Privacy Policy

This Privacy Policy describes how CLE LTD. (“CoachRocks”, “we”, “us”, “our”) processes personal data when you use the CoachRocks coaching platform and related services (the “Services”), available at https://coachrocks.com.

For questions about this policy or your personal data, contact us at support@coachrocks.com.
CLE LTD. has not appointed a Data Protection Officer or EU/UK representative at this time. For GDPR-related inquiries, please contact us at the address above.

Quick answers: what to tell your client

Professional coaching bodies expect you to be able to explain where session recordings and transcripts are held and who can reach them — the ICF Code of Ethics addresses this directly in sections 2.4 and 2.5 on technology and confidentiality. Coaches ask us these questions often, so here are the answers in plain language. The numbered sections below are the full legal detail.

Where are recordings and transcripts stored? Session recordings are held in Cloudflare R2 object storage only until their analysis completes (see "How long is it kept" below). Transcripts and AI analyses are stored in our PostgreSQL database, hosted by Neon. Both are cloud-hosted rather than on staff machines, and neither is publicly accessible — every read requires an authenticated request tied to your account.

Who can access them? You, and anyone you deliberately share with, plus the limited staff access described at the end of this answer. Client identity fields (names, emails, phone numbers, LinkedIn and website), session titles, transcripts, AI analyses and ICF reviews, custom reports, client notes and insights, the coach's chat history, copies of emails sent to clients, client details in the coaching-hours log, and integration tokens are encrypted at rest by the application, on top of the storage provider's own encryption. Where the application must match an encrypted value (a calendar attendee to a client by email, a duplicate client by name) it compares keyed hashes under a separate key, so the database never holds the value in the clear. Each coach's records are encrypted under a key that exists only for their account, and closing the account destroys that key, so any surviving copy of the records becomes unreadable (the Trust page, section 3, states the one exception: the provider's point-in-time backups from before the deletion, until they age out). The coach's own account details, session times and links, and status fields are protected by the provider's encryption and by access control. CoachRocks staff do not read session content as a matter of course; access is limited to named personnel, and only where necessary to operate the service, investigate a fault you have reported, or meet a legal obligation.

Which outside companies touch this data? Only the processors needed to deliver the features you use:

Each is contractually bound to process data only on our instructions. What each one receives, where it is hosted and what it commits to — quoted from its own pages — is on our Trust page, section 8. A few further services serve only your own account and receive no client or session data from CoachRocks: Google and Microsoft (sign-in and read-only calendar sync, if you connect them), PostHog (product analytics, only after you accept the cookie banner), the Google Ads conversion tag, and PayPal (coach billing). The complete list with locations is our Subprocessors page.

Is our session data used to train AI models? CoachRocks does not train any model on your session content. Our AI processors are engaged under business terms and are not permitted to use your content to train their models. If you need this in writing for a client or an employer, email support@coachrocks.com and we will provide the current processor terms. See also the AI Transparency Notice.

How long is it kept, and how do I delete it? Transcripts and analyses are kept until you delete them or your account is closed — we do not expire them on a timer. The audio is treated differently depending on how the session reached us:

• Recorded by the meeting bot: we keep only the transcript. Once it is stored and analysed we delete the bot from the recorder service (Skribby), and with it the service's copy of the recording and transcript.

• Uploaded by you, recorded in your browser (the in-app "record this session" button, no bot) or recorded with the CoachRocks desktop app: the audio or video file is permanently deleted from our storage automatically once its transcript is stored and the analysis has completed. We keep the transcript and the analysis, not the recording. Deletion runs only after a successful analysis, so a file whose analysis fails or does not run stays in place until a retry succeeds or you delete the session.

• An uploaded transcript file (.txt or .docx) is not a recording and is kept until you delete the session or the client.

• Deleting a session (the "Delete session" control on its analysis page) removes its recording, transcript, analysis, custom report and the copies of emails sent to the client for it.

• Deleting a client (archive first, then delete) removes that client's meetings, recordings, transcripts, analyses and reports, including the stored recording files and the recorder service's copy.

• Closing your account removes everything associated with it and destroys the encryption key for your records, so copies in backups become unreadable as well.

