Privacy · 5 min read
How Field Lab protects catalogue customer data
What the catalogue collects, what it does not collect, and the controls used around customer and order records.
Published 2026-07-25. Educational research-operations content only.
Collect only what the request needs
The catalogue collects contact and shipping details needed to review and fulfil a request. Phone number and marketing consent are optional. Payment-card, bank, wallet, Venmo, and Cash App credentials are never collected by the website.
Keep public and administrative access separate
Catalogue forms write through server-side endpoints. Customer, order, inventory, and affiliate records are not readable from the public Supabase client. Administrative pages require an authenticated account whose email is explicitly listed as an administrator.
- Row-level security is enabled on operational tables.
- Public catalogue submissions are rate-limited and size-limited.
- State-changing requests require a trusted website origin.
- Sensitive API responses use no-store caching directives.
Customer choices remain explicit
Transactional order emails are separate from optional marketing consent. Customers may request access, correction, or deletion through the support address, subject to records that must be kept for legal, accounting, fraud-prevention, or dispute purposes.