Privacy Policy & Data Rights

This policy took effect on October 17, 2026. Every incoming commercial transmission, server call, and marketing referral conducted across catalystcoffee.us is administered strictly under the provisions documented below.

The operational controller managing this roastery domain is Catalystcoffee, trading at catalystcoffee.us. Physical operational facilities and corporate administrative dispatch are registered at 1082 GOSHEN RD., RINCON, GA 31326, RINCON, GA, United States. Telephone communication is routed through (912) 358-9502, and electronic notifications are received at [email protected].

We log only what our industrial inquiry mechanisms strictly demand. When a commercial client lodges an inquiry through our inquiry form (submit.php / fuma69b.php), we record: name, phone, email, address, the kind of enquiry, the message, the requested specification, and the consent tick. Simultaneously, technical and log data is captured automatically: the IP address, the browser's user-agent string, the referring URL, the moment the form was rendered and the moment it was sent. The support chat (chat.php / webe095.php) keeps the conversation and a token (catalyst_chat_token) in the visitor's browser so they can return to it. The consent choice is stored in the browser under site_consent_v2, and nothing else on this site persists a choice. No account, no password, no payment and no card data: nothing is sold on this site and no payment is taken. Furthermore, cookie identifiers and advertising click identifiers are captured, including gclid, msclkid, and fbclid.

Collected records serve concrete commercial functions: formulating custom batch roasting quotes, calculating green coffee procurement schedules, estimating valve pouch packaging logistics, dispatching sample evaluations, defending digital plant endpoints against malicious scraping, fulfilling state regulatory accounting obligations, and evaluating our advertising acquisition efficiency across search and social channels.

Under governing international and domestic privacy doctrines, processing is grounded upon defined legal bases: consent explicitly granted when ticking our intake acknowledgement or allowing cookie categories; performance of a contract or preliminary commercial measures when assessing wholesale toll roasting pricing; and legitimate interest when protecting our communications architecture against unauthorized network intrusion and analyzing roastery advertising engagement.

This commercial website receives active traffic from Google Ads (google ads), Microsoft Advertising (microsoft advertising), and Meta Ads. When a prospective wholesale client reaches our domain through a paid placement, the incoming Uniform Resource Locator carries distinct query parameters. Specifically, Google Ads attaches the gclid parameter, Microsoft Advertising attaches the msclkid parameter, and Meta Ads attaches the fbclid parameter. These identifiers permit attribution of inquiries back to distinct marketing campaigns without storing unsecured banking data.

Our platform maintains active integration with Google Consent Mode v2 (consent mode). By default, the four core privacy signals—specifically ad_storage, ad_user_data, ad_personalization, and analytics_storage—are held denied until the visitor allows storage, and set back to denied when they decline or withdraw consent. Only upon explicit affirmative consent are ad_storage, ad_user_data, ad_personalization, and analytics_storage transitioned to granted. Should a user subsequently alter their preference and decline, all four signals are returned to denied instantaneously.

Data recorded through digital interactions is routed to verified operational vendors under strict confidentiality covenants: Google LLC / Google Ireland Ltd for performance attribution; Microsoft Ireland Operations Ltd for enterprise search advertising analytics, whose data handling protocols are published at privacy.microsoft.com; Meta Platforms Ireland Ltd for marketing event validation; our hardened infrastructure hosting provider located within the United States hosting our web server and MySQL database; and our transactional mail transport provider relaying inbound roasting inquiries directly to our administrative terminal in Rincon.

Our operational nodes and roastery facilities are located within the United States. In the event European or international visitors transmit inquiries across our gateway, data is transferred into United States jurisdiction based upon Standard Contractual Clauses (SCCs) approved by the European Commission, relevant Data Privacy Framework certifications, and explicit contractual necessity to formulate a cross-border commercial estimate.

We enforce explicit finite retention periods across all collected information streams: enquiries and their email copies are retained for 18 months; chat transcripts are kept for 6 months; server and access logs are kept for 90 days; the record of a consent choice in the browser under site_consent_v2 is kept for 12 months; and a data request is answered within 7 days.

All information transmitted between the visitor's browser and catalystcoffee.us is encrypted via TLS 1.3 cryptographic protocols with modern cipher suites. Inbound inquiry records are protected by database salt layers, administrative IP allowlisting, parameterized database queries mitigating SQL injection, automated honeypot verification rejecting automated submission agents, and physical access controls enforced at our facility at 1082 Goshen Rd. in Rincon, Georgia.

For individuals accessing our commercial services from the European Economic Area, the United Kingdom, or Switzerland, the provisions of the gdpr guarantee specific statutory prerogatives: the right to access personal data held in our registries; the right to rectify erroneous or incomplete company specifications; the right to request erasure of inquiry archives; the right to restrict processing during dispute audits; the right to receive portable data files in structured formats; the right to object to processing grounded on legitimate interests; and the right to withdraw previously granted consent at any moment without punitive consequence.

Pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa), alongside consumer privacy statutes in other states, commercial operators must disclose consumer rights. Catalyst Coffee Corporation affirms: we do not sell personal data, nor do we share personal details for cross-context behavioral advertising outside our disclosed ad platform tags. Under California and other state laws, visitors have the right to request knowledge of personal data collected, request deletion, request correction, and the right to opting out of sale or sharing of personal data, without experiencing discrimination.

Our website programmatically reads the Sec-GPC header signal transmitted by compliant browser user agents. When a browser broadcasts the global privacy control signal, our system treats that instruction as an automated, immediate opt-out directive, disabling non-essential marketing tags and setting ad storage signals to denied without requiring secondary manual prompts.

Catalyst Coffee Corporation conducts business-to-business and commercial coffee roasting enterprise. Our digital portal and wholesale services are never directed toward children or minors under the age of sixteen. We do not knowingly solicit, archive, or process personal data from any person below sixteen years of age. Should we discover any inadvertent submission originating from a minor, the record will be purged immediately from our databases.

Commercial clients and visitors retain the statutory right to lodge an administrative complaint with an appropriate supervisory authority. United States residents may contact the Georgia Department of Law's Consumer Protection Division, their respective state Attorney General, or the California Privacy Protection Agency (CPPA) if domiciled in California. European visitors may register complaints with the data protection supervisory authority established in their member state of residence.

To exercise your statutory rights regarding data access, verification, portable export, or comprehensive deletion, submit a written inquiry to our privacy compliance officer at [email protected], or transmit formal postal correspondence to 1082 GOSHEN RD., RINCON, GA 31326, RINCON, GA, United States. We verify identity through matching commercial communication records and will issue our formal response within 7 days of receipt.

Catalyst Coffee Corporation reserves the right to amend this statutory privacy charter as roasting facilities expand, equipment is upgraded, or international digital compliance mandates evolve. Any revised document will be published directly to catalystcoffee.us/privacy.html accompanied by an updated effective date header. Ongoing commercial communication following publication constitutes informed recognition of the updated parameters.

Direct inquiries regarding roastery records or commercial compliance may be addressed directly to our operational staff. Reach our team by telephone at (912) 358-9502, by email at [email protected], or in person or by mail at Catalystcoffee, 1082 GOSHEN RD., RINCON, GA 31326, RINCON, GA, United States. Every inquiry reaches our roasting and operations management desk directly.