This page explains, in plain language, how CoachRocks handles you and your clients' session data — for coaches, clients and training schools. The binding document is the Privacy Policy. 本頁另有繁體中文版。

1. What we store, and where

Transcripts, AI analyses, ICF competency reviews, client notes, coach chat history, and copies of emails sent to clients live in our PostgreSQL database, hosted by Neon.
Session recordings you upload live in Cloudflare R2 object storage (bot recordings: see section 5).
Both are cloud-hosted, never on staff machines, and every read requires an authenticated request tied to your account.

2. Who can see it

You, and anyone you deliberately share with. CoachRocks staff do not read session content as a matter of course; access is limited to named personnel, and only to operate the service, investigate a fault you have reported, or meet a legal obligation.

Being precise about what enforces that: the encryption below protects your records against a database or storage compromise, not against CoachRocks itself. The master key that unwraps your data key is a deployment secret, so production access can decrypt. Staff access is therefore an operational commitment backed by confidentiality obligations, not a cryptographic impossibility, and we do not today offer a self-serve log of it. If you need a record of access for a specific period, ask us and we will provide what we hold.

Two things that follow from this, and that you can act on:

Server logs carry no session content. They record identifiers and state — the internal ids of an account, client or session, the pipeline step, the error type and code — never a transcript, an AI analysis, a client name or an email address.
A code name is enough. When you add a client you can use an alias ("Partner A", "Client 01"). Sessions, analysis and the ICF coaching-hours log all work from that record, so a real name is never required.

3. Encryption

Application-layer encryption (AES-256-GCM), on top of the storage provider's own: client names, emails, phone numbers, LinkedIn and website, session titles, transcripts and their timings, AI analyses, ICF reviews, client notes, custom report bodies, coach chat history, copies of client emails and their recipients, client names and contact details in the coaching-hours log, calendar integration tokens.
How encrypted fields are matched: the app has to match calendar invites to clients by email and stop duplicate records by name. Those comparisons use blind indexes (HMAC-SHA-256 keyed hashes under a separate key), so the database never sees the value.
One key per coach: your records are encrypted under a data key that exists only for your account, itself encrypted by a master key held as a deployment secret outside the database. A key exposed for one account exposes only that account, and the master key can be rotated without rewriting anyone's records.
Closing your account destroys your key (crypto-shredding): the data key is deleted together with the account, so any copy of the encrypted records that outlives the deletion cannot be decrypted by anyone, us included. The one exception is the database provider's point-in-time backups taken before the deletion, which remain readable until they age out of its restore window, measured in days.
Not application-encrypted: the coach's own account details (name, email), session times and links, status fields. These remain protected by the provider's disk encryption and by access control.

4. AI and model training

Transcription and analysis use OpenAI (analysis, fallback transcription), Soniox (speech-to-text with speaker separation) and Skribby (the meeting recorder). What each receives, and its commitments in its own words, is in section 8.
Names and email addresses are kept out of AI prompts. Before a transcript or session data is sent to OpenAI for analysis, the text is rewritten in memory: the coach's and the client's names become placeholders, every email address becomes a placeholder, and speaker labels are reduced to "coach" and "client". The real values are put back into the result on our side, and the stored copy keeps the encryption described in section 3 throughout. This reduces rather than removes what the processor sees: a name spoken in a form we cannot recognise (a nickname, a misspelling) stays in the transcript text, speech-to-text necessarily receives whatever was said aloud, and research you run on a named prospect (Discovery Call Prep) sends that name by design.
CoachRocks does not train any model on your session content. OpenAI, Soniox and Perplexity state in their API terms or documentation that customer content is not used to train their models (quoted in section 8); Skribby's privacy policy does not address the point.
Every ICF review states which ICF document revision it was judged against and what a transcript cannot perceive (silence, tone, presence). It is a learning aid, not an official ICF assessment.

