1Who we are
In this policy, “Craft”, “we” and “us” mean the people who make and run Craft.
For anything about privacy, email privacy@coachwithcraft.com.
2Your data and your clients’
Craft holds two kinds of personal information, and the law gives us a different job for each.
- About you, the coach. Your name, email address, practice details and how you use Craft. We decide how this is used, so we’re its controller.
- About your clients. Everything you put into Craft about the people you coach. You decide what goes in and why, so you’re its controller. We’re your processor: we act only on your instructions, under the processor terms in our Terms.
If you’re a coaching client whose coach uses Craft, section 12 is for you.
3What we collect about you, and why
We collect only what Craft needs to work. The law asks us to say which lawful basis we rely on for each.
| What | Why | Lawful basis |
|---|---|---|
| Your name and email address | To set up your account and sign you in. You sign in with Google or with a link we email you. | Contract |
| Your practice | Its name, time zone, country and the sign-off on shared copies, so Craft works the way your practice does. | Contract |
| Your signature, if you draw one | We keep the strokes you drew, not a picture, and add it only to copies you share. | Contract |
| Your calendar, if you connect it | The Google or Microsoft account you connect, the calendar you choose and the events in it that look like sessions, so Craft can show and sync them. Access tokens are stored encrypted. | Contract |
| Security and support records | Error codes, and a log of sensitive actions such as opening or deleting a transcript: who, what and when, never what it said. We use them to keep Craft secure and to fix problems. | Legitimate interests |
Our server logs record which part of Craft was used and whether it worked. They don’t record what you wrote.
We don’t send marketing emails. The only email Craft sends you is a warning a week before a client’s transcripts are deleted. Sign-in emails come from Clerk, our sign-in provider.
4Your clients’ information
This is what you choose to put into Craft about the people you coach:
- their details: name, email, phone number, organisation, role and time zone;
- engagements and sessions: dates, times and meeting links;
- your notes from each session, session notes and your note templates;
- transcripts you add;
- goals, observations and actions;
- the copies you share with them.
We use it only to provide Craft to you. We don’t use it for anything of our own, and we never sell it.
Coaching conversations can touch on sensitive things, such as someone’s health. The law calls this special category data. As the controller, you need a legal condition for recording it. We protect everything you put in to the same standard, whatever it is.
Craft doesn’t contact your clients
You share a note by copying its text or downloading a PDF, then send it yourself. If you book a session in a connected calendar and choose to invite your client, the invitation comes from your own calendar, sent by Google or Microsoft.
5Write-ups and AI
When you ask Craft to write up a session, it sends OpenAI:
- your notes from that session;
- the transcript, if you added one;
- your note template;
- your client’s name, your name, the session’s date and what kind of session it was, such as “Session 3 of 6”.
Nothing else from your client’s record goes with it.
- Not used for training. OpenAI doesn’t train its models on data sent through its API, and we haven’t opted in to let it.
- Not stored by choice. We ask OpenAI not to store what it writes. OpenAI may keep requests for up to 30 days to check for abuse, then deletes them.
- Where. For now, OpenAI may process requests in the US. We plan to move to OpenAI’s EU data residency, and we’ll update this policy when we do.
- No names in the label. OpenAI sees which practice a request came from only as a scrambled code, never your name or email.
A write-up is a draft. You read each section and keep, change or remove it. Nothing is shared with anyone until you choose to share it. Draft text you don’t keep is deleted a day later.
6Google Calendar
Connecting your Google Calendar is optional. If you do, Craft asks Google for two things:
- to see the list of your calendars, so you can choose the one Craft uses;
- to see, add, change and delete events in calendars you own, so the sessions you book in Craft appear there, and changes you make there come back to Craft.
Craft reads the calendar you choose to find your coaching sessions: each one’s title, times, meeting link and the people invited. It keeps the events that are sessions, or that it asks you about, and ignores the rest. It stores Google’s access tokens encrypted.
- Used only for you. Your calendar is used only to show and sync your sessions in Craft.
- Not shared. We don’t pass your calendar to anyone else. When you ask for a write-up, the session’s date and your client’s name go to OpenAI, as section 5 says.
- Not for AI training. Nothing from your Google account is used to train AI models, ours or anyone else’s.
- Never sold, never for advertising. And no person at Craft reads it, unless you ask us to for support, it’s needed for security, or the law requires it.
- Yours to take back. Disconnect in Settings at any time. Craft revokes its access at Google and deletes its tokens. The sessions already in Craft stay with your records. You can also remove Craft’s access at myaccount.google.com/permissions.
Craft’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7Who handles it
Where Craft runs
During the pilot, Craft’s server and database run on dedicated hardware we operate in the UK. PDFs of shared notes are made on that same server, so no outside service sees them.
Before Craft opens to everyone, we plan to move to Render, a hosting company, in its Frankfurt region. We’ll update this policy and tell you before we move.
