Privacy notice

Who we are

CAT is run by Anton Churyn, a sole trader in Germany, trading as Coaching Adventure Time. Address: Fasanenstraße 59, 10719 Berlin, Germany.

For anything about your data — questions, requests, complaints — write to [email protected]. A person reads every message.

Who is responsible for which data

Data protection law asks who decides why and how personal data is used (the “controller”) and who only handles it on someone else's behalf (a “processor”). In CAT that depends on whose data it is:

• Your account as a coach (your name, email address, password, settings): we decide how it's used, so we are the controller.
• Your clients' data — the client details you enter, the recordings, transcripts and AI analyses of your sessions, and your clients' consent records: you decide to record and analyse your sessions, so you are the controller, and we process this data on your behalf, as your processor, only to provide the CAT app to you.

If you need a data processing agreement with us for your clients' data, write to [email protected].

What we process

• Your coach account: name, email address, password (stored only as a one-way hash), time zone, analysis language, retention setting, and sign-in sessions.
• Client details you enter: first and last name, email address or phone number, and optional details such as LinkedIn profile, organisation, role and your notes.
• Sessions: date, time, duration, meeting link, and the goals and notes you write.
• Recordings: audio only. The notetaker records the call's mixed audio — no video.
• Transcripts: what was said, as text, with “Coach” and “Client” speaker labels.
• AI analyses: a summary, scores against the ICF Core Competencies, recommendations and blind spots — each with a short quote from the transcript.
• Consent records: when and how a client agreed, declined or withdrew, and the version of the text they saw. As evidence, we store their IP address and browser user agent only in hashed form (a code that can't be turned back into the original).
• Emails we send: the address, the type of email and whether it bounced. We send only emails the app needs — sign-up confirmation, password reset, “analysis ready”, consent requests and answers, account deletion. No marketing.
• Early-access applications from coachingadventuretime.com/for-coaches: what the applicant enters, plus a hashed IP address and user agent against abuse.
• Technical data: server logs and monitoring data (errors, timings). They identify sessions and accounts by internal ids and never contain transcript or analysis text.

Why, and on what legal basis

• To provide the CAT app to you as a coach — your account, your clients and sessions, the recording, transcript and analysis: our contract with you (Art. 6(1)(b) GDPR).
• Recording, transcribing and analysing a client's session happens only after the client agreed — on the consent page we email them, or in person, which you then confirm in CAT. You rely on that consent (Art. 6(1)(a) GDPR). Without it, the notetaker never joins. A client can withdraw at any time.
• Consent records: to be able to show that consent was given (Art. 7(1) GDPR).
• Security, abuse prevention and keeping the service running (logs, monitoring, rate limits): our legitimate interest in a safe, reliable service (Art. 6(1)(f) GDPR).
• Early-access applications: to review the application and reply (steps before a contract, Art. 6(1)(b) GDPR).

The AI analysis

After a recorded session, an AI model — Anthropic's Claude, run on Amazon Bedrock in the EU — reads the transcript and writes feedback on the coach's coaching against the ICF Core Competencies. It is feedback for the coach, not an assessment of the client.

We don't send names, email addresses or other details from your CAT account to the model: the transcript lines are labelled “Coach” and “Client”. What people say during the session (which can include names) is part of the transcript.

Analyses are AI-generated and can be wrong. Only the coach sees them; the client doesn't receive them. No decision with legal or similarly significant effect is made about anyone by automated means.

No training on your data

Nothing from your sessions is used to train AI models — not by us, and not by the providers we use:

• Deepgram (speech-to-text) would by default use audio to improve its models; we switch that off on every request.
• Amazon Bedrock doesn't use inputs or outputs to train models.
• Recall.ai (the notetaker) states that it doesn't use customer data to train or fine-tune AI models.

We also don't use your sessions to test or improve our own prompts unless both you and your client agree to that separately.

How long we keep it

• Recordings and transcripts: deleted automatically after the number of days the coach chooses in Settings — 7, 30, 60, 90, 180 or 365, 90 by default — counted from the end of the session. That includes the recording at the notetaker provider, the stored files and the transcript text. The client sees this number on the consent page. The coach can also delete a session's recording and transcript earlier, at any time, from the session page.
• AI analyses: until the coach deletes them (from the session page) or closes the account. They can contain short quotes from the session.
• Consent records: as long as the coach's account exists.
• Closed accounts: everything is deleted within 24 hours — see below.
• Backups: database backups are kept for a limited time (normally up to 30 days) and then expire, so deleted data disappears from them too.
• Logs and monitoring data (internal ids only): up to 30 days.
• Early-access applications: until they're no longer needed to reply and onboard; write to us to have one deleted sooner.

Deletion and your rights

Coaches can delete data themselves in the app, and each deletion is permanent:

• a session's recording and transcript, straight away (the analysis stays unless you delete it too);
• a session's analysis;
• the whole account (Settings → Delete account): you're signed out everywhere at once, upcoming recordings are cancelled, and within 24 hours everything in the account is deleted — clients, sessions, notes, recordings, transcripts, analyses and consent records — including the recordings at the notetaker provider and our stored files. We then send a last email confirming it.

What stays after an account is deleted: an email address on our list of addresses that bounced or reported spam (so we never email it again), an early-access application if there was one (ask us to delete it), logs and monitoring data with internal ids for up to 30 days, and backups until they expire (up to about 30 days).

Clients: you can withdraw your consent at any time with the link in the consent email. That stops all recording of your sessions with that coach and deletes the recordings and transcripts. For anything else about your data, ask your coach (they are responsible for it), or write to us and we'll help.

Everyone has the right to access their data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting what happened before. Write to [email protected]. You can also complain to a data protection authority — for us that is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, datenschutz-berlin.de) — or to the one where you live or work.

Where the data is processed

In the EU. The app, its database, stored files and emails run on Amazon Web Services in Frankfurt; the AI analysis runs on Amazon Bedrock in EU regions only; transcription uses Deepgram's EU endpoint; the notetaker uses Recall.ai's EU region (Frankfurt); monitoring runs on Grafana Cloud in the EU.

Some of these providers are US companies, so access from outside the EU (for example for support) can't be ruled out. Such transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Changes to this notice

When we change this notice, we update the date at the top. We tell coaches about material changes by email before they take effect.

Subprocessors

These companies process data for the CAT app on our behalf, each under a data processing agreement. We list only the ones in use today and update this list before adding a new one.

• Amazon Web Services EMEA SARL (Luxembourg)

  Purpose:

  Hosting, database, file storage, email (Amazon SES), AI analysis (Amazon Bedrock, Anthropic Claude models)

  Data:

  All app data

  Location:

  EU — Frankfurt; Bedrock in EU regions only

• Hyperdoc Inc., trading as Recall.ai (USA)

  Purpose:

  Joins the call as “CAT Notetaker” and records the audio

  Data:

  Meeting audio, meeting link, participant names shown in the call

  Location:

  EU region (Frankfurt); US company, transfers under Standard Contractual Clauses

• Deepgram, Inc. (USA)

  Purpose:

  Speech-to-text

  Data:

  Meeting audio (not kept after processing; model improvement switched off)

  Location:

  EU endpoint

• Vercel Inc. (USA)

  Purpose:

  Serves the web app and the website

  Data:

  Request data passing through (e.g. IP address, page requested); no client data stored

  Location:

  EU (Frankfurt) region for the app

• Raintank Inc., trading as Grafana Labs (USA)

  Purpose:

  Monitoring (errors, performance)

  Data:

  Technical ids, metrics and error reports — no session content

  Location:

  EU (Grafana Cloud, Frankfurt)