Catalog.ID Delegate Terms

Operator: Roberto Bourgonjen, a private individual in the Netherlands, operating catalog.id under operator code fndr ("Operator")
Address: Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands
Last updated: 2026-10-15

These Catalog.ID Delegate Terms ("Delegate Terms") apply to you as the natural person operating a Delegate Identity on catalog.id (the "Network") on behalf of an organization (the "Organization").

Roberto Bourgonjen created the Catalog software and the catalog.id namespaces (in that capacity the "Founder"; referred to as "the Developer" in the Catalog.ID Whitepaper) and operates catalog.id himself, as a private individual, under operator code fndr. If the role of Operator passes to a company or other organisation, these Delegate Terms continue with it (Section 12.6).

What these terms are, and what they are not. You are not a Member of catalog.id and these terms are not a membership agreement. The Organization is the Operator's contracting party under the Catalog.ID Organization Identity Agreement and bears legal responsibility for your use of the Network on its behalf. These Delegate Terms exist so that the Network's core protections — confidentiality, safety, respect for intellectual property, and key security — bind every person operating on the Network personally, whatever their capacity. Members accept the same protections through the Catalog.ID Membership Agreement.

1) Acceptance

You accept these Delegate Terms by activating your Delegate Identity through the invitation your Organization provides, or by operating a Delegate Identity.
Acceptance is a condition of activation. If you do not accept, do not activate or operate the Delegate Identity. By accepting, you confirm that you are of legal age and have full legal capacity to accept these Delegate Terms.
Your acceptance is recorded at activation.

2) Key definitions

Delegate Identity: the Catalog.ID identity created for you by the Organization, identified by a username in the ab12cd34fg format and permanently linked to the Organization. See the Catalog.ID Whitepaper §3b.
Member: a natural person registered on catalog.id under the Catalog.ID Membership Agreement in a private capacity.
Member Shared Data: any data a Member, an Organization Identity, or another Delegate Identity shares with you or your Organization via the Network or Catalog clients/APIs, including encrypted attributes, messages, files, links, provenance records, decryption keys, identity assertions, and private metadata, as well as copies, extracts, screenshots, transcriptions, and summaries that reveal the substance of the original data.
Onward Sharing: disclosing, publishing, forwarding, selling, sublicensing, or otherwise making available Member Shared Data to any third party beyond the intended audience.
Agent Identity: a Catalog.ID identity for an autonomous or semi-autonomous entity (AI system, automation script, or human operator) acting on behalf of a personal or delegate identity. See the Catalog.ID Whitepaper §3c.

3) Your Delegate Identity

Personal and non-transferable. Your Delegate Identity is for you alone. You must not share access to it or let anyone else operate it.
Organization-controlled lifecycle. The Organization created your Delegate Identity and can freeze it, change its roles, or terminate it at any time. On termination, your delegate username is permanently retired and never reassigned.
Your own keys and claims. You generate and hold your own credentials (password, supersecret, PIN) and your own encryption keys. The Organization never receives any of them. The Operator never receives your supersecret or your plaintext private keys and cannot decrypt your own claims; your password and PIN serve only to authenticate you to the Operator's servers (see Catalog.ID Whitepaper §3.2, §3.4). If you lose your supersecret and have no device with imported keys, your encrypted claims are permanently unrecoverable; this is an intentional property of the system (see Catalog.ID Whitepaper §3.2, §3b.4).
Organization keys. Every Delegate Identity receives a wrapped copy of the Organization's attr_encrypt key, enabling organization-wide sharing; depending on your roles, you may receive wrapped copies of further Organization keys (see Catalog.ID Whitepaper §3a.3.1, §3a.4). These remain the Organization's; your access ends when your roles change or your Delegate Identity is terminated.
Username license. Your delegate username is part of a namespace that is the Founder's intellectual property, licensed to your Organization under the Organization Identity Agreement and made available to you through it for the duration of your Delegate Identity. You do not own it and may not transfer it or assert any proprietary right in it.
Optional personal identity. If you also hold or want a personal Catalog.ID membership, that is a separate relationship under the Membership Agreement. Linking the two identities is optional, is a session convenience only, and does not merge keys, claims, or legal frameworks (see Catalog.ID Whitepaper §3b.5).

