Privacy Policy

Account information you provide when you sign up: name, email address, business name, timezone, and (for coaches) your coaching niche.

Client and coaching data that coaches enter or that clients submit through intake forms, check-ins, messages, tasks, documents, and progress updates. This data belongs to the coach's practice, not to CoachevaOS.

Usage data such as pages visited and features used, collected automatically to keep the product reliable and to improve it.

Payment and subscription details when a coach selects a paid plan, processed by Paddle.com, our payment provider and Merchant of Record. We do not store full card numbers on our own servers.

To operate the core product: authenticate you, keep coach and client portals working, and deliver messages, bookings, and notifications in real time.

To power AI features (daily briefings, session-note follow-ups, smart replies, progress insights) using a coach's own account data. This data is never used to train shared models or shown to other coaches.

To send account-related and, where you've opted in, product email, never sold to third parties for advertising.

To detect abuse and keep the platform secure, including rate-limiting and monitoring for suspicious login activity.

All traffic between your browser, CoachevaOS, and our servers is encrypted in transit (HTTPS/TLS 1.2+). Our API additionally enforces HSTS so browsers only ever connect over HTTPS.

Data at rest — account records, client data, and any OAuth tokens for connected calendar/video integrations (Google Calendar, Zoom, Calendly, Cal.com) — is stored in a managed PostgreSQL database encrypted at rest by our infrastructure provider. Passwords are hashed, never stored in plain text.

OAuth access and refresh tokens for connected integrations are used only server-side to make API calls on your behalf, are never exposed to the browser or any third party, and are only ever used for the specific action you took (e.g. creating a session's video link) — never for broader account access.

Access to production data is restricted to the systems that need it to serve your account; CoachevaOS staff don't access account content except to provide support you've requested or investigate a security issue (see "Who we share data with" above).

CoachevaOS's AI features (daily briefings, session-note follow-ups, smart replies, progress insights, program drafting, the retention and Companion agents described in-app as "Your AI Team") are powered by OpenAI's standard API (not ChatGPT, not a fine-tuning or model-training product). We send only the specific account data needed to generate that feature's output (e.g. a client's recent check-ins for a progress summary), never a full data export.

Every AI feature is purpose-built and scoped to a specific coaching task — none of them are a general-purpose chatbot. Each is instructed to only discuss what it was built for (a specific client's coaching data, a coach's own uploaded documents, or a draft message in the coach's voice) and to decline anything outside that scope, including general knowledge questions, requests unrelated to the coaching relationship, or attempts to use a feature as an open AI assistant. Messages an AI feature drafts for a client are reviewed and approved by the coach before being sent, except where a coach has explicitly turned on fully automatic sending for that feature.

Per OpenAI's API data usage policy, data submitted through the API is not used to train or improve OpenAI's models, and is retained only briefly for abuse monitoring before deletion. CoachevaOS does not use any other third-party AI/ML provider, aggregator, or model gateway, and does not operate any self-hosted or offline model.

Where a coach connects a Google Calendar, Zoom, Calendly, or Cal.com account, that integration's data (e.g. calendar events, meeting links) is used only to provide the scheduling/video feature itself and is never passed to any AI model or used to train or improve any AI/ML system.

Limited Use compliance statement: The use of raw or derived user data received from Google Workspace APIs (including Google Calendar) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Every account is scoped to its owner. A coach can only see their own clients, leads, and messages, never another coach's data.

A client can only see their own records and their own coach's shared content (messages, tasks, documents, sessions), never another client's data, and never another coach's internal notes or business data.

CoachevaOS staff do not access account content except as needed to provide support you've requested or to investigate a security issue.

Paddle.com receives the billing details needed to process a subscription — name, email, and payment information — and acts as Merchant of Record for sale, subscription management, tax collection and remittance, and invoicing. Paddle's own privacy practices govern that data once it's in their hands.

Client records, notes, messages, and files created within your practice belong to you. If you close your account, you can request an export of your data before deletion.

We act as a processor of the client data you and your clients enter. You remain responsible for having the right to collect and store that information under applicable law in your jurisdiction.

Account and coaching data is retained for as long as your account is active, plus a limited period afterward for backups and legal/audit purposes.

You can request deletion of your account and associated data at any time by contacting us; some records may be retained longer where required by law.

We use essential, httpOnly authentication cookies to keep you signed in securely. We do not use third-party advertising trackers.

If we make material changes to this policy, we'll update this page and, where appropriate, notify account owners by email.

7, Narhari Nagar, Nashik, Maharashtra 422010, India

Questions about this policy or your data can be sent to om@getcoachevaos.com.