and material changes | Performance of contract (Art. 6(1)(b)) |
The Operator does not use your personal data for advertising or profiling and does not sell it to third parties.
4) Encryption and privacy by design
The Catalog services are built on privacy-by-design principles:
- End-to-end encrypted Attributes. Certain Attributes are stored end-to-end encrypted. The Operator cannot read the plaintext of encrypted Attributes unless a decryption key is shared with the Operator.
- Key-based sharing. When you share an encrypted Attribute, the decryption key is delivered encrypted to the recipient's public key. The Operator facilitates key delivery but has no access to plaintext unless a key is specifically shared with the Operator.
- Private keys stay with you. Your private keys are generated on your device. The servers hold them only as Key Bag entries encrypted under your Supersecret, which the Operator never receives.
- Encrypted User Content. If you encrypt your User Content before uploading, the Operator's processing is limited to storage, transport, and legal compliance.
- Pseudonymous ledger. The Bitcash ledger identifies wallets by references derived from their codes, not by the people who hold them.
- Operational metadata. Even where content is encrypted, the Operator necessarily processes technical metadata (timestamps, file sizes, usage logs) to operate and secure the services.
The Operator acts as controller for the account and operational metadata needed for service operation, security, billing, and legal compliance, even where some content fields are end-to-end encrypted.
5) Permanent archiving and the right to erasure
5.1 Archival by design
The Cloud Services and the CPR are designed for permanent archiving. File histories, versions, edits, provenance records and accepted CPR claims may be retained indefinitely. The Bitcash ledger is an append-only signed record. Deletion may be technically impossible or restricted.
5.2 Legal basis for permanent retention
The Operator relies on legitimate interest (Art. 6(1)(f) GDPR) for permanent archival retention, balancing the public and cultural interest in preserving intellectual works and provenance records against individual privacy interests. Where content is uploaded in non-encrypted form, users grant an archival license under the Catalog EULA and Cloud Services Terms (Section 11.3) that supports this retention.
The Operator applies safeguards to reduce the impact on privacy, including access controls, encryption, pseudonymisation where possible, purpose limitation, and restricting access and publication where appropriate. Where erasure is not possible because of the archival design or legal obligations, the Operator seeks to meet the intent of a request through restriction of processing, minimising exposure, and other protective measures, where feasible.
5.3 Erasure requests
You have the right to request erasure under Article 17 GDPR. Because of the archival design:
- Encrypted content: if the Operator cannot access the plaintext, erasure of the encrypted data may not meaningfully affect your privacy, but each request is assessed individually.
- Non-encrypted content: where the archival license and legitimate interest apply, the Operator may not be able to delete content but can apply safeguards such as restricting public access, pseudonymising associated account data, or removing personal identifiers from metadata.
- CPR claims: accepted claims cannot be removed from the immutable claim layer, but a claim or attribution can be excluded from publication (muted) on request, as described in the CPR Terms.
- Bitcash ledger rows: signed rows cannot be removed or rewritten, because every later row of the wallet attests to them and holders keep copies of them. They identify wallets by reference only, not by person.
- Public claims: you may delete any public claim at any time during your lifetime, including after your account has ended; deletion takes effect immediately.
- Account data: when your account ends, your encrypted Attributes, keys and validation certificates are destroyed, and remaining account registration data is deleted or anonymised within a reasonable period, except where retention is required by law or for the establishment, exercise or defence of legal claims.
The Operator responds to erasure requests within one month, as required by GDPR Article 12(3), and explains any limitations and the safeguards applied.
5.4 If you require deletion
If you require the ability to fully delete content, do not upload it to the Cloud Services and do not register it in the CPR. Use the Software in Standalone/Local mode only.
6) Data sharing and recipients
The Operator may share personal data with the following categories of recipients:
6.1 Other Members and Relying Parties
When you share Attributes, User Content, or Member Shared Data with other Members, or disclose Attributes to a website through "Log in with Catalog.ID", those recipients receive access to the shared data (including via decryption keys). Sharing is controlled by you.
6.2 Sub-processors
The Operator uses third-party service providers to operate the infrastructure and services. These sub-processors process personal data on the Operator's behalf under data processing agreements that ensure GDPR compliance.
Current sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Delivering and protecting the Websites and services (CDN, DNS, DDoS protection, traffic security); hosting the Bitcash ledger on its platform | Global (EU–U.S. Data Privacy Framework certified; Standard Contractual Clauses in Cloudflare's data processing addendum) |
| Twilio Ireland Limited (Twilio Verify) | Sending and checking SMS verification codes for telephone number validation | Ireland (EU); processing by its affiliate Twilio Inc. in the United States (EU–U.S. Data Privacy Framework certified; Standard Contractual Clauses in Twilio's data processing addendum) |
This table is kept up to date with every change of sub-processor.
6.3 Law enforcement and legal obligations
The Operator may disclose personal data where required by law, regulation, court order, or a request from a competent authority.
6.4 Dispute resolution
In connection with disputes under the Catalog.ID Membership Agreement or the Catalog EULA and Cloud Services Terms, relevant data (including a recording of a pre-arbitration conversation, where the dispute proceeds to arbitration) may be shared with arbiters, mediators, or the Review Board, subject to confidentiality obligations.
6.5 Sanctions Registry
Sanction records are encrypted, accessible only to the Operator's authorised registration reviewers, and used only to prevent re-registration by expelled Members and to enforce bans. They are kept for the duration of the ban, for at least 1 year and at most 20 years from the date of expulsion. An applicant who is refused registration is not told whether a sanction record exists. Your right of access to sanction records may be restricted only where and to the extent a legal ground under GDPR Article 23 (as implemented in Dutch law) applies, such as the establishment or defence of legal claims or the prevention of circumvention of sanctions.
