Privacy Policy

Last updated: July 6, 2026

This Privacy Policy explains what data CoachForge collects, how we use and protect it, and the rights you and your clients have. CoachForge acts as a data processor for the client data that coaches manage on the platform.

1. Data We Collect

• Account data: coach name, email, password (hashed with bcrypt), business name, timezone, brand color.
• Client records: names, emails, phone, company, notes, tags, goals, and progress that coaches enter.
• Session data: video/audio recordings, transcripts, AI debriefs, mood/energy/engagement scores, follow-up emails.
• Consent records: whether and when a client consented to recording, and the terms version.
• Technical data: IP address and audit logs for security-sensitive actions (login, exports, erasure).

2. How Recordings and Transcripts Are Stored

Session recordings are stored on Vercel Blob storage with unguessable URLs. Transcripts and the sensitive narrative fields of AI debriefs (summary, action items, breakthroughs, concerns) are encrypted at rest using AES-256-GCM before being written to the database. Data is transmitted over TLS in transit. Recording only occurs after explicit, in-session consent from all participants.

3. Encryption at Rest (AES-256-GCM)

We encrypt sensitive fields with AES-256-GCM, an authenticated encryption scheme, using a key held in our server environment and never stored in the database. Each value uses a unique initialization vector and authentication tag, so ciphertext cannot be tampered with undetected.

4. Third-Party Services

• Daily.co, real-time video calling infrastructure for live sessions.
• OpenAI Whisper, speech-to-text transcription of session recordings.
• OpenAI, generation of session debriefs and follow-up emails. We do not permit your data to be used for model training.
• Resend, transactional email delivery (session invites, follow-ups, password/magic-link emails).
• Vercel, application hosting and Blob storage for recordings.
• Supabase, managed PostgreSQL database.

5. Lawful Bases for Processing (GDPR Article 6)

• Consent: session audio and video recording and its transcription. Recording begins only after all participants explicitly consent in-session, and consent can be withheld or withdrawn.
• Contract: your account data and the client records and sessions you manage are processed to provide the CoachForge service you sign up for.
• Legitimate interests: transactional service emails (session invites, follow-ups, password and magic-link emails, billing notices) and security and audit logging, balanced against your and your clients’ rights.

6. International Data Transfers

CoachForge is operated from the United States, and the sub-processors below are US companies. Where personal data of individuals in the EEA or UK is transferred to the US, the transfer relies on the Standard Contractual Clauses (SCCs)approved by the European Commission (with the UK Addendum / IDTA where applicable), together with each provider’s Data Processing Addendum:

• Vercel (hosting and Blob storage): vercel.com/legal/dpa
• OpenAI (transcription and debriefs): openai.com/policies/data-processing-addendum
• Resend (email delivery): resend.com/legal/dpa
• Supabase (database): supabase.com/legal/dpa
• Daily.co (live video): daily.co/security/gdpr-compliance (DPA provided on request via help@daily.co).

7. Your GDPR Rights

For individuals in the EEA/UK, applicable rights include:

• Access: obtain a copy of personal data. Coaches can export a full client data file (JSON) from the client’s page.
• Erasure: request deletion. Coaches can permanently erase a client and all associated sessions, debriefs, goals, and check-ins.
• Portability: the export is provided in a structured, machine-readable JSON format.
• Rectification, restriction, and objection: correct or limit processing of personal data.
• Complaint: lodge a complaint with your local data-protection supervisory authority. In the UK this is the Information Commissioner’s Office (ICO), ico.org.uk.

Clients should direct requests to their coach (the data controller); coaches can fulfill them using the in-app export and erasure tools.

8. Data Retention

We retain personal data while your account is active. When a client is erased, their data is deleted immediately. On account termination, personal data is deleted or anonymized within 90 days, except where law requires longer retention. Audit logs are retained for security and compliance purposes.

9. Cookie Policy

CoachForge uses a minimal set of cookies, strictly to operate the Service:

• Authentication cookies (cf_token, cf_refresh): httpOnly, secure session cookies that keep you signed in. These are essential and cannot be disabled while using the app.
• OAuth state cookie (cf_oauth_state): a short-lived cookie used to protect the “Continue with Google” flow against CSRF.

We do not use advertising or third-party tracking cookies. Because we only use strictly necessary cookies, no consent banner is required, but you can clear cookies in your browser at any time (doing so will sign you out).

10. Contact

Privacy questions or requests: hello@coachforge.pro.