Legal

Privacy Policy

Effective date: July 2026 · Last updated: August 2026 · neoCatalyst Labs

This policy is issued by neoCatalyst Labs Limited Liability Company ("neoCatalyst Labs").

We do not sell or trade your personal information. We collect only what we need to run the platform: your email address, your student's academic profile, and lab progress data. We use no advertising trackers or analytics SDKs in your browser. Our own server sends a limited signal to our advertising platform when a visitor reaches our pricing or completes a purchase, so we can measure which adverts work — described under "Analytics and advertising" below. Nothing about a student, their work or their results is ever included. Our public marketing pages carry one third-party script — an affiliate referral tracker from our payment provider, used solely to credit a partner who referred a purchase. It is not present on labs or any signed-in page, and it is not used for advertising. We reserve the right to introduce analytics or advertising tools in the future to improve and grow the platform. If we change this policy, we will notify users and, where the account is associated with a minor student, the applicable parent or guardian of material changes affecting the minor student's personal information, and continued use of neoCatalyst Labs will constitute acceptance of the updated terms, except where applicable law requires affirmative consent.

Who we are

neoCatalyst Labs ("we," "us," or "our") operates the virtual chemistry lab platform at neocatalystlabs.com. We are a small independent company, not a school or institution. Questions about this policy: info@neocatalystlabs.com.

What we collect and why

Account and purchase information: When you purchase access, Lemon Squeezy (our payment processor and Merchant of Record) delivers your email address to us. We use it to send your access code and transactional notifications (new lab releases, access expiry reminders). We do not receive or store your payment card details — those stay with Lemon Squeezy.

Student profile: Student name, parent/guardian name, grade level, school name, and course start date — collected during onboarding. Used to pre-populate lab reports and the transcript documentation package. This data is yours. For students under 18, the parent or guardian associated with the account will be provided notice of the categories of student information collected and the purposes for which it is used, as further described under "Children's and Minor Students' Privacy" below.

Lab progress and submissions: Your student's lab responses, analysis answers, time-on-lab (recorded by a timer while the lab is active), and submitted reports. Used to generate PDF lab reports and populate the parent dashboard. We do not analyse this data for any purpose other than producing your documentation. For minor students, this information is treated as student information and is subject to the additional protections described under "Children's and Minor Students' Privacy" below. We do not use a minor student's academic work or personal information to train artificial intelligence models.

Account security and anti-sharing signals: When you log in, submit a lab, or use our support form, we log a one-way hash of your IP address (the raw IP is never stored) to guard against brute-force login attempts, abuse, and access-code sharing. We also reserve the right to collect device and technical signals (such as browser and device characteristics) to strengthen sharing detection across households. Used only for account security and sharing detection — not for advertising or profiling.

Lead magnet (free guide): If you submit the free guide form, your first name and email address are sent to Kit (formerly ConvertKit) for marketing email delivery. This is separate from a purchase account. You can unsubscribe at any time via the link in any email.

Lead ads (Facebook and Instagram): If you submit one of our advert forms on Facebook or Instagram, Meta collects your name and email address together with your answers to a short set of questions — your biggest worry about lab science, whether you want to be notified about enrollment, and whether you expect to use an ESA or charter fund and in which state. Meta sends that to us and we store it in Kit for marketing email. It creates no purchase account, and you can unsubscribe at any time.

Advert measurement: When a visitor reaches our pricing or completes a purchase, our server reports that to Meta so we can tell which adverts work. What is sent, and what is never sent, is set out under "Analytics and advertising" below.

We do not currently collect: browsing behaviour across other websites, and no advertising or device identifier that would let anyone recognise you across other sites. We run no analytics platform and no advertising scripts in your browser. Where you arrive from one of our own adverts we do read the click identifier Meta put on that link, so a purchase can be matched to the advert that led to it — see "Analytics and advertising" below. The one exception is affiliate referral tracking on our public marketing pages, described under "Cookies and session tokens" below: it records only which partner referred a visit, so that partner can be paid. We reserve the right to add analytics or advertising tools in the future — for example, on our public marketing pages — and will disclose them here when we do.

