Privacy Policy
Last updated: [DATE]
The short version
Driving Performance is a private coaching space. Your conversations with Dr. B belong to you. Your employer paid for your seat, and your employer cannot read what you write here. They see how many people use it and whether it is working, never who said what.
We are not a medical or mental-health service. Dr. B is an AI, and will tell you so if you ask.
This summary is here for orientation. The sections below are the actual terms.
1. Who we are
[LEGAL ENTITY], [REGISTERED ADDRESS] ("we", "us") provides the Driving
Performance coaching product.
For questions about this policy or your data: [PRIVACY CONTACT EMAIL].
[IF THE ENTITY IS NOT ESTABLISHED IN THE EU: our EU representative under Article 27 GDPR is (NAME, ADDRESS, EMAIL).]
[DPO: we have assessed that a Data Protection Officer is / is not required under Article 37. Confirm with counsel.]
2. Our two different roles
This matters, so it is near the top rather than buried.
For your coaching content, we are the data controller. Your conversations, the memory Dr. B builds from them, and your development profile are processed by us, under this policy. Your employer does not direct how we handle them and cannot access them.
For your account and roster data, we are a data processor acting for your employer. Your name, work email, and which cohort you belong to come from your employer, who decides who receives access.
The practical consequence: exercise your rights over coaching content directly with us, using the contacts in section 9. For questions about why you were given a seat, speak to your employer.
3. What we collect
You give us:
- Account details: preferred name, work email, and role.
- Anything you write to Dr. B, and anything you write into your profile, insights, or saved items.
The system derives from your conversations:
- Summaries of each conversation.
- Memory items: observations, the people and situations you discuss, commitments you make, and themes over time.
- A development profile across the framework's areas, with a written reading of where you appear to be focused.
We collect automatically:
- Product usage: which screens you open, which content you watch and how far.
- Technical data needed to run the service: request logs, error diagnostics, and the cost of the AI calls your usage generates.
We do not collect: payment card data (there is no consumer checkout), and we do not buy personal data from third parties or run advertising trackers.
4. Sensitive information
The product is leadership development. It is not therapy, diagnosis, or medical care, and we do not ask you for health information.
In practice, honest conversation about work sometimes includes health, mental health, or similarly sensitive detail. When you choose to write that, it is stored like the rest of your coaching content and is covered by the same confidentiality.
Because that information can qualify as special-category data under Article 9 GDPR, we ask for your explicit consent when you start using the product. You can withdraw it at any time by deleting your account or the specific items (section 9). Withdrawing consent does not affect processing that already happened.
Please do not write anything you would not want stored. If you are in crisis, this product is not the right tool: contact your local emergency services or a crisis line.
5. Why we process it, and our legal basis
| What | Why | Legal basis |
|---|---|---|
| Your conversations and derived memory | To provide coaching that remembers you between sessions | Performance of our contract with you (Art. 6(1)(b)) |
| Sensitive detail you volunteer | Same as above | Your explicit consent (Art. 9(2)(a)) |
| Account and roster data | To give you access to the seat your employer bought | Our legitimate interests and our contract with your employer (Art. 6(1)(b)/(f)) |
| Product usage analytics | To understand whether the product works and improve it | Legitimate interests (Art. 6(1)(f)); you can opt out |
| Aggregate reporting to your employer | To show the buyer whether their investment works, without exposing individuals | Legitimate interests (Art. 6(1)(f)), with a minimum cohort size |
| Security, error, and cost logs | To keep the service running, safe, and within budget | Legitimate interests (Art. 6(1)(f)) |
6. What your employer can and cannot see
Your employer receives aggregate figures only, and only when the group is
large enough that individuals cannot be identified (currently a minimum of
[10] people). Examples of what they see: how many seats are active, activation
and retention rates, how many experiments were started, and which development
areas are trending across the group.
Your employer cannot see: your messages, your summaries, your memory items, your development profile, or anything attributable to you as an individual. There is no screen in the product that shows them, and the aggregate reports suppress groups below the minimum size.
We contractually prohibit your employer from using anything we provide to make employment decisions about you, and we do not provide them with anything that would enable it.
7. Automated decisions and profiling
Dr. B builds a profile of your development patterns. That is profiling under GDPR, and you should know it happens.
It is not used to make any decision that produces legal effects or similarly significantly affects you (Article 22). It informs a coaching conversation, and nothing else. It is not shared with your employer, not used for hiring, pay, promotion, or discipline, and not sold.
You can see the profile, and you can correct it. See section 9.
8. Who we share it with
We do not sell personal data. We share it with service providers who help run the product, listed in full with their purposes at subprocessors.md.
The one worth calling out: your conversations are sent to Anthropic to
generate Dr. B's responses. Under Anthropic's commercial API terms, your content
is not used to train their models. [CONFIRM WHETHER ZERO-DATA-RETENTION AND EU RESIDENCY ARE ENABLED, AND STATE IT HERE — this is the question EU buyers ask first.]
We also disclose data if legally required, or to protect someone's life or safety.
9. Your rights and how to use them
Under GDPR you can request access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it.
Several of these are built into the product rather than requiring a request:
- See what Dr. B remembers, item by item, in your profile.
- Correct or retire any memory item, or mark it as something not to raise unless you raise it first.
- Opt out of product analytics in Settings → Privacy.
- Export your data, and delete your account and its data, in Settings.
For anything else, or to make a formal request, contact
[PRIVACY CONTACT EMAIL]. We respond within one month. You also have the right
to complain to your local supervisory authority [FOR NL: the Autoriteit Persoonsgegevens].
10. How long we keep it
While your account is open, we keep your coaching content so that Dr. B can remember you. That continuity is the product.
When you delete your account, we delete your personal data from our production
systems, and it ages out of encrypted backups within [BACKUP RETENTION WINDOW — confirm with Supabase plan].
Operational records with short lifespans: the full context assembled for each
coaching turn is pruned automatically on a rolling window; error and cost logs
are kept for [RETENTION].
We do not delete your conversation history on a timer, and that is deliberate. Your history is your relationship with the coach. A coach who forgot everything you said three months ago would be a worse coach, and silently deleting your own record of your development would take something from you rather than protect you.
So retention is tied to purpose rather than to a clock: we keep it while you have an account, because that is exactly as long as it is needed to provide the service. It ends when you do. And you are not waiting on us in the meantime: you can delete any individual item, or your entire account, at any moment (section 9).
11. Where your data goes
We are [LOCATION], and our providers include companies in the United States.
Where personal data leaves the EEA, transfers rely on the European Commission's
Standard Contractual Clauses together with additional safeguards, and we have
assessed those transfers. [CONFIRM: SCCs executed with each US subprocessor; transfer impact assessment on file.]
[DECISION: moving the production database and AI inference to EU regions would remove most of this section's risk. See README item 3.]
12. How we protect it
Encryption in transit and at rest, database-level row security so one user cannot reach another's data, passwordless sign-in, and least-privilege access to production. The full picture, including our current gaps, is in security-overview.md.
If a breach puts your rights at risk, we notify the supervisory authority within 72 hours and tell you without undue delay.
13. Children
The product is for working adults. It is not directed at anyone under 18, and we do not knowingly collect their data.
14. Changes
If we change this policy materially, we will tell you in the product or by email before it takes effect.