Privacy Policy

Account information

• Name / display name
• Email address
• Username
• Institution / affiliation (optional)
• Password hash (we never store a plaintext password)
• Sign-in identifiers from Google or X (if you choose those methods)

Account operations

• Credit wallet, ledger, purchases, and refunds
• Laboratories opened and billed operations
• Notification-center items we send you
• Team membership and community posts you write
• Waitlist entries for laboratories still in design

Account security

We record browser and operating system, a hashed IP prefix (not the full IP address), and approximate city and country on sign-in, solely to detect new devices and send a security email. This information is not used for advertising. You can revoke known devices in your account settings. Cloudflare Turnstile is used on selected forms to reduce automated abuse.

Payment information

We do not store full card numbers. Payment processing is handled by Paddle. We only receive limited metadata (pack purchased, amount, transaction ID, and credit-balance updates) and keep that metadata with your account so we can issue a receipt and restore a wallet.

Scientific files

Datasets, parameters, logs, and figures you open in a laboratory are processed in that signed-in session so the lab can run. They are not written into our account database as a dataset archive, and they are not used to train models. Export is yours to keep. If a laboratory offers a local project file, that file stays with your browser unless you download or share it.

We use the information we collect to:

• Operate accounts, laboratories, teams, and the notification center
• Manage your credit wallet and issue purchase receipts
• Process payments through Paddle
• Confirm email, recover passwords, and warn you about new devices or a low wallet
• Prevent abuse and keep the service secure
• Improve reliability and fix technical issues

We do not sell your personal data or your scientific datasets. We do not train models on files you open in a laboratory.

Account, wallet, purchase, notification, team, and community records are stored in a Neon Postgres database operated for MatSpace. That database holds the operational record of the service — who you are on the site, what you bought, what we notified you, and similar account rows. It is not a dump of powder patterns, spectra, or microscopy images.

The website is served by our hosting provider. Transactional email (receipts, verification, security notices, credit warnings, team invitations) is sent from our mail service to the address on your account.

• Account information is retained while your account remains active.
• Wallet, purchase, and ledger rows are retained as required for billing and tax, and to reconstruct a balance.
• Known-device records remain until you revoke them or the account is deleted.
• Laboratory measurement files are not retained on the account database after the session; export anything you need to keep.
• You may request deletion of your account and associated personal data by contacting us.

We use the following third parties, each for a stated job:

• Neon — Postgres database for accounts, wallets, purchases, notifications, teams, and community records
• Paddle — payment processing and invoices
• Google and X — optional authentication
• Cloudflare Turnstile — bot checks on selected forms
• Our hosting provider — to run the website and laboratory shells
• Our email service — transactional mail only

These services only receive the minimum data necessary to perform their functions.

We use a signed session cookie so you stay signed in. That cookie is required for the account, wallet, and laboratories to work. We do not use advertising cookies, and we do not run a third-party ad network on matspace.co.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate information
• Request deletion of your account and data
• Export your data

You can update most profile information directly in your account settings. For other requests, contact us at admin@matspace.co.

We take reasonable technical and organizational measures to protect your data, including encrypted transport, hashed passwords, and access limited to operating the service. No method of transmission or storage is 100% secure.

Your information may be processed in countries other than your own, including where Neon, Paddle, and our hosting provider operate. We take steps to ensure appropriate safeguards are in place.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the most recent version.

If you have any questions about this Privacy Policy or our data practices, please contact admin@matspace.co. Related documents: Terms of Service and Refund Policy.