Cookie policy

1. What cookies and browser storage are

This Cookie policy explains what cataloop stores on your device, and what it reads from it, when you use the Service.

When we say "we", we mean Weston Trade SL, the company that provides the Service. Words with an initial capital have the meaning given to them in the Terms.

A cookie is a small text file that a website stores in your browser. The browser sends it back to that website on every visit.

This policy treats in the same way any other means of storing or reading information on your device, such as the browser's local storage (localStorage) and session storage (sessionStorage) (Art. 22(2) of Spanish Law 34/2002 on Information Society Services and Electronic Commerce, LSSI).

Read the Privacy policy to learn how we process your personal data.

2. What we use

All the cookies and keys in the table are ours. The table lists each one, with its purpose, its duration and the place where it is used. In short, they serve five purposes:

• Session and access. They keep you signed in to the Back office, remember that you entered the Access code of a private Shop, and identify you as a Buyer when you open your Customer link, so that your prices can be shown.
• Preferences. They remember the language you choose, whether you prefer light or dark mode and whether you want to see the Catalogue as a grid or as a list. They are created only when you choose an option.
• Cart and Orders. Your cart and the changes you have not yet saved to an Order are kept in your browser until you place the Order, empty the cart or save the changes. Your place in the Catalogue is kept only while the tab is open.
• Our team. They keep Operators signed in to the Operations console, protect the second verification step, and give an Operator Support access to a Back office.
• Demonstration. If you open the Back office of the Demo shop, a cookie keeps it open in read-only mode for 2 hours.

Each cookie is sent only to the address that created it. None is shared between Shops, or between a Shop and the main site.

No cookie can be read by the code of the page (HttpOnly). On the live Service, cookies travel only over encrypted connections (Secure) and are not sent with most requests that start on other websites (SameSite=Lax).

3. Why we do not ask for your consent

Art. 22(2) LSSI allows information to be stored on and read from your device without consent when it is strictly necessary for a service you asked for. Everything in the table meets that condition or stores a preference you chose yourself. That is why the Service shows no cookie banner.

We follow the criteria of the Guía sobre el uso de las cookies (Guide on the use of cookies) of the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency), in its version updated in May 2024:

• Preferences you choose yourself, such as language or theme, are exempt if they are used only for that. They last 365 days, to remember your choice.
• The cart and the unsaved changes to an Order are data that you enter, which the guide also treats as exempt.
• The session and access cookies last 30 days, and the Customer link cookie 365 days, so that you do not have to identify yourself on every visit. Without them you would have to sign in again, type the Access code again or open your Customer link again each time. You can delete them whenever you like, as the section "How to delete or block them" explains.

4. What we do not use

The Service uses none of the following:

• analytics or audience measurement cookies;
• advertising or pixel tracking;
• maps, chats or frames (iframes) showing pages from other websites that load without your asking for them;
• fonts loaded from other servers;
• Stripe's payment code (Stripe.js) inside our pages;
• error reports from your browser.

If you are a Seller and pay for your Subscription, we take you to Stripe's payment pages. There, Stripe's cookies apply, under Stripe's cookie policy, and this policy does not.

5. Third-party content

Some parts of the Service load content from other servers. Those servers can see your IP address:

• Videos. A Seller may add videos hosted on another service to the Shop. They load only if you press the play button. Your browser then connects to that service, which receives your IP address and may set cookies of its own under that service's policy.
• Images. Product photos and Shop logos are served from our image delivery network, which receives your IP address when it sends each image to your browser, including when you open an email from a Shop that shows its logo. It sets no cookies.

Read the Sub-processor list to see which providers we use.

6. Our test site

We have a password-protected test site. There, the sm_staging_gate cookie remembers that you entered the password. The live Service does not allow that password to be turned on, so this cookie is never created there.

7. Who is responsible for these cookies

We are responsible for the cookies and storage in the table on the site and in every Shop, because our code sets them. The Seller is responsible for the third-party content it adds to its Shop, such as videos.

Because each cookie is tied to the address that created it, one Shop cannot read another Shop's cookies.

8. How to delete or block them

You can view, delete or block cookies and storage in your browser settings. If you block them, you will not be able to sign in or use the cart.

The Service also deletes some of this information on its own:

• When you sign out of the Back office, it deletes the session and Support access cookies, and also any Access code and Customer link cookies in that browser.
• If you are a Buyer, you can delete the Access code and Customer link cookies with the "Forget this browser" link in the Shop footer.
• If you open a Customer link that the Seller has replaced, it deletes the cookie for the previous link.
• If you choose to follow the system mode, it deletes the light or dark mode cookie.
• When you place an Order, or empty the cart, it deletes the cart kept in the browser.
• Your place in the Catalogue is deleted as soon as it is used.

9. Changes to this policy

If we change the cookies or storage the Service uses, we will update this policy and the table. The version in force is always the one published here, with the date shown at the top.

If you have any question about this policy, write to us at privacidad@cataloop.app.

10. Language

This policy is published in Spanish and in English. If the two versions differ, the Spanish version prevails.