• For anything else, email support@coachrocks.com and we will action it and confirm when it is done.

Section 7 covers retention in full.

What if my client doesn't want to be recorded? Turn the recorder off for that session, or for that client permanently, from the meeting's recording control in your dashboard. No bot joins, and nothing is captured. You can also record and upload manually instead.

1. Who this policy applies to

We process personal data about:

• Coaches (account holders) who register for and use the Services.
• Coaching clients and other individuals whose information coaches enter or import into CoachRocks, or who appear in meetings, recordings, transcripts, or AI-generated outputs.

If you are a client of a coach who uses CoachRocks, your coach is typically the primary decision-maker (controller) for your data in the platform; CoachRocks processes such data on behalf of our customers (processor) as described in our agreements and Section 8.

2. Personal data we process

We process the following categories of data, depending on how you use the Services:

2.1 Account and identity (coaches)

• Name, email address, profile image (e.g. from Google sign-in), account identifiers, authentication data (including password hashes where applicable), and Google account identifiers where you use Google login.

2.2 Client and contact records

• Name, email, phone, notes, tags, contract or related fields, and other information coaches store about clients.

2.3 Meetings, media, and conversation content

• Meeting titles, dates, links, uploaded or linked recordings (e.g. video/audio), transcripts (including speaker-labelled segments from integrated tools), and related metadata.
• AI-generated analyses derived from sessions (e.g. summaries, themes, action items, recommendations, follow-up content, and similar outputs).

2.4 Integrations

• Google or Microsoft (OAuth and Calendar): When you connect Google or Microsoft, we receive profile information allowed by the scopes you approve and process calendar-related data as needed to provide calendar features (read-only calendar access: event titles, times, attendees and meeting links). OAuth tokens required for integration are stored and used only to operate the integration.
• Prospect research (Discovery Call Prep): When you enter a prospect's LinkedIn URL or company website and ask for call preparation, we send that name, URL and website to our research providers (Perplexity, EnrichLayer) to summarise publicly available information. No recordings or transcripts are involved.
• Meeting bot / transcription partners: Where you use features that rely on a third-party bot or similar service, we send operational data (such as meeting URLs or identifiers) and receive transcripts or status information as required for those features.
• Email delivery: We send transactional and product-related emails (e.g. password reset, notifications) via our email provider; these messages may include names, email addresses, and content needed for the email purpose.

2.5 Technical and security data

• Session and device-related data associated with authentication (e.g. refresh tokens, session validity, and device or client information such as user-agent where stored for security or troubleshooting).
• Server and infrastructure logs (e.g. IP address, timestamps, error logs) typical for hosted software.

2.5.1 Cookies and local storage inventory

The Services use the following cookies and browser storage. You can reject analytics/marketing technologies at any time through the cookie banner or your browser settings.

Strictly necessary items are set without consent because the Services cannot function without them; optional analytics items load only after you grant consent. You can withdraw consent at any time by clicking Reject on the banner or by clearing cookies in your browser — the next page load will re-prompt.

2.6 Communications with us

• Information you provide when you contact support or correspond with us.

We do not use CoachRocks to knowingly collect special categories of data under Article 9 GDPR from you as a dedicated data-collection step. However, recordings and transcripts may incidentally reveal sensitive information spoken in sessions. Coaches should only upload or process such content where they have an appropriate legal basis and safeguards.

3. Purposes and legal bases (GDPR)

We process personal data for the purposes below, relying on the legal bases indicated.

Client data entered by coaches: Coaches determine why and how client data is processed in CoachRocks. We process that data as processor on documented instructions, unless we are required to process it by law.

Calendar-derived or imported contacts: Coaches must ensure they have a valid legal basis (e.g. consent or legitimate interest, as appropriate) before importing or syncing third-party personal data into CoachRocks.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal; withdrawal may limit certain features.

4. Automated processing and AI

CoachRocks uses automation and AI (including third-party AI models) to transcribe, analyse, and generate content from session materials. This processing may involve profiling-like outputs (e.g. themes, recommendations). It is not intended as a substitute for professional judgment. See our AI Transparency Notice for details.

