Privacy policy

Who this policy covers

Two kinds of people use the service. Coaches create an account, set up a practice and pay us a subscription. Clients are invited by a coach, use a client space the coach has branded, and pay the coach, never us. This policy covers both. Where the rules differ, it says so.

For a coach's account and billing data, Commitment Coach, LLC (placeholder) is the controller. For the content of a coaching engagement (notes, goals, messages, intake answers), the coach decides what is collected and why, and we process it on the coach's behalf under these terms.

What we collect

We collect only what the service needs to work.

• Account details: name, email address, password (stored as a hash we cannot reverse), time zone, and for coaches a business name, photo, logo, accent color and public bio.
• Engagement content: packages, agreements and typed signatures (with the time, IP address and agreement version), intake answers, session times, shared and private notes, goals, metrics, habits, actions, messages and attachments, and uploaded documents.
• Payment records: for coaches, the subscription status, invoices and the last four digits and expiry of a card held by our payment processor. For clients, the record of a payment to a coach: amount, currency, date and receipt number. We never store full card numbers.
• Technical data: the IP address and browser of each sign-in, server logs kept for a short period for security and debugging, and the cookies described below.
• Email events: whether an email we sent was delivered or bounced, so reminders and receipts reach people.

What we do not collect

We run no advertising, analytics or behavioural tracking scripts. We do not buy data about you, sell data about you, or build profiles for anyone else. We do not read private notes or messages except where a specific support request or a legal obligation requires it, and then only the minimum.

Why we use it

Each use has a reason, and the reason is the service itself.

• To run your account and the practice: show the right data to the right person, keep a coach's clients apart, and keep a client's data visible only to that client and their coach.
• To send the emails the service depends on: invitations, receipts, booking confirmations, session reminders, password resets and failed-payment notices. These cannot be switched off while an account is active.
• To send optional emails a person has chosen: new message digests, habit reminders, action reminders and weekly summaries. Each has a switch in notification settings and an unsubscribe link in the footer.
• To bill coaches for the subscription, and to produce receipts for clients' payments to coaches.
• To keep the service secure: detect abuse, investigate problems, and keep an audit trail of signatures.
• To meet legal obligations, such as tax records for payments and responding to lawful requests.

Private notes

A coach's private notes about a client are stored in a separate field that the client's view of the service cannot read. This is enforced at the database layer, not only in the interface. Clients never see private notes, and we do not show them to anyone but the coach who wrote them.

Who we share it with

We share data with the providers who run parts of the service for us, under contracts that limit them to doing so: our hosting and database provider, our email delivery provider, our payment processor and our file storage provider. Each sees only what it needs. We do not share data with advertisers or data brokers.

Within the service, a coach sees the data of their own clients and a client sees their own data and what their coach has shared with them. A client who works with more than one coach sees each coach's space separately; coaches do not see each other's spaces.

We will disclose data where the law requires it, where it is needed to protect someone from serious harm, or to enforce these terms, and we will tell the affected person unless the law forbids it.

Where it is stored

Data is stored on servers operated by our hosting provider. Coaches and clients may be anywhere in the world; where data crosses borders, we rely on the provider's standard contractual safeguards. If you need to know the region your data is held in, ask us.

How long we keep it

For as long as the account is active, and then as described here. A coach whose trial ends without a subscription keeps a read-only account; nothing is deleted. A coach who closes their account has their data deleted within 30 days, except payment records we must keep for tax purposes (typically seven years) and signed agreements, which both parties may need; those are kept for the period the law in the coach's country expects for contracts. A client whose engagement ends keeps read access to their own space until the coach closes the account or the client asks us to delete it.

Server logs are kept for 30 days. Backups are kept for 30 days and then overwritten.

Cookies

We use a small number of cookies, all of which the service needs: one to keep you signed in, one to remember your light or dark theme, and one to protect forms against cross-site requests. There are no advertising or analytics cookies, and no third-party cookies.

Your choices and rights

Depending on where you live you have legal rights over your data. We offer the same choices to everyone.

• See and export your data from your settings, as a file you can keep.
• Correct anything that is wrong, in settings or by asking us.
• Delete your account and data, from settings or by asking us; we will confirm when it is done.
• Turn off every optional email in notification settings.
• Object to a use of your data, or complain to the data protection authority where you live. We would rather hear from you first.

Children

The service is for adults. We do not knowingly accept accounts from anyone under 18, and a coach who invites a minor as a client is responsible for having a parent or guardian's consent.

Security

Connections are encrypted in transit. Data is encrypted at rest by our hosting provider. Passwords are hashed. Access to production systems is limited to the people who need it and is logged. If we learn of a breach that affects you, we will tell you promptly and say what we know and what we are doing.

Changes

When this policy changes we will update the effective date at the top and, for changes that matter, tell coaches by email before they take effect. Earlier versions are available on request.

Contact

Write to support@commitment-coach.vercel.app. The legal entity responsible is Commitment Coach, LLC (placeholder).