Privacy Policy
What we collect, why, who sees it, and the rights you have under GDPR. Kept short and plain.
Last updated: 6 May 2026
This is the privacy policy for Catalyst — the website at catalystlearn.app and the Catalyst mobile app (currently in private beta). It explains what data we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Dutch implementing law (UAVG). We've kept it short and plain. If anything is unclear, email info@catalystlearn.app.
1. Who is the controller
Catalyst is operated as a sole proprietorship in the Netherlands. The data controller's full legal identity is listed in section 11 (Contact) at the bottom of this page — GDPR requires us to make it available, and that's where you'll find it.
For any privacy question, email info@catalystlearn.app and you'll reach the person actually responsible. Catalyst doesn't have a Data Protection Officer because GDPR Art. 37 doesn't require us to appoint one.
2. What data we collect
Waitlist signup (catalystlearn.app)
If you join the waitlist, we collect:
- Your email address.
- Which form you used (hero or final call-to-action) — for understanding the page.
- The referring URL (if your browser sends one) and a generic browser user-agent string.
- The timestamp of signup.
We do not ask for your name, location, payment details, or any other personal data on the website.
The Catalyst mobile app (private beta)
The app is currently in a closed TestFlight beta. By default it uses Supabase anonymous authentication — a randomly generated user ID is stored on your device and in our database. We don't ask for your name or email inside the app. We collect:
- The anonymous user ID.
- Which learning paths you start and which days you complete (so the app can show your progress).
- Time spent on each session (a count of seconds, not what you read).
- Topics you submit when generating a custom AI-built learning path.
If you join the TestFlight beta, Apple shares basic build install information (device model, OS version) with us through App Store Connect. That's an Apple process, not something Catalyst opted into.
3. Why we use it (lawful basis under GDPR Art. 6)
| Purpose | Data | Lawful basis |
|---|---|---|
| Tell you when early access is ready | Email, signup metadata | Consent (Art. 6(1)(a)) — by submitting the form |
| Operate the app (show progress, save completion) | Anonymous user ID, path/day records | Performance of a contract (Art. 6(1)(b)) — providing the service you opened the app to use |
| Generate audio narration of lessons | Lesson text (not your data) | Performance of a contract (Art. 6(1)(b)) |
| Generate custom learning paths from a topic you submit | Topic, requested duration | Performance of a contract (Art. 6(1)(b)) |
| Diagnose bugs and prevent abuse | Error logs, request counts per anonymous user | Legitimate interest (Art. 6(1)(f)) — keeping the service running and unburned |
4. Who we share it with
We use a small number of trusted processors. Each one only sees the data it needs to do its job, governed by a Data Processing Agreement.
| Processor | What it does | What it sees |
|---|---|---|
| Supabase (Supabase Inc., USA) | Database, anonymous auth, storage, serverless functions | Waitlist email, anonymous user ID, path progress, lesson text |
| Vercel (Vercel Inc., USA) | Hosts the catalystlearn.app website | Standard server logs (IP, user-agent) — used for security and operations only |
| Cloudflare (Cloudflare Inc., USA) | DNS for the domain | DNS lookups (no content) |
| ElevenLabs (ElevenLabs Inc., USA) | Generates audio narration of lessons (text-to-speech) | Lesson script text — no user data |
| Anthropic (USA) and Google (USA) | Generate the lesson content for AI-built custom paths | The topic you submitted plus our generation prompt — no other user data |
| Apple (Apple Inc., USA / Ireland) | TestFlight distribution of the iOS build | Your TestFlight Apple ID and device install metadata |
We do not sell or rent your data. We don't use advertising networks. We don't run third-party analytics on the website at this time (we plan to add product analytics inside the app — likely PostHog — to understand whether the core "open the app, complete a session" loop is actually working; when that goes live, this policy will be updated and the in-app context will say so).
5. International transfers
Most of our processors are based in the United States. When your data is transferred outside the European Economic Area, we rely on:
- The EU–US Data Privacy Framework, where the processor is certified, and
- Standard Contractual Clauses (the European Commission's 2021 SCCs) as a fallback.
You can ask us for a copy of the relevant safeguards by emailing info@catalystlearn.app.
6. How long we keep it
- Waitlist email: until you ask us to delete it, or until the public launch is well past and the list is no longer relevant — whichever is sooner.
- App progress data: as long as the anonymous account exists. Reinstalling the app creates a new anonymous account and the old one is no longer linked to you.
- Server and error logs: typically 30 days, then deleted by the processor.
7. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15).
- Correct data that's wrong or incomplete (Art. 16).
- Erase your data — the "right to be forgotten" (Art. 17).
- Restrict processing in certain situations (Art. 18).
- Port your data to another service in a machine-readable format (Art. 20).
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent at any time, where processing is based on consent (Art. 7(3)).
To exercise any of these, email info@catalystlearn.app from the address you signed up with. We'll respond within 30 days, free of charge.
If we don't resolve a complaint to your satisfaction, you can file one with the Dutch Data Protection Authority — Autoriteit Persoonsgegevens — at autoriteitpersoonsgegevens.nl.
8. Cookies and tracking
The catalystlearn.app website uses no cookies and no third-party trackers at the time of writing. The only outbound request from the page is to Google Fonts to load the typefaces; Google may log standard request data (IP, user-agent) for that delivery.
The Catalyst mobile app uses local device storage (similar to cookies) to remember your anonymous session and progress. It doesn't use advertising identifiers.
9. Children
Catalyst is built for adult learners. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email info@catalystlearn.app and we'll delete the record.
10. Changes
We'll update this page when something material changes — for example, when we add product analytics, add a paid tier, or replace a processor. The "Last updated" date at the top will reflect the change. If the change affects what we do with data you already gave us, we'll email you before it takes effect.
11. Contact
For privacy requests, support, and general questions, please email info@catalystlearn.app. We'll respond from the inbox of the person actually responsible for the data.
Controller of record (per GDPR Art. 13): Robin Maximus, sole trader, the Netherlands. A postal address can be supplied on request to the email above.