Service providers
We use a small number of other companies to run Craft. Each may use your information only to provide its service to us, under a data processing agreement.
| Provider | What for | What it sees | Where |
|---|---|---|---|
| Cloudflare | The secure connection to Craft and protection from attacks. Storage for transcripts, PDFs and backups. | Traffic passes through it. What it stores is encrypted. During the pilot it also checks invited coaches’ email addresses. | Storage in the EU. Network worldwide. |
| Clerk | Signing in | Your name, email address and sign-in details. No client information. | US |
| OpenAI | Drafting session notes | What’s listed in section 5, for each write-up you ask for. | US for now; EU planned |
| Resend | Sending Craft’s emails to you | Your email address. The warning before transcripts are deleted names the client. | US; sends from Ireland |
| Google or MicrosoftOnly if you connect a calendar | Syncing your sessions with your calendar | The sessions Craft adds to your calendar, including a client you choose to invite. | Their own locations |
We also use an outside service to check that Craft is up. It only visits a status address and sees no personal data.
Before we add or change a provider that handles your clients’ information, we’ll tell you, so you can object.
We’d share information with anyone else only if the law made us, for example under a court order. Where we’re allowed to, we’ll tell you first.
8Outside the UK
Transcripts, PDFs and backups are stored in Cloudflare’s EU region. Some providers are based in the US or handle data there: Clerk, OpenAI, Resend and Cloudflare’s network.
When information leaves the UK, it’s protected by the provider’s data processing agreement, using the safeguards UK law approves, such as standard contractual clauses with the UK Addendum. We’re putting these agreements in place with each provider before Craft is used with real client information.
9How long we keep things
| What | How long |
|---|---|
| Transcripts | Until 30 days after the client’s engagement ends. We tell you a week before. An engagement with no session for 12 months counts as ended. You can delete a transcript yourself at any time, and from that moment it can’t be read. |
| Quotes from a transcript | The short lines behind a drafted note (up to 300 characters each) stay with the note after the transcript has gone. They’re never in a shared copy. |
| Notes, sessions, goals, observations, actions and shared copies | Until you delete them, erase the client or close your account. |
| Draft text you didn’t keep | A day. |
| Unsaved changes | On your device, until Craft has saved them, for up to 30 days. |
| Your account | Until you close it. |
| The log of sensitive actions | While your account exists. It holds who, what and when, never content or names. |
| Emails from Craft | Resend keeps each one for 30 days. |
| Backups | Deleted data stays in encrypted backups for up to 35 days, and in monthly backups for up to 400 days, and is then deleted. |
Nobody reads a backup except to restore Craft after a failure. If we ever restore one, we erase again anything that had been erased since it was made.
10Keeping it safe
- Encrypted in transit. Everything between you and Craft travels over HTTPS.
- Transcripts and PDFs have their own locks. Each is encrypted with a key of its own, on top of the storage’s encryption. Deleting a transcript destroys its key, so from then on nothing can read it, including any copy.
- Only you open your transcripts. Every time one is opened, it’s logged. We have no support tool that can open them.
- Practices are kept apart. Every request is checked against your practice. Nobody else can reach your records.
- Encrypted backups. They’re locked with a key that isn’t kept on the server.
- No open doors. The server can only be reached from the internet through Cloudflare’s secure tunnel.
- Less to lose. When you upload a transcript file, Craft keeps the text it reads from it, never the file itself. Calendar access tokens are stored encrypted.
- The desktop app keeps your sign-in encrypted with your computer’s own protection.
If something goes wrong that puts your information at risk, we’ll tell you without delay, and the ICO where the law requires it.
11Your rights
You can ask us to:
- give you a copy of your information;
- correct it (you can change most of it yourself in Settings);
- delete it;
- limit how we use it, or object to how we use it;
- give it to you in a form you can take elsewhere.
Email privacy@coachwithcraft.com. We’ll reply within one month. During the pilot, we export your data by hand when you ask.
If you’re unhappy with how we’ve handled your information, tell us first and we’ll try to put it right. You can also complain to the ICO at ico.org.uk or on 0303 123 1113.
12If you’re a coaching client
Your coach decides what’s recorded about you in Craft, so please ask them first. They can give you a copy, correct it or delete it.
They can also erase you from Craft entirely. That deletes your details, sessions, notes, transcripts and progress in one go, and takes booked sessions still to come out of your coach’s calendar.
What erasing can’t reach
- Copies your coach has already shared with you, or downloaded.
- Encrypted backups, until they expire: up to 35 days, or 400 days for monthly ones.
- An email to your coach that named you, which Resend keeps for 30 days.
- Text sent to OpenAI for a write-up, which OpenAI may keep for up to 30 days.
- Past events in your coach’s own calendar, and any future one your coach has changed there. Your coach can delete them if you ask.
- Unsaved changes on your coach’s other devices, which go the next time Craft is opened there.
If you contact us instead, we’ll pass your request to your coach in writing the same day. We can’t act on it ourselves: the records are your coach’s, and we can’t check who’s asking.
14Changes to this policy
We’ll update this policy when Craft changes. The date at the top says when we last did.
Some things on our homepage, such as the notetaker that joins your calls, aren’t switched on yet. Before any new feature sends information somewhere new, we’ll add it here and tell you.
We’ll email you before an important change takes effect.
15Contact us
Craft
Email privacy@coachwithcraft.com