4) Acting for the Organization

Capacity. Actions you take through your Delegate Identity are actions in the Organization's capacity. Toward the Operator and other Network participants, the Organization is responsible and liable for them under the Organization Identity Agreement.
Authority. You must act within the roles and authority the Organization has assigned to you, and within any internal policies it imposes.
Audit awareness. The Organization's owner and admin delegates can audit CPR signing activity across the Organization, including which delegate signed which claim, from which machine, and when (see Catalog.ID Whitepaper §3a.8.2).
Publication is yours. Publishing your CPR signing key or public claims on your Delegate Identity is your voluntary action. When you publish a CPR signing key, your Delegate Identity and your Organization become discoverable from claims signed with it. On termination of your Delegate Identity, the Organization decides whether your published CPR signing keys are revoked or unpublished (see Catalog.ID Whitepaper §3a.8.1); keys you never published remain anonymous and unaffected.

5) Confidentiality and Member data (core obligations)

These obligations bind you personally and are enforceable against you by the Operator and by affected Members and Organizations:

No Onward Sharing. You must not Onward Share Member Shared Data without the sharing party's explicit permission. Where data has been shared with the Organization, access by the Organization's Delegate Identities through the Network's organization-wide sharing mechanisms is not Onward Sharing. Data shared with you individually must not be re-shared — including organization-wide — without the sharing party's permission, and disclosure outside the Network or beyond the intended audience is never permitted.
Minimum disclosure. If sharing is authorized, share only what is necessary and only with the authorized audience.
No doxxing. You must not publish or disclose anyone's personal data without consent, and must not attempt to identify, deanonymize, correlate, or dox Members, Delegates, or others based on identifiers, metadata, or combined information.
Provenance key confidentiality. If a Member or Delegate shares a CPR signing key association with you (including anonymous keys shared for arbitration or private verification), treat it with the same confidentiality as any other Member Shared Data.
No circumvention. You must not request, distribute, or accept decryption keys outside the platform's key-sharing mechanisms in order to evade revocation, audit, or access controls.
Survival. These obligations continue after your Delegate Identity is terminated and after your relationship with the Organization ends.

6) Intellectual property and provenance

You must respect the copyright, neighboring rights, database rights, moral rights, and other IP rights of Members, Organizations, and third parties.
You must not misrepresent authorship, provenance, or permissions.
You must not redistribute another party's protected content without permission and a lawful basis.

7) Prohibited conduct

You must not use the Network to:

harass, threaten, stalk, or intimidate others;
facilitate illegal activity;
distribute malware, attempt unauthorized access, or abuse the Network;
scrape or bulk-collect Member or Delegate data;
trade or sell access to decryption keys or Member Shared Data without the sharing party's consent;
impersonate others or mislead anyone about your identity or authority.

8) Security

Credentials. Keep your password, supersecret, PIN, devices, and keys secure. Follow the Organization's security policies for machines that hold wrapped Organization keys or run agent runtimes.
Incidents. Promptly notify the Organization, and where Member data may be affected also the Operator, of any suspected compromise of your credentials, keys, devices, or Agent Identities.
CPR signing keys. CPR signing keys are generated per machine and never leave it. If a machine is lost or compromised, the corresponding key must be revoked promptly.

9) Agent Identities

Subject to your Organization's internal policies, you may create Agent Identities under your Delegate Identity — any role set permits this (see Catalog.ID Whitepaper §3c.8). You are their Principal: you configure their scopes, control their sessions, and must keep them no broader than their purpose requires.
Actions of your Agent Identities count as your actions under these Delegate Terms, and as the Organization's actions toward the Operator and the Network.
You must promptly terminate or revoke an Agent Identity that is malfunctioning, compromised, or acting outside its intended scope.