5. Recipients and subprocessors

We use trusted service providers (processors) who process personal data on our behalf under agreements that require them to protect the data and process it only for the purposes we specify.

Categories of processors include:

• Hosting and infrastructure (e.g. application hosting, databases, object storage such as cloud storage/CDN providers).
• AI and speech services (e.g. transcription and language models).
• Meeting or bot integrations (e.g. third-party meeting transcription services).
• Email delivery (transactional email).
• Authentication and calendar (Google or Microsoft APIs where you connect them).
• Prospect research (public-web and LinkedIn lookups for Discovery Call Prep).
• Product analytics and advertising measurement (PostHog; the Google Ads conversion tag), loaded only with your consent and carrying no session content.
• Billing (PayPal, for coach subscriptions only).

A current list of subprocessor names and purposes is published on our Subprocessors page (or available on request at support@coachrocks.com); what each receives and commits to is set out on our Trust page.

6. International transfers

Some subprocessors may process data in countries outside the European Economic Area (EEA), including the United States. Where we transfer personal data from the EEA/UK/Switzerland to countries not subject to an adequacy decision, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK Addendum where applicable), supplemented by technical and organisational measures as required by law.

You may request more information about transfers by contacting support@coachrocks.com.

7. Retention

We retain personal data only as long as necessary for the purposes described in this policy, unless a longer period is required by law.

Indicative retention (subject to your subscription, legal holds, and product configuration):

• Account data: For the life of the account and a short period thereafter for backup, dispute resolution, or legal compliance, unless deleted earlier upon request where applicable.
• Client, meeting, transcript, and analysis data: Until deleted by the coach/user, or upon account termination according to our Terms of Service.
• Session audio: Bot recordings are deleted at the recorder service once the transcript is stored and analysed. Every audio or video file in our storage — uploaded by you, recorded in your browser or recorded with the desktop app — is permanently deleted automatically once its transcript is stored and its analysis has completed; a file whose analysis fails or does not run stays until a retry succeeds or you delete the session. Uploaded transcript files (.txt, .docx) are kept until you delete the session or the client. See the plain-language summary above.
• Security and logs: For a limited period consistent with security needs and legal obligations.

We may shorten or lengthen retention as we document in product settings or separate notices. You can delete client and session data yourself at any time, and you may request deletion or export of your data by contacting support@coachrocks.com.

8. Controllers, processors, and your responsibilities (coaches)

If you are a coach, you are typically the controller of your clients’ personal data in CoachRocks. CoachRocks acts as processor for that data. Our Data Processing Agreement is an integral part of the Terms of Service: it takes effect automatically for every user when the Terms are accepted, with no signature or separate request needed. If your organisation requires a countersigned copy, email support@coachrocks.com.

You must:

• Provide any required notices and obtain any required consents or other legal bases for your use of CoachRocks with respect to client data.
• Ensure imports (e.g. from calendar or third-party tools) comply with applicable law.
• Use AI outputs responsibly and in line with professional standards.

9. Your rights (EEA/UK and similar jurisdictions)

Subject to applicable law, you may have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase data (“right to be forgotten”) in certain cases.
• Restrict processing in certain cases.
• Data portability (where processing is based on contract or consent and technically feasible).
• Object to processing based on legitimate interests (including profiling in some cases).
• Withdraw consent where processing is consent-based.
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact support@coachrocks.com. We may need to verify your identity. If you are a client of a coach, we may need to route your request through the coach where we act only as processor and cannot identify you independently.

10. Security

We implement appropriate technical and organisational measures designed to protect personal data, including access controls, encryption in transit (HTTPS), secure authentication practices, and vendor due diligence. No method of transmission or storage is completely secure; we work to reduce risk in line with Article 32 GDPR.

11. Children

The Services are not directed at children under 16, and we do not knowingly collect personal data from children. Where your jurisdiction sets a higher age of digital consent, that age applies instead. If you believe we have collected such data, contact us and we will take steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date. Where required by law, we will notify you (e.g. by email or in-product notice). Continued use of the Services after changes may constitute acceptance where permitted by law.

13. Contact

CLE LTD.
Floor 11, No.172, Section 2, Minsheng East Road, Taipei 10485, Taiwan
Email: support@coachrocks.com