5. Retention and deletion

Transcripts and analyses are kept until you delete them; nothing expires on a timer.
Sessions reach CoachRocks three ways, and the audio is treated differently in each. Bot-recorded: we keep only the transcript — as soon as it is stored and analysed, we delete the bot from Skribby, and with it Skribby's copy of the recording and transcript; if processing fails and the bot is not deleted, the recording expires under Skribby's default one-week retention or is deleted when you delete the session, client or account.
Recorded in your browser (the "record this session" button, no bot): the audio is deleted automatically once the transcript is stored and the analysis has completed — we keep the transcript and the analysis, not the recording. Deletion happens only after the analysis succeeds, so a failed run leaves the audio in place to retry from; nothing else is needed from you.
Uploaded by you: the recording file is kept until you delete the session or the client.
Delete one session from its analysis page ("Delete session"): recording, transcript, analysis, custom report and sent-email copies go with it.
Delete a client (archive first, then delete): removes every session, recording, transcript, analysis and report for that client.
Close your account: removes everything associated with it, including records held by the recorder service.
Export: "Download your data" in Settings, any time.

Telling the client before recording is the coach's responsibility (ICF Code of Ethics 2.4 and 2.5; Taiwan's Personal Data Protection Act notice-and-consent). We recommend coaches say it themselves rather than leave it to a bot. A script you can use as-is:

"So that I can review my own coaching afterwards, this session will be recorded and transcribed by CoachRocks. It is stored in my account and used only for my learning and for your session recap. You can ask me to stop recording or to delete it at any time. Is that okay with you?"

Once the client agrees, press "Mark as recorded" under Recording consent on their profile; the date is kept with the client.
If you also want the bot to post a recording notice in the meeting chat as it joins, turn on "Bot recording notice" in Settings (off by default).

7. How this maps to the rules

GDPR: the coach is the controller, CoachRocks the processor; data-subject rights (access, rectification, erasure, portability) are served by the features above. International transfers rest on Standard Contractual Clauses — Privacy Policy §6.
Taiwan Personal Data Protection Act: purpose notice before collection, consent, and deletion on request — met by the consent flow and the deletion features above.
ICF Code of Ethics: confidentiality (2.4) and the duty to explain how records are stored and destroyed (2.5).

8. Sub-processors

The outside companies that directly handle client data (recordings, transcripts, names, emails): what each does for CoachRocks, what it receives, and what it commits to on its own pages. Quoted text is the vendor's own wording; where a page does not say something, we write "not stated" rather than guess. All statements were checked against the vendors' pages on 6 September 2026. Services that serve only your own account and receive no client data from CoachRocks (sign-in, analytics, billing) are listed at the end of this section. Hosting locations are on the Subprocessors page.

Neon (PostgreSQL database; a Databricks company) — Security · DPA · Privacy notice

What it does and receives: our primary database. Transcripts, AI analyses, client names and contact details, notes and session records live here (client data and session content carry the application-layer encryption from section 3).
Commitments: "All stored data is encrypted using AES-256"; "Neon enforces TLS 1.2+ encryption"; annual SOC 2 Type II and ISO/IEC 27001:2022 and 27701:2019 audits; "We offer Data Processing Agreements (DPA)".

Cloudflare (R2 object storage) — Privacy Policy · Customer DPA · R2 data security

What it does and receives: recordings you upload are stored in R2; dashboard and API traffic also passes through Cloudflare's network.
Commitments: R2 "Objects are encrypted using AES-256" and transfers use TLS; the Customer DPA incorporates the EU Standard Contractual Clauses (Modules 2 and 3) and cites ISO/IEC 27001, SOC 2 Type II and PCI DSS Level 1.

OpenAI (AI analysis, fallback transcription) — Enterprise privacy · API data controls · DPA

What it does and receives: the full transcript is sent to gpt-5-mini to produce summaries, analyses, ICF reviews, reports and content drafts, with the coach's and the client's names replaced by placeholders before sending (section 4); other people's names mentioned in conversation go as spoken. If Soniox is unavailable, the audio file is sent to OpenAI for transcription instead.
Commitments: "data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in)"; "OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them."; "encrypts all data at rest (AES-256) and in transit ... (TLS 1.2+)"; the API Platform "has been audited and certified for SOC 2 Type 2 compliance"; a DPA can be executed for API use.