10) Your personal data

Your Delegate Identity data (claims, keys, role set, the organization link, and audit records) is your personal data. The Operator processes it in accordance with the GDPR and applicable Dutch data protection law, as described in the Privacy Policy.
Your own encrypted claims are end-to-end encrypted; neither the Operator nor the Organization can read them without a key you share.
While your engagement with the Organization is active, the Organization has a legitimate basis for maintaining your Delegate Identity, and you cannot unilaterally terminate it. When the engagement ends, you may request termination if the Organization has not already terminated it, and your right to erasure applies (see Catalog.ID Whitepaper §3b.3, §9a.6).
Public claims and license to publish. Public claims you publish on your Delegate Identity are published with your consent. By requesting publication you grant the Operator a worldwide, non-exclusive, royalty-free, perpetual license to publish the resulting public claim in cleartext, sign it with the Operator's key, and serve it through public APIs and profile interfaces; this license survives termination of your Delegate Identity so that attribution remains resolvable. You may delete or update any of your public claims at any time during your lifetime, including after your Delegate Identity has been terminated; deletion takes effect immediately and ends the license for the deleted claim (see Catalog.ID Whitepaper §9a.5–9a.6).

11) Enforcement

Against your Delegate Identity. The Operator may restrict, freeze, suspend, or terminate your Delegate Identity for breach of these Delegate Terms, for safety, security, or legal compliance reasons, or at the Organization's instruction.
Against you. For breaches of Sections 5, 6, 7, and 8, the Operator and affected Members or Organizations may seek injunctive relief and actual damages from you directly. Liquidated damages for breaches committed through your Delegate Identity arise under the Organization Identity Agreement and are owed by the Organization, not by you; this does not limit the Organization's right to redress against you under your internal relationship or applicable employment law. If you separately hold a Personal Account, liability for breaches committed through that account remains your own under the Membership Agreement.
Disputes. Network disputes arising from your conduct as a Delegate are conducted with the Organization as the responsible party under the Organization Identity Agreement. You must cooperate in good faith with dispute proceedings, including preserving evidence and maintaining confidentiality of dispute materials. This duty does not require you to incriminate yourself or make unlawful disclosures.

12) General

No fees. You owe the Operator no fees for your Delegate Identity; applicable fees are charged to the Organization.
Operator liability. The Network is provided to you as available. Except in cases of intent or deliberate recklessness of the Operator, or liability that cannot be limited under mandatory law, the Operator is not liable to you for damages arising from your use of the Delegate Identity; the Operator's liability in respect of your Organization's use of the Network is governed by the Organization Identity Agreement.
Notices and changes. The Operator cannot contact you by email or telephone, because your contact details are held as end-to-end encrypted claims it cannot read. Notices to you are placed in your Delegate Identity and shown in the notification area of the Catalog Dashboard (the Catalog desktop application) and when you sign in to catalog.id. The Operator may update these Delegate Terms; material changes are announced in this way, and on catalog.id, with at least 30 days' notice. Continued operation of your Delegate Identity after the effective date constitutes acceptance.
Severability. If any provision of these Delegate Terms is held invalid or unenforceable, the remaining provisions continue in full force.
Governing law and venue. These Delegate Terms are governed by the laws of the Netherlands. Disputes that cannot be resolved within the Network may be brought before the competent court in the Netherlands for the district in which the Operator is domiciled or established, unless mandatory law requires a different venue.
Successor Operator. If the Organization Identity Agreement is transferred to a company or other organisation that takes over the role of Operator, these Delegate Terms continue between you and that successor, which is announced to you in advance as described in Section 12.3. You consent to this in advance; your Delegate Identity continues unchanged.

13) Contact

Roberto Bourgonjen, operator of catalog.id
Address: Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands
Website: catalog.id
Email: [email protected]