Privacy Policy

Last updated: [DATE] · This is a draft policy reflecting Catalyst's current data practices. It has not been reviewed by a solicitor — see the note at the bottom.

Who we are

Catalyst ("we", "us", "our") is operated by [COMPANY NAME / SOLE TRADER NAME], [REGISTERED ADDRESS], [COMPANY REGISTRATION NUMBER, if applicable]. You can contact us about privacy matters at [CONTACT EMAIL].

What we collect

• Account data: your email address and password (your password is hashed and managed by our authentication provider, Supabase — we never see it in plain text).
• Content you provide: the learning goals, outcomes, and mission details you enter; files you upload (PDF, Word, PowerPoint, or text) and the text we extract from them; YouTube links you add as source material; your progress through modules and sprints; quiz and assessment answers; and any feedback you submit.
• Technical data: standard server logs (such as IP address and browser type) collected by our infrastructure providers for security and reliability.

How we use it

We use your data to provide the core service: generating your personalised learning missions, lessons, quizzes, and assessments; tracking your progress; responding to feedback and support requests; and keeping the service secure and running.

AI processing

To generate your learning content, we send relevant text (your goals, uploaded material, and chat questions) to OpenAI's API. As of this writing, OpenAI's API terms state that data submitted through the API is not used to train their models — but you should check OpenAI's current policies, as they can change. When you add a YouTube link as source material, we use the YouTube Data API to find relevant videos.

Where your data is stored

Your account and mission data is stored with Supabase, hosted on AWS infrastructure in the EU (Stockholm region).

Cookies

We only use strictly necessary cookies to keep you signed in (managed by Supabase Auth). We do not currently use any analytics, advertising, or tracking cookies. If that changes, we'll update this policy and ask for your consent where required.

Data retention

We keep your data for as long as your account is active. You can delete your account at any time from Account settings → Delete account, which permanently removes your account and all associated missions, modules, and lessons.

Your rights

Under UK GDPR, you have the right to access, correct, delete, restrict, or export your personal data, and to object to certain processing. You can exercise most of these yourself in the app (editing or deleting missions, or deleting your account entirely); for anything else, contact us at [CONTACT EMAIL]. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

Children

Catalyst is not directed at children under 13, and we do not knowingly collect data from them.

Changes to this policy

We may update this policy as the service changes. We'll update the date at the top when we do.

Contact

Questions about this policy? Email [CONTACT EMAIL].