Privacy Policy

Last Updated: 14 October 2026

EventCatalog Ltd is a company registered in England and Wales (company number 15764703), registered office 55 Broadgate Lane, Deeping St James, Peterborough, PE6 8NN, United Kingdom. We are the data controller for the personal information described in this policy. EventCatalog Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC269123.

This policy explains what data we collect, why, and how we handle it. We collect very little. EventCatalog is self-hosted, so your catalog content stays on your infrastructure. EventCatalog Cloud (eventcatalog.cloud) is our license key and billing portal; it does not host or store catalogs.

1. Information We Collect​

Account and billing information - when you create an EventCatalog Cloud account or purchase a license, we collect your name, email address, organisation, plan and billing details and, for Commercial Licenses, the eligibility and number of Teams you self-certify. If you invite team members to your organisation in EventCatalog Cloud, we store their email addresses. You can sign in to EventCatalog Cloud with an email address and password, or with GitHub or Google, in which case we receive your name and email address from that provider. Payments are processed by Stripe, which handles all card data; we never receive or store full card numbers. If you pay through Stripe, we store the Stripe customer ID linked to your account.

License data - license keys, plan, license status and expiry dates. Licence keys for current releases are checked offline by the Software and do not contact our servers. Older Starter and Scale license keys are still checked online at build time: the Software sends the license key to our license service (api.eventcatalog.cloud), and, as with any web request, the service receives the request time and the IP address it came from. We do not keep separate logs of license checks beyond our hosting providers' standard logs. No catalog content or user data is sent in a license check.

Telemetry data - by default, the Software sends usage telemetry when you run eventcatalog dev, eventcatalog build or eventcatalog start, or create a new catalog. It includes the organisation name from your catalog configuration, a randomly generated catalog ID, catalog resource counts (for example the number of services and events), the number of EventCatalog Studio canvases kept and how many changed recently, the command run, whether a license is present, its type, status and expiry date, the end date of the evaluation period, plan and feature flags, the names of generators in use, a one-way hash of your catalog files, and the Software, operating system and Node.js versions. The IP address of the machine running the command is visible to the service receiving it. Telemetry does not include the names or content of your services, events, schemas, documentation, diagrams or Studio canvases, or any data about the people using your catalog. It is not anonymous: the organisation name and catalog ID can identify your organisation. Telemetry is sent to Simple Analytics, and a scheduled job then copies it into PostHog for analysis. You can turn it off by setting EVENTCATALOG_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1, or telemetry: false in eventcatalog.config.js.

Website analytics - we use Simple Analytics, which does not use cookies, to collect anonymous, aggregate analytics on our website (eventcatalog.dev) to understand traffic and usage patterns.

Support and correspondence - when you email us, we keep your messages and contact details so we can respond.

Emails we send - we send EventCatalog Cloud users account and license emails, and news about EventCatalog products, features and updates. Every email includes an unsubscribe link.

2. Self-Hosted Users​

EventCatalog is a self-hosted product. Your documentation, diagrams, event definitions, schemas, and all other content remain entirely under your control on your own infrastructure. We do not access, store, or process any of that data, and we have no visibility of it.

The only data sent to EventCatalog from a self-hosted Instance is: (i) the telemetry described above; and (ii) the online license check, if you use an older Starter or Scale license key. Some optional features make requests from your environment or your users' browsers directly to third-party services (for example the npm registry for update checks, plantuml.com for PlantUML diagrams, and jsDelivr and Google Fonts). Those requests do not come to us. Our Security Overview, available on request, lists them.

We are not a data processor for personal data in your catalogs. If you share personal data with us for a support request, we process it for you only to resolve that request, and for paying customers our Data Processing Agreement (DPA), which forms part of every paid contract, covers that support data.