6.6 Successor Operator
If the role of Operator passes to a company or other organisation, the personal data needed to continue the services transfers to that successor, which becomes the controller. The transfer is announced on the Websites, and for Catalog.ID members in their account, at least 30 days before it takes effect, as described in the Catalog.ID Membership Agreement Section 28.
7) International data transfers
The Operator's own servers are located in the Netherlands. Personal data leaves the EU/EEA in three cases:
- Telephone number validation. When you validate your telephone number, it is passed to Twilio Ireland Limited, whose affiliate Twilio Inc. may process it in the United States so that the verification code can be sent and checked.
- The Bitcash ledger. The ledger runs on Cloudflare's platform, which stores its records in Cloudflare's data centres; their location is not limited to the EU/EEA.
- Delivery of the Websites and services. Cloudflare operates a global network and may process traffic data (IP addresses, request headers, cached content) at locations outside the EU/EEA for the moment needed to deliver and protect the Websites and services.
Twilio Inc. and Cloudflare, Inc. are certified under the EU-US Data Privacy Framework, and Standard Contractual Clauses apply under their data processing addenda. If the Operator engages additional sub-processors outside the EU/EEA, appropriate safeguards (for example adequacy decisions, SCCs, or binding corporate rules) will be in place and this policy will be updated.
8) Data retention
| Data category | Retention period |
|---|---|
| Account registration data | Duration of the account, plus a reasonable period after termination (or as required by law) |
| Public claims | Until you delete them; otherwise permanent, for archival and attribution purposes |
| User Content (non-encrypted, Cloud Services) | Permanent (archival by design) |
| User Content (encrypted, Cloud Services) | Permanent (archival by design; plaintext inaccessible to the Operator) |
| Accepted CPR claims and licence records | Permanent (immutable claim layer; publication can be muted) |
| Bitcash ledger rows | For as long as the ledger is kept (append-only signed record) |
| Purchase records and the records of payments needed for tax | 7 years (Dutch tax and accounting obligations; longer where legally required) |
| Server logs, visitor statistics, technical and security logs | Up to 12 months (or longer where required for a security investigation or legal obligation) |
| Dispute and arbitration records, including conversation recordings | Duration of the dispute plus 5 years (limitation period) |
| Sanction records | Duration of the ban; at least 1 year and at most 20 years |
| Communication and support data | Up to 3 years after resolution |
9) Your rights
Under the GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data the Operator holds about you. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete data. |
| Erasure (Art. 17) | Request deletion of your data, subject to the limitations described in Section 5 of this policy. |
| Restriction (Art. 18) | Request that the Operator restricts processing in certain circumstances. |
| Portability (Art. 20) | Receive your data in a structured, commonly used, machine-readable format, or have it transferred to another controller. |
| Objection (Art. 21) | Object to processing based on legitimate interest. The Operator stops the processing unless it can demonstrate compelling legitimate grounds. |
| Withdraw consent (Art. 7(3)) | Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. |
How to exercise your rights
Write to [email protected] with your request; requests about Catalog.ID may also be sent to [email protected]. The Operator verifies your identity and responds within one month. The Operator may ask for additional information to verify your identity (for example, confirming control of the email address or telephone number on file). If a request is complex or there are many requests, this period may be extended by a further two months, with notice.
Right to lodge a complaint
If you believe your data has not been handled properly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
- Website: autoriteitpersoonsgegevens.nl
- Postal: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag
10) Data portability on account termination
When you terminate your account or your membership ends:
- You may request an export of your personal data and User Content in a structured, commonly used format, before or within a reasonable period after termination.
- Account registration data (name, email, telephone, address) is deleted or anonymised within a reasonable period after termination, except where retention is required by law.
- User Content uploaded to the Cloud Services and accepted CPR claims are subject to the permanent archival policy and may not be deletable (see Section 5).
11) Cookies and browser storage
The Software (desktop applications) does not use cookies. On the web:
- Strictly necessary cookies are used for authentication, session management, and security, for example when you sign in to Catalog.ID. These do not require consent.
- Visitor statistics on the Websites use your browser's session storage and local storage, not cookies, as described in Section 2.1.
- The browser wallet keeps your wallet codes and wallet settings in your browser's local storage, because you asked it to (Section 2.5).
- No advertising or third-party tracking. No advertising trackers and no third-party analytics are used.
Cloudflare may set security-related cookies (for example __cf_bm) for bot protection. These are strictly necessary for security and do not track you for advertising purposes.
12) Security measures
The Operator implements appropriate technical and organisational measures to protect personal data, including:
- end-to-end encryption for supported Attributes and User Content;
- encryption in transit (TLS) for all network communications;
- encryption at rest for stored data;
- a physically and logically isolated Validator Black Box for validating contact details;
- signed, replicated ledger rows that any holder can verify;
- access controls and authentication for systems;
- security logging and monitoring;
- regular security assessments.
No system is completely secure. If you suspect a security incident or unauthorised access to your account or wallet, contact the Operator immediately at [email protected].
13) Children
The Catalog services are not intended for persons under 18 years of age. The Operator does not knowingly collect personal data from anyone under 18. If the Operator becomes aware that it has collected data from a person under 18, it deletes that data and terminates the associated account.
14) Changes to this policy
The Operator may update this Privacy Policy. If changes are material, notice is given on the Websites and, for Catalog.ID members, in the notification area of the Catalog Dashboard and when they sign in to catalog.id. The "Last updated" date at the top indicates the most recent revision.
15) Contact
Roberto Bourgonjen, operator of the Catalog services
Address: Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands
Websites: catalog.org, catalog.id, bit.cash
Email: [email protected]
Data Protection Officer (DPO): not appointed (not required for the current activities)
For privacy-related requests, please include "Privacy" or "GDPR" in the subject line of your email.