Soniox (speech-to-text with speaker separation) — Privacy Policy · Security and privacy

What it does and receives: audio you upload is sent to Soniox as a file for transcription with speaker labels; bot-recorded sessions are transcribed by Soniox through Skribby (see Skribby). Once we have the transcript we immediately ask Soniox to delete the uploaded file and the transcription job.
Commitments: "Soniox does not use Customer Content to train, fine-tune, evaluate, benchmark, or improve Soniox models or services."; "Audio and transcriptions stored via the Async API are automatically deleted after 30 days."; "All data is encrypted in transit using TLS 1.2+ and at rest using industry-standard encryption."; its security page lists SOC 2 Type 2, ISO/IEC 27001:2022, GDPR and HIPAA.

Skribby (meeting recorder bot) — Privacy Policy · Sub-processors

What it does and receives: the bot joins your Zoom, Google Meet or Teams meeting, so it receives the meeting link, participants' display names and the meeting's audio and video; Skribby records the session and has it transcribed by Soniox; we receive the transcript and speaking events. As soon as the transcript is stored in our database and processed, we delete the bot, and with it Skribby's copy of the recording and transcript. Deleting a session, client or account also deletes any bot data still held at Skribby.
Commitments: recordings — "Default retention is one week, with an option for one year (as specified in your service agreement)"; transcripts — "As long as you have an account with us, unless you request deletion"; "All data is encrypted in transit using TLS 1.2 or higher"; "Sensitive data is encrypted at rest using AWS-managed encryption algorithms"; "For business customers, a Data Processing Agreement (DPA) is available". Use of customer content for model training: not stated.

Loops (transactional email) — Privacy · DPA

What it does and receives: session recaps, custom reports and the follow-up emails you send from CoachRocks to clients (client name, email, coach name and the message body), plus our system email to coaches. Clients are recipients only and are never added to Loops' contact list; a coach's name and email are kept as a Loops contact and deleted with the account.
Commitments: the DPA says transfers use "Standard Contractual Clauses, reliance on recognized adequacy decisions, or other legally accepted mechanisms"; the privacy policy states certification under the EU-U.S. Data Privacy Framework (with the UK Extension and the Swiss-U.S. DPF). Encryption and SOC 2: not stated on its public pages.

Perplexity and EnrichLayer (discovery-call preparation) — Perplexity API Terms · Perplexity DPA · EnrichLayer Privacy Policy

What they do and receive: used only when you enter a prospect's LinkedIn URL or company website in Discovery Call Prep on a client's page and press generate. EnrichLayer receives the LinkedIn profile URL and returns the public profile; Perplexity receives the person's name, LinkedIn URL and company or website and summarises public information. No recordings, transcripts or other client data are involved.
Commitments: Perplexity API Terms (23 January 2026): "Perplexity shall not use (or authorize third parties to use) Customer Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models."; API FAQ: "We do not retain any query data sent through the API and do not train on any of your data."; DPA (13 August 2026) with the EU Standard Contractual Clauses. EnrichLayer Privacy Policy (9 June 2025): "Encryption of data in transit and at rest, where appropriate"; Standard Contractual Clauses "where required"; a DPA is available on request; retention of query inputs: not stated.

Services that serve only your own account (they receive no recordings, transcripts or client data from CoachRocks): Google and Microsoft (sign-in and read-only calendar sync: we read your calendar events and send nothing back), PostHog (usage analytics only after you click "Accept" on the cookie banner, account ID only), the Google Ads conversion tag (Google's tag script loads on each page, so Google receives your IP address and the page URL; it runs with consent denied until you accept, writes no advertising cookie before then, and sends one sign-up conversion event with no personal data) and PayPal (coach subscription billing; we never receive card or bank details). We use no third-party error-tracking service, and fonts are served from our own domain, so the browser makes no request to Google Fonts.

9. Contact

Questions: support@coachrocks.com.