3. How We Use Your Information​

We use your information for the following purposes:

• Account management - to create and maintain your account, issue and manage your license, and communicate with you about your subscription.
• Payment processing - to process payments and comply with tax obligations.
• License validation - to verify that your license is valid and active, and to prevent misuse.
• Product improvement - to understand how the Software is used and improve it.
• Product news - to tell you about EventCatalog products, features and updates similar to those you use.
• Support - to respond to your enquiries and provide technical assistance.
• Security and legal compliance - to keep our systems secure and meet our legal obligations.

We do not use automated decision-making that has legal or similarly significant effects on you. We do not use your data to train AI models.

4. Legal Basis (UK GDPR)​

You can ask us for more information about how we balanced our legitimate interests against your rights.

Electronic marketing (PECR). We collect your business contact details when you sign up for EventCatalog Cloud or buy a license. We only use them to send news about similar EventCatalog products and services. You are given the chance to opt out when your details are collected and in every email we send, and you can unsubscribe at any time. We do not send marketing on behalf of anyone else.

5. Subprocessors​

We share information with the following service providers (subprocessors), which process it on our behalf under data processing terms:

This section is our list of subprocessors. When we add or replace a subprocessor, we update this section and the "Last Updated" date above, and that update serves as notice of the change.

We do not sell your data to anyone. We may disclose information where the law requires it.

6. International Transfers​

We store EventCatalog Cloud data in the UK. Some of our providers process data outside the UK, mainly in the United States. Where this happens, we rely on the safeguards UK GDPR requires: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, the UK Extension to the EU-US Data Privacy Framework, or an adequacy decision. You can ask us for details of the safeguard used for a particular provider.

7. Data Retention​

• Account, license and support data - retained while it is needed for the purposes described in this policy. You can ask us to delete it at any time, and we will do so within 90 days of your request. Not renewing a subscription does not by itself trigger deletion, because the Software can continue to be used.
• Billing and payment records - retained for as long as UK tax and company law requires.
• Telemetry and analytics - retained while needed for product analysis, under our analytics providers' retention settings. Telemetry relates to organisations and catalogs, not to individual users.
• Hosting logs - our hosting providers' standard logs are kept under their standard retention settings. We do not keep our own activity or IP address logs.
• Data seen during a support session in your environment - deleted or returned within 30 days of the issue being resolved.

8. Cookies​

Our website (eventcatalog.dev) does not use cookies; our analytics provider, Simple Analytics, is cookieless. EventCatalog Cloud uses only strictly necessary authentication cookies to keep you signed in. Strictly necessary cookies do not need consent, so we do not show a cookie banner. If we ever introduce non-essential cookies, we will ask for your consent first.

9. Data Security​

We store minimal personal data (email addresses, license keys, and account information) in Supabase's London region, in an access-restricted database that is encrypted at rest, uses row-level security and is backed up daily. Development and production environments are kept separate. Administrative access is restricted and protected by multi-factor authentication. For details on infrastructure security, see Supabase's security documentation.

If a personal data breach affects your data, we will notify the ICO within 72 hours of becoming aware of it where the law requires, and we will tell affected customers without undue delay, and in any case within 72 hours.

For self-hosted users, the security of your hosting environment and the data within it is your responsibility. We recommend keeping your EventCatalog installation up to date, as we regularly release security patches.

10. Your Rights​

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (subject to legal retention requirements).
• Restrict how we use your data in certain circumstances.
• Export your data in a portable format.
• Object to processing based on legitimate interests, and to direct marketing (including product news emails) at any time.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 if you believe your rights have been infringed. We would appreciate the chance to deal with your concerns first.

To exercise any of these rights, contact us at support@eventcatalog.dev. We will respond within one month.

11. Children​

EventCatalog is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes to This Policy​

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Website at least 30 days before they take effect. Changes to the list of subprocessors in section 5 take effect when that section is updated. The "Last Updated" date above will always reflect the current version.

13. Contact​

For privacy-related questions, contact: support@eventcatalog.dev

EventCatalog Ltd Company registered in England and Wales (15764703). 55 Broadgate Lane, Deeping St James, Peterborough, PE6 8NN, United Kingdom. ICO registration number: ZC269123.