Privacy Policy

1. Who we are

Catalyst Collective, LLC, a Delaware limited liability company doing business as Approve Suite ("we," "us," or "our"), operates Approve Suite at approvesuite.com. This policy explains what personal information we collect, how we use it, and your rights regarding that information.

For purposes of applicable data protection law, Catalyst Collective, LLC is the data controller. You can reach us at info@approvesuite.com or by mail at:

2. Information we collect

Account information

When you sign up, we collect your email address and, optionally, your name, company name, and time zone. If you sign in with Google, we receive your name and email address from Google. Accounts are managed through Supabase, our authentication and database provider.

Watchlists and delivery settings

The companies, indications, CFR parts, and GxP areas you add to a watchlist, your saved views, your digest schedule, and the email addresses you ask us to deliver to. We treat watchlist contents as confidential: they are visible only to you and are never shown to other customers.

Feedback

Useful/noise ratings you give on items and any product feedback you send us.

Email delivery data

Whether a digest or alert we sent was delivered, bounced, or marked as spam, so we can stop sending to addresses that do not want or cannot receive our email.

Usage and attribution data

Standard usage data such as page views and feature interactions, and how you first found us (for example the referring site or campaign), to understand how the product is used and improve it. We do not sell this data.

What we do not collect

The regulatory records shown in the Service come from public government sources, not from you. We do not ask for, and you should not enter, patient data, unpublished regulatory submissions, or other confidential company documents.

3. How we use your information

• To provide, operate, and improve Approve Suite, including matching public records against your watchlist and sending your digests and alerts
• To authenticate your account and enforce plan limits
• To process payments via Stripe (we do not store payment card details)
• To respond to support requests
• To send onboarding and service emails, and product updates and offers if you have opted in (every such email has a one-click unsubscribe)
• To prevent abuse and keep the Service secure

Lawful basis for processing (GDPR)

If you are located in the European Economic Area or United Kingdom, we process your personal data under the following lawful bases: contract (to deliver the Service you signed up for), legitimate interests (to improve the product, prevent abuse, and ensure security), and consent (for optional communications such as product update emails, which you may withdraw at any time).

4. Data sharing

We do not sell your personal data. We share data only with service providers that help us operate the product:

• Supabase: authentication and database hosting (United States)
• Vercel: application hosting (United States)
• Stripe: payment processing (United States)
• Resend: email delivery of digests, alerts, and account email (United States)
• Google: sign-in, if you choose "Continue with Google"
• Cloudflare: bot protection on sign-in and sign-up forms, where enabled
• Anthropic: AI processing (United States). The AI classifies and summarizes public regulatory records. To write the short introduction of your digest, it also receives the name of your watchlist and which of your rules each item matched. It does not receive your name, email address, or payment details, and under our agreement this data is not used to train models.

Each provider is contractually required to protect your data and may not use it for their own purposes. We may also disclose information if required by law or to protect our rights.

5. International data transfers

Catalyst Collective, LLC and our service providers are based in the United States. If you access the Service from the European Economic Area, United Kingdom, or another jurisdiction with data-transfer restrictions, your personal data will be transferred to and processed in the United States. Where required by law, we rely on appropriate transfer mechanisms such as the EU Standard Contractual Clauses or equivalent safeguards established by our service providers.

6. Data retention

Your account, watchlists, and saved views are retained for as long as your account is active. Copies of digests and delivery records are kept for up to one year. Operational logs are kept for up to 90 days, and usage and analytics data for up to 24 months. If you delete your account, your watchlists and personal information are permanently removed within 30 days, except where we are required to retain it by law (for example, payment records required for tax and accounting purposes).

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request that we delete your account and all associated data
• Portability: export your watchlists and settings in a structured format
• Restriction: request that we limit processing of your data in certain circumstances
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent (for example marketing emails), you may withdraw at any time without affecting prior processing

You can edit or delete watchlists at any time and close your account from your profile settings. For other requests, contact us at info@approvesuite.com. We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving a verifiable request.

If you are located in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection supervisory authority.

8. California privacy rights (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: you may request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used.
• Right to delete: you may request deletion of personal information we have collected, subject to certain exceptions.
• Right to correct: you may request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights.

To submit a California privacy rights request, contact us at info@approvesuite.com. We will acknowledge your request within 10 business days and respond within 45 calendar days.

9. Data breach notification

In the event of a data breach that is likely to result in a risk to your rights or freedoms, we will notify affected users and, where required, the relevant supervisory authority, in accordance with applicable law (including within 72 hours where required under GDPR). We will provide information about the nature of the breach, the data affected, and the steps we are taking.

10. Cookies

We use only essential cookies required for authentication and session management. We do not use advertising or tracking cookies. We may use limited analytics tools to understand aggregate product usage; any such tools are configured to minimize personal data collection.

11. Security

We use industry-standard security measures including encrypted connections (HTTPS), row-level security in our database so only you can read your watchlists, signed webhooks, and access controls on administrative functions. No system is completely secure, and we cannot guarantee absolute security.

12. Children

Approve Suite is a professional tool and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in-app notice and by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact

Questions about this policy or your data? Contact us at info@approvesuite.com. See also our Terms of Service.