Privacy & Cookie Policy
Last updated: July 22, 2026
1. Who We Are
This website (cat-ro.com) is operated by CAT Membranes("we," "us," "our"), a United States–based company developing catalytic anti-fouling coatings for reverse-osmosis membranes. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, CAT Membranes is the data controller of the personal information described in this policy.
Contact for anything privacy-related: evan@catmembranes.com
2. The Short Version
- We only collect what you type into our demo-request form, plus limited technical data (IP address, browser type) for security, and anonymous analytics.
- We use it to reply to you and to keep the site working and safe. Nothing else.
- We never sell your data, and we don't use it for advertising.
- Our service providers are Supabase (database), Resend (email), and Google Analytics (traffic statistics).
- If you're in the EU or UK, you have specific legal rights over your data — see Section 9.
3. What We Collect
Information you give us (demo-request form)
- First and last name
- Email address
- Organization (optional)
- Inquiry type and any message you write (optional) — including calculator results if you choose to attach them
Information collected automatically
- Security metadata:when you submit the form, our server records your IP address (used only for rate limiting, i.e. blocking spam floods) and your browser's user-agent string (stored with the submission to help identify abuse).
- Analytics data: Google Analytics collects pseudonymous usage data — pages viewed, approximate location (city level), device and browser type, and how you arrived at the site. See Section 6 (Cookies).
We do not collect special-category (sensitive) data, and this site has no user accounts, no payments, and no advertising trackers.
4. Why We Use Your Data (and Our Lawful Bases)
EU and UK law require us to have a "lawful basis" for each use of your personal data. Here they are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to your demo request and following up about your requirements | Form data | Steps taken at your request prior to entering a contract (Art. 6(1)(b)); otherwise our legitimate interest in responding to inquiries |
| Sending you a confirmation email of your submission | Name, email, submission summary | Legitimate interest (Art. 6(1)(f)) — confirming receipt of your own request |
| Preventing spam and abuse of the form (rate limiting) | IP address, user-agent | Legitimate interest (Art. 6(1)(f)) — keeping the service secure |
| Understanding site traffic to improve the site | Analytics cookies & usage data | Consent (Art. 6(1)(a)) where required by EU/UK law; see Section 6 |
We do not use your data for automated decision-making or profiling, and we do not send marketing emails unless you have specifically asked us to keep you informed.
5. Who We Share Data With
We never sell or rent your personal data. We share it only with the service providers ("processors") that run this site's infrastructure, under contracts that limit what they can do with it:
- Supabase — hosts the database where form submissions are stored.
- Resend — delivers our notification and confirmation emails.
- Google (Google Analytics 4) — processes anonymous traffic statistics.
We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets (in which case this policy would continue to apply to your data until amended).
6. Cookies
Cookies are small text files stored in your browser. This site sets no cookies of its own — the only cookies come from Google Analytics, and only on our live production site:
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique visitors (statistics) | 2 years |
| _ga_* | Google Analytics | Maintains session state for this site's analytics property | 2 years |
Strictly necessary items:the form's spam-protection and rate limiting operate server-side and do not use cookies.
Your choices:you can block or delete cookies at any time in your browser settings, or opt out of Google Analytics on all websites by installing Google's opt-out browser add-on. Blocking analytics cookies does not affect your ability to use any part of this site.
Where EU/UK law requires consent for analytics cookies, they should load only after you agree; if you believe analytics ran without your consent, contact us and we will investigate and delete associated data where feasible.
7. International Transfers
We are based in the United States, and our service providers (Supabase, Resend, Google) process data on U.S.-based infrastructure. If you contact us from the EU, UK, or Switzerland, your data will therefore be transferred to the United States. Where required, these transfers rely on recognised safeguards such as the EU–U.S. Data Privacy Framework (for certified providers, including Google) and/or Standard Contractual Clauses included in our providers' data-processing agreements.
8. How Long We Keep Data & How We Protect It
- Demo-request submissions: kept while we follow up on your inquiry and for up to 24 months after our last contact with you, then deleted — unless a business relationship (e.g. a pilot) requires longer retention.
- Rate-limiting records (IP): functionally relevant for 1 hour; periodically purged.
- Analytics data: retained per our Google Analytics settings (14 months), in aggregate form.
Data is transmitted over HTTPS, stored with access controls (database row-level security, restricted keys), and accessible only to the small CAT Membranes team. No system is 100% secure, but if we ever discover a breach affecting your data, we will notify you and the relevant authorities as the law requires.
9. Your Rights (EU & UK Visitors)
Under the GDPR / UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — limit how we use your data while a dispute is resolved.
- Objection — object to processing based on legitimate interests.
- Portability — receive your submitted data in a machine-readable format.
- Withdraw consent — at any time, where processing is based on consent (e.g. analytics), without affecting prior processing.
To exercise any of these, email evan@catmembranes.com. We will respond within one month, and we will never charge you for a reasonable request. We may ask you to confirm the email address the request concerns.
You also have the right to complain to your data-protection authority: in the UK, the Information Commissioner's Office (ICO); in the EU, your national supervisory authority (list here). We'd appreciate the chance to resolve any concern directly first.
Visitors elsewhere (including U.S. states with privacy laws): we extend the same courtesies — access, correction, and deletion on request — to everyone, regardless of where you live. We do not sell or share personal information as defined by the California Consumer Privacy Act.
10. Children
This site is intended for professionals in water treatment and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe a child has submitted data to us, contact us and we will delete it.
11. Changes to This Policy
If we change how we handle personal data, we will update this page and the "Last updated" date above. Material changes (new data types, new purposes, new recipients) will be highlighted here for at least 30 days.
12. Contact
Questions about this policy, cookies, or your data? Email evan@catmembranes.com.