Privacy Policy

Who we are

neoCatalyst Labs ("we," "us," or "our") operates the virtual chemistry lab platform at neocatalystlabs.com. We are a small independent company, not a school or institution. Questions about this policy: privacy@neocatalystlabs.com.

What we collect and why

Account and purchase information: When you purchase access, Lemon Squeezy (our payment processor and Merchant of Record) delivers your email address to us. We use it to send your access code and transactional notifications (new lab releases, access expiry reminders). We do not receive or store your payment card details — those stay with Lemon Squeezy.

Student profile: Student name, parent/guardian name, grade level, school name, and course start date — collected during onboarding. Used to pre-populate lab reports and the transcript documentation package. This data is yours.

Lab progress and submissions: Your student's lab responses, analysis answers, time-on-lab (recorded by a timer while the lab is active), and submitted reports. Used to generate PDF lab reports and populate the parent dashboard. We do not analyse this data for any purpose other than producing your documentation.

Access event logs: When you log in or access a lab, we log a one-way hash of your IP address (the raw IP is never stored). Used only for access code sharing detection — not for tracking, advertising, or profiling.

Lead magnet (free guide): If you submit the free guide form, your first name and email address are sent to Mailchimp for marketing email delivery. This is separate from a purchase account. You can unsubscribe at any time via the link in any email.

We do not collect: Browsing behaviour, advertising identifiers, device fingerprints, or any data used for targeting. We run no third-party analytics scripts (no Google Analytics, no Meta Pixel, no Segment).

Infrastructure and data processors

Your data passes through or is stored by the following processors:

• Netlify: Hosts the platform (static files and serverless functions). Netlify may log standard server access data (IP, timestamp, endpoint) per their own policy. We do not retain these logs.
• Supabase: Our database provider (PostgreSQL, hosted in the United States). Stores your student profile, lab submissions, and purchase record. Supabase operates under a data processing agreement and maintains industry-standard security.
• Lemon Squeezy: Payment processor and Merchant of Record. They receive your email and payment information. Their privacy policy governs payment data.
• Resend: Transactional email delivery (access codes, lab submission confirmations, access expiry warnings). Your email is used only to send neoCatalyst Labs transactional emails via Resend. Not used for marketing.
• Mailchimp: Marketing email (free guide subscribers only). Used only if you opt in via the lead magnet form. Unsubscribe any time.

Fonts and third-party assets

neoCatalyst Labs self-hosts all fonts (Geist and JetBrains Mono). No font requests are made to Google Fonts or any external CDN when you use the platform. There are no third-party tracking scripts, advertising pixels, or analytics SDKs on our pages.

Cookies and session tokens

We use one session cookie (ncl_session), set as an HttpOnly, Secure cookie after login. It is not accessible to JavaScript or browser extensions. It is used solely to authenticate your lab sessions and expires at the end of your access window.

We do not use advertising cookies, tracking cookies, or third-party cookies of any kind. We honour Do Not Track signals by design — our tracking footprint is already zero.

Security

All data is transmitted over HTTPS (TLS). Access codes are stored as bcrypt hashes — the plaintext code is never stored on our servers after delivery. Lab files are gated at the CDN edge layer (via Netlify Edge Functions) — unauthenticated requests never receive a lab file. If we become aware of a security incident affecting your personal data, we will notify you by email within a reasonable time.

Data retention

• Purchase records: Retained for 4 years from the date of purchase. This is a commitment, not a policy subject to quiet revision. It ensures your transcript documentation remains verifiable for college applications and subsequent re-verification.
• Academic records (lab submissions, reports, profile): Retained for as long as your account exists. Reports remain downloadable from the parent dashboard after your access window expires.
• Access event logs (hashed IP): Retained for 90 days, then purged automatically.
• Lead magnet email (Mailchimp): Retained until you unsubscribe. Unsubscribing removes you from Mailchimp; it does not affect a separate purchase account if you have one.

FERPA

FERPA (Family Educational Rights and Privacy Act) applies to schools that receive federal funding. neoCatalyst Labs is not a school and does not receive federal funding, so FERPA does not apply to us directly. We nonetheless handle student records with the same care FERPA requires: we do not share student data with third parties, we do not use it for advertising, and parents and students retain full control over their own records.

Children's privacy (COPPA)

neoCatalyst Labs is designed for students ages 13 and older (high school, Grade 9+). We do not knowingly collect personal information from children under 13. Students confirm their age during account setup. If you believe a child under 13 has provided personal information, contact us at privacy@neocatalystlabs.com and we will delete that data promptly.

Your rights

Access and export: You can download all lab reports and transcript documents from the parent dashboard at any time.

Deletion: Email privacy@neocatalystlabs.com to request account deletion. We will remove your name, email, and student profile. Purchase records are retained per our retention policy above.

California residents (CCPA): You have rights under the California Consumer Privacy Act to know what data we collect and to request deletion. We do not sell personal data. Contact us at the email above.

Changes to this policy

If we make material changes, we will update the effective date above and notify users by email where we have an address. Continued use of neoCatalyst Labs after changes constitutes acceptance of the revised policy.

Contact

Privacy questions or deletion requests: privacy@neocatalystlabs.com