Privacy

Who we are

Catalyst is a product of Kason. Kason is run by Oleksandr Ladaniak, who is responsible for this website and for the personal data collected through it (the data controller). Send any privacy request (access, erasure, objection) or complaint to founders@kason.tech. A registered company for Kason will be named here before public launch.

Visitors to this site

• No analytics or advertising scripts, and this site sets no cookies. When you send a contact form, the bot check may store a small amount of technical data in your browser, which it needs to tell people from bots.
• Your choice of light or dark theme and of paused motion is kept only in your own browser.
• Our hosting and network-security provider (United States) processes IP addresses and request metadata to deliver and protect the site; the transfer is covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.

Contact forms

• When you send a form, we process what you enter — name, work email, company, role, the CRM you use (on the form for CRO, CDMO and CMO teams), and your message — to reply to you. It reaches the founders by email through our service email provider, which also sends you a confirmation.
• Before we send the confirmation, we look up whether the domain of your email address can receive mail. Only the domain is looked up, through our hosting and network-security provider.
• A bot check from our hosting and network-security provider runs when you send a contact form. It uses signals from your browser and device, such as your IP address, to tell people from bots. The provider does this on our behalf, and also uses these signals, as a separate controller, to improve its bot detection.

Our clients

• For people who use Catalyst, we keep their work email, their role and the actions they take in their workspace.
• Access starts with an invitation email; there is no public sign-up.
• Each client’s data stays in its own workspace and is never shared with, sold to or mixed with another client’s. The full terms will be in the data processing agreement each client signs.

People Catalyst writes to

What we process

Name, business email, job title and company; the LinkedIn conversation with the rep; emails and replies; meeting notes; and public events about the company — such as research funding, a financing or a clinical trial — including the name and title of a researcher named in such a record.

Where it comes from

• Public records about companies and their research, which can name a lead researcher. A public record tells us when to write; the person we write to is found separately, and we do not use contact details published in the record.
• Business-data providers, which find the right person and a business email by company.
• The client’s own records: their CRM, mailbox, LinkedIn conversations and meeting notes — and referrals.

Why

Business-development outreach on behalf of a pharma-services company, about work relevant to the person’s professional role. An AI model drafts each email and sorts replies; outside auto mode, every email is approved by a person before it goes out.

Your choices

• The first email that uses data we did not get from you says where the data came from and how to object.
• Reply “unsubscribe” and you are added to the client’s do-not-contact list, and Catalyst sends you no further email on that client’s behalf.
• Ask to be erased and we answer within one month (up to three for complex requests, with notice). Your data is deleted from our live systems; copies in backups and service logs are not used and age out on a set schedule. A minimal record of your refusal is kept so you are not written to again.
• You can also ask for access to your data (including which providers received it), its correction, restriction of its use or a portable copy, and complain to your data protection authority.

Legal basis

The legal basis for each kind of outreach will be listed here before public launch.

How long we keep data

• Contact form messages: for as long as we are in business contact with you. We do not delete them on a timer; ask us and we delete them.
• Records about people Catalyst writes to: the client decides how long its records are kept, and the data processing agreement with each client sets it. A request to erase them is answered as described above.
• The log of actions in a client’s workspace: 24 months by default (each client can set 3 to 36 months). After that, we remove from it what directly identifies the people concerned.
• Do-not-contact records: a minimal record, kept while it is active so that you are not written to again. If it is lifted, it is kept for 5 years from the last email to that address after lifting (or from lifting), then deleted.

Providers and transfers

We use providers in these categories: cloud database and storage, background processing and working records, AI models, contact data and address verification, messaging integration, hosting and network, service email, team notifications, SMS delivery (only when you switch the channel on), business email. Their regions and transfer safeguards are on the subprocessors page; the named list is in each client’s data processing agreement, and a copy of a transfer safeguard is available on request. Data sent to AI providers through their business interfaces is not used to train their models under those providers’ standard terms.