Infrastructure and data processors

Your data passes through or is stored by the following processors:

Netlify: Hosts the platform (static files and serverless functions). Netlify may log standard server access data (IP, timestamp, endpoint) per their own policy. We do not retain these logs.
Supabase: Our database provider (PostgreSQL, hosted in the United States). Stores your student profile, lab submissions, and purchase record. Supabase operates under a data processing agreement and maintains industry-standard security.
Lemon Squeezy: Payment processor and Merchant of Record. They receive your email and payment information. Their privacy policy governs payment data.
Resend: Transactional email delivery (access codes, lab submission confirmations, access expiry warnings). Your email is used only to send neoCatalyst Labs transactional emails via Resend. Not used for marketing.
Meta (Facebook and Instagram): Hosts the advert forms described above. Where you reach us that way, Meta collects your name, email address and answers before we receive them, and Meta's own privacy policy governs what they do with that information. We also send Meta a message from our own server when a visitor reaches our pricing or completes a purchase, so we can measure our adverts. We run no Meta advertising pixel, and nothing about a student, their work or their results is ever sent — see "Analytics and advertising" below.
Kit (formerly ConvertKit): Marketing email (free-guide subscribers and enrollment-waitlist sign-ups). Used only if you opt in. Unsubscribe any time.

Analytics and advertising

We show no ads on neoCatalyst Labs and run no analytics platform. There is no advertising pixel, tag or SDK in your browser on any page, and labs, dashboards and every other signed-in page carry no advertising code of any kind.

Advert measurement (Meta Conversions API). We advertise our public marketing pages on Facebook and Instagram. To learn which of those adverts lead anywhere, our server sends Meta a message when a visitor reaches our pricing or completes a purchase. It is sent by us, from our servers — nothing in your browser reports to Meta — and it carries only which of those two things happened, when, the page it happened on, your IP address and browser user agent, and, if you arrived from one of our adverts, the click identifier Meta attached to that link. For a purchase we also include a one-way hash of the purchaser's email address, so Meta can match the sale to the advert without us handing over the address itself.

We send Meta nothing about a student: not their name, profile, lab work, answers, reports, marks or results. No signal of any kind is sent from a lab, a dashboard or any signed-in page. Meta uses what we send to attribute and measure our adverts, and under their own terms may also use it to improve their advertising systems; their privacy policy governs what they do with it. You can limit this from your own Meta account under Settings → Your activity off Meta technologies, and you can ask us to stop sending it for you by emailing info@neocatalystlabs.com.

We reserve the right to change or extend our advertising measurement. If we do, we will disclose it here and notify users and, where the change materially affects minor student personal information, the applicable parent or guardian, and continued use of neoCatalyst Labs will constitute acceptance of the updated terms, except where applicable law requires affirmative consent. We do not sell or trade your personal information. We will not use minor student personal information for targeted advertising or cross-context behavioural advertising.

Fonts and third-party assets

neoCatalyst Labs self-hosts all fonts (Geist and JetBrains Mono). No font requests are made to Google Fonts or any external CDN when you use the platform. We use no advertising pixels and no analytics SDKs anywhere on the site. One third-party script runs on our public marketing pages — the affiliate referral tracker supplied by our payment provider, Lemon Squeezy (lmsqueezy.com) — described below. It is not loaded on labs, dashboards, or any signed-in page. We reserve the right to add other tools in the future, as described above.

Cookies and session tokens

We use one session cookie (ncl_session), set as an HttpOnly, Secure cookie after login. It is not accessible to JavaScript or browser extensions. It is used solely to authenticate your lab sessions and expires at the end of your access window.

Affiliate referral tracking. If you reach our public marketing pages through a link shared by one of our affiliate partners, Lemon Squeezy's affiliate script stores an identifier in your browser recording which partner referred you, for up to 60 days. Its only purpose is to pay that partner a commission if you later buy. It does not record your browsing on other websites, is not used for advertising or ad targeting, and is not shared with any advertising network. It is not loaded on labs or on any signed-in page. If you arrive without an affiliate link, nothing is stored.

We use no advertising cookies and no cross-site tracking cookies. Where you arrive from one of our adverts, the click identifier from that link is kept in your browser's own storage for the length of your visit so a purchase can be matched to the advert; it is first-party, no other site can read it, and it is not a cookie. We reserve the right to introduce analytics or advertising cookies in the future; if we do, we will update this policy and notify users and, where the change materially affects minor student personal information, the applicable parent or guardian, and continued use will constitute acceptance, except where applicable law requires affirmative consent. California residents will be able to opt out of any cookie-based "sharing" for advertising — see "Your rights." Advertising or cross-site tracking cookies will not be used on student labs, dashboards, or other signed-in student areas.

