Privacy Notice

Version: 2026-07-22-draft. This draft must be completed by the workspace owner and reviewed by counsel before production publication.

1. Who controls the data

The coaching practice operating this deployment determines why and how client data is used. AppWizzy and configured infrastructure or AI providers may process data only to provide the workspace under their applicable agreements.

2. Data used by the workspace

The workspace may hold account and contact details, intake answers, goals, session dates, manual notes, transcripts or audio when separately authorized, AI-assisted drafts, commitments, reflections, resources, and limited security/audit metadata. It does not require payment-card or demographic data unless the workspace owner separately adds those features.

3. Purposes and sharing

Data is used to operate the coaching relationship, authenticate users, protect the service, produce coach-requested drafts, and deliver coach-approved material to the correct client. Coaching content is not sold, published, used for advertising, or used for model training by this application. The production owner must list every actual hosting, email, storage, monitoring, and AI subprocessor, including region and transfer mechanism.

4. Recording and AI processing

Recording consent and AI-processing consent are stored separately. Recording, upload, transcription, and AI generation are blocked when the required authorization is absent or withdrawn. A coach may continue with permitted manual notes. Contact the workspace owner to withdraw consent or request deletion.

5. Visibility

Private coach notes, raw transcripts, audio, emotional-theme analysis, and internal AI annotations are private by default. A client portal shows only material the coach explicitly approves for that client.

6. Retention and deletion

The production owner must publish configured retention periods for raw audio, transcripts, generated memory, private notes, shared notes, audit metadata, and backups. Authorized users may request access, correction, export, restriction, or deletion where applicable. Deleted active files must become inaccessible immediately; backup expiry follows the documented infrastructure schedule.

7. Security and incidents

Access controls and deployment isolation are used to limit data access. No absolute security guarantee is made. The production owner must publish an incident and privacy contact before accepting real client data.

8. Contact

The workspace owner must replace this paragraph with its legal entity, privacy email, postal address, launch jurisdictions, and effective date before production publication.