Privacy notice

What we collect

We collect the account details you provide, your learning activity, session intentions and reflections, permission records, and technical information needed to keep the service secure.

• The app keeps an app-scoped installation identifier, device name or model, platform and app version when supplied, plus recent-use and security details such as last-seen time, protected network reference and browser or app information. This helps you recognise devices and helps us protect your account.
• If you use Google, Facebook, or LinkedIn to sign in, we keep the provider name, its stable account identifier, the email it returns, and whether the provider confirmed that email. We do not retain the provider access token or raw profile response.
• If you add a recording, we process the recording, transcript, language information, AI feedback, and evidence links created from it.
• If you report a concern about AI feedback, we keep the concern category and any optional details you choose to add so an authorised person can review it. The app does not include session content in the submission automatically.
• If you connect Zoom, we store the connection and selected meeting details needed to discover recordings. For an eligible discovered recording, we store limited recording metadata to create the review item; no media is imported until you approve it and any applicable participant or client permission is valid. We do not import video, chat, participant files, or meeting summaries.

Waiting list

When you join the waiting list, we store your email in encrypted form, a keyed fingerprint of your email to identify duplicate requests without exposing the address, your selected access group, language, request status and timestamps, and minimal security and audit information.

We use this information only to manage the waiting list and invite you when public access opens for your group. Joining the list does not create an account automatically.

You may ask support to correct or delete eligible waiting-list information. We may retain limited security, legal, or audit records where necessary.

Why we use it

We use this information to provide your learning journey, prepare source-linked developmental feedback, remember useful themes across sessions, support you, prevent misuse, and keep an auditable record of permission and important actions.

Permission comes first

Recordings may be used only with permission from both coach and client or practice participant. Real-client processing waits for the client’s recorded agreement. Permission can be declined or withdrawn without affecting access to unrelated parts of the service.

AI and service providers

AI services help create transcripts, translations, and formative feedback. We send these requests with response storage disabled. Under standard controls, an AI provider may still keep limited request data for abuse monitoring for up to 30 days; stronger approved data controls can reduce this period. API data is not used to train public models unless the account owner explicitly opts in. Our hosting, email, security, AI, and connected-meeting providers process only the information needed to deliver their part of the service.

• AI output can be incomplete or mistaken and remains a developmental hypothesis.
• A connected meeting provider remains responsible for its own copy of a cloud recording under your account settings.

Storage and retention

Recordings are encrypted in private storage and normally scheduled for deletion after 30 days. Verified transcripts, consent receipts, structured findings, reflections, audit records, and deletion receipts may be retained to preserve the integrity of your learning record. If Zoom verifies that you removed The Coaching Map, we delete the Zoom connection, content, identifiers, imported session, and learning data derived from it in active product systems, regardless of that normal schedule. To prevent an authorization already in progress from restoring access, we temporarily use only keyed, non-reversible identity and event digests plus lifecycle timing records. They contain no raw Zoom account or user identifier, credential, meeting detail, recording, transcript, or client information. These markers expire and stop being used within 24 hours. Automated cleanup removes expired rows; if infrastructure is unavailable, physical row removal completes when normal processing resumes. The recording in your Zoom account is not deleted. Encrypted server backups may retain a deleted item until the normal backup cycle expires.

Your choices and rights

You can delete an imported recording, withdraw client permission while the recording is retained, disconnect Zoom, or ask us to access, correct, export, restrict, or delete eligible personal information. Some records may need to be retained for security, legal obligations, or evidence integrity.

International processing and security

The service and its providers may process information in more than one country. We use access controls, encryption, signed requests, least-privilege permissions, audit trails, and tested recovery procedures to reduce risk. No online service can promise absolute security.