Security

All data is transmitted over HTTPS (TLS). Access codes are stored as bcrypt hashes — the plaintext code is never stored on our servers after delivery. Lab files are gated at the CDN edge layer (via Netlify Edge Functions) — unauthenticated requests never receive a lab file. If we become aware of a security incident affecting your personal data, we will notify you by email within a reasonable time.

Data retention

Purchase records: Retained for 4 years from the date of purchase. This is a commitment, not a policy subject to quiet revision. It ensures your transcript documentation remains verifiable for college applications and subsequent re-verification.
Academic records (lab submissions, reports, profile): Retained for as long as your account exists. Reports remain downloadable from the parent dashboard after your access window expires.
Security/anti-sharing logs (hashed IP; device signals if and when added): Retained for 90 days, then purged automatically.
Advert measurement signals: Held by Meta under their own retention policy once sent. We keep no copy of our own beyond the anonymous funnel counts described above, which carry a hashed IP and no identity.
Marketing email (Kit): Retained until you unsubscribe. Unsubscribing removes you from Kit; it does not affect a separate purchase account if you have one.

FERPA

FERPA (Family Educational Rights and Privacy Act) applies to schools that receive federal funding. neoCatalyst Labs is not a school and does not receive federal funding, so FERPA does not apply to us directly. We nonetheless handle student records with the same care FERPA requires: we do not share student data with third parties, we do not use it for advertising, and parents and students retain full control over their own records.

Children's and Minor Students' Privacy (COPPA)

neoCatalyst Labs is designed for students ages 13 and older (high school, Grade 9+). We do not knowingly collect personal information from children under 13. Students confirm their age during account setup. Students under 13 may not create an account, access the platform, or submit personal information to neoCatalyst Labs. If you believe a child under 13 has provided personal information, contact us at info@neocatalystlabs.com and we will delete that data promptly.

Students ages 13 through 17 may use neoCatalyst Labs. Where a student is under 18, we provide the student's parent or guardian with notice of the student information we collect and how we use it. This information may include the student's name, grade level, school name, course information, lab responses and submissions, time-on-lab, generated reports, and the limited security and technical information described in this Privacy Policy. We use minor student information only to provide and operate the educational service, generate academic documentation, maintain student accounts and records, provide support, maintain platform security, and for the other purposes specifically disclosed in this Privacy Policy. Except where applicable law requires parental or guardian consent for a particular processing activity, the parent or guardian receives notice of these practices and separate consent is not required for a student age 13 or older to use neoCatalyst Labs. We do not sell minor student personal information, use minor student personal information for targeted advertising, or use a minor student's academic work or personal information to train artificial intelligence models.

Your rights

Access and export: You can download all lab reports and transcript documents from the parent dashboard at any time. A parent or guardian may also contact us at info@neocatalystlabs.com regarding personal information associated with their minor student. We may take reasonable steps to verify the identity and authority of a parent or guardian before providing access to a minor student's information.

Deletion: Email info@neocatalystlabs.com to request account deletion. We will remove your name, email, and student profile. Purchase records are retained per our retention policy above. A parent or guardian may request deletion of their minor student's personal information, subject to records we are required or permitted to retain. We may take reasonable steps to verify the identity and authority of a parent or guardian before deleting a minor student's information.

California residents (CCPA/CPRA): To the extent neoCatalyst Labs is subject to the California Consumer Privacy Act, California residents have the rights provided by applicable law. We do not currently sell personal information.

Changes to this policy

We reserve the right to change this policy at any time. If we make material changes, we will update the effective date above and notify users by email where we have an address. Where a material change affects how we collect, use, or disclose a minor student's personal information, we will also provide notice to the applicable parent or guardian using the contact information available to us. Continued use of neoCatalyst Labs after any change constitutes acceptance of the revised policy, except where applicable law requires affirmative consent to a particular change. Where reasonably practicable, notice of a material change affecting minor student personal information will be provided before the change becomes effective.

Contact

Privacy questions or deletion requests: info@neocatalystlabs.com