The Practice.coach platform (https://www.practice.coach) is operated by MMXXV Labs s.r.o., Company ID (IČO) 11945320, VAT ID CZ11945320, with registered office at Hasičská 930/53, Hrabůvka, 700 30 Ostrava, Czech Republic, registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 87316 (referred to as "we", "us", or the "controller"). We are the data controller for personal data we process in accordance with applicable privacy laws including GDPR.
Contact: privacy@mmxxvlabs.io
We collect only data necessary to operate the platform:
Each data type is used for a specific purpose:
We never sell your coaching data to third parties, and we never use it to train AI models — our contracts with Google Gemini and xAI explicitly cover this restriction.
5.1 Basic sign-in (scopes openid, email, profile). When you sign in with Google, we receive only your name, email address, and profile picture — used solely to create and identify your account. We do not request access to your Google Drive, Gmail, or any other Google services beyond this basic authentication.
5.2 Google Calendar integration (optional, scope https://www.googleapis.com/auth/calendar.readonly). If you explicitly connect Calendar in Settings, we read only the following fields for upcoming events: event title, attendee names and emails, start and end times, location, and description. This data is used solely to display upcoming client sessions in the app and to generate pre-session text briefs. Calendar events are not stored in our database — they are fetched on demand at view time and discarded when you leave the page. You can disconnect the integration at any time in Settings; once disconnected, we stop reading from your calendar.
5.3 Google API Limited Use. Practice.coach's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide the Google Calendar integration feature within the platform and is not sold, not shared with third parties, not used for advertising, and not used to train AI models.
We share your data only with the following processors, each contractually bound to protect it:
server/_core/sentry.ts)What "sent as inference input" means. When you use AI sessions, ICF evaluation, or title generation, the relevant content (transcript, audio, or text) is sent via API to the LLM providers above. The contractual terms with Google and xAI in this mode explicitly prohibit using the content to train their models. Your coaching data therefore does not enter the training datasets of these models.
Primary data location. Your account data and coaching content are stored in a Supabase project located in the European Economic Area (EU region).
Sub-processors in the US (with appropriate safeguards). Some sub-processors (Vercel, Stripe, Resend, Sentry, Google APIs, xAI) process data outside the EEA, typically in the United States. Where this happens, the transfer is safeguarded by the EU Standard Contractual Clauses approved by the European Commission and, where the provider is certified, the EU–US Data Privacy Framework. We can provide a copy of the safeguards on request.
If you upload data about your real coaching clients (e.g. session transcripts, notes, or contact details), you are the controller of that data and we act as your processor, processing it only on your instructions and to provide the service. This data may include special categories of personal data (e.g. health information). You are responsible for having a valid legal basis (typically the client's consent or a contract) before uploading it.
This processing is governed by our Data Processing Agreement (DPA), which forms part of this Policy.
Retention varies by data type:
You can request earlier deletion at any time — see §10.
You have two ways to request deletion of your data:
The same routes also let you exercise other GDPR rights (access, rectification, portability, objection) — see §11.
To exercise your rights, contact: privacy@mmxxvlabs.io
If you are located in the United States, state privacy laws (such as the California Consumer Privacy Act / CPRA, and similar laws in Virginia, Colorado, Connecticut and other states) may give you rights to access, correct, and delete your personal data, and the right not to be discriminated against for exercising them. We do not "sell" your personal information or "share" it for cross-context behavioral advertising as those terms are defined under these laws. To exercise your rights, contact us at privacy@mmxxvlabs.io.
We use only first-party cookies needed to run the platform: (1) an authentication cookie that signs you in and keeps your session, and (2) a cookie that remembers your sidebar preference. We do not use third-party advertising or tracking cookies. If we add analytics in the future, we will use a privacy-friendly solution and update this Policy.
Data is encrypted in transit (TLS/HTTPS) and at rest (Supabase encrypts database and object-storage content at the storage layer). Access to production data is restricted to authorized operations personnel on a need-to-know basis. PII (emails, names) is stripped from logs sent to Sentry by a dedicated redactor on both client and server.
The platform is intended for professional coaches and is not directed to anyone under the age of 18. We do not knowingly collect personal data from children.
We will notify you of material changes by email at least 14 days in advance. The current version is always available at https://www.practice.coach/privacy.