Version 1 · Effective 2026-08-15

This document is a draft and has not yet been reviewed by legal counsel. It is not yet in effect.

Privacy Policy

Effective date: August 15, 2026 · Version: 1

Ladoos Consultancy BV ("Coachstra," "we," "us"), registered in Belgium (company number 0732908541, registered office at Poddegemstraat 112B, 1850 Grimbergen, Belgium), processes personal data in two distinct roles. Reading this section first will make the rest of this policy make sense.

1. Our two roles: controller and processor

We are a data controller for your coach account data — your name, email, billing details, login activity, and product-usage analytics. We decide why and how this data is processed.

We are a data processor for your clients' data — client profiles, intake forms, session notes, recordings, transcripts, AI-generated summaries, ICF hours, contracts, and messages. You (the coach) are the controller of this data. We process it only on your instructions, as described in our Data Processing Agreement, which is incorporated into your agreement with us automatically when you use the Service.

This means: if your client wants to access, correct, or delete their data, that request should go to you, not to us — we will forward any request that reaches us directly to you and tell the requester who their controller is.

2. What we collect and why

| Data | Role | Purpose | Legal basis (where we are controller) | | ----------------------------------------- | ---------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------- | | Coach account, billing, login | Controller | Provide and bill for the Service | Contract necessity | | Product usage/telemetry | Controller | Reliability, security, product improvement | Legitimate interest | | Marketing email preferences | Controller | Send you product updates you've opted into | Consent | | Client profiles, intake, notes | Processor | Delivered on your instructions as controller | You determine the basis | | Session recordings, transcripts, AI notes | Processor | Delivered on your instructions, consent-gated per session | You determine the basis; we never process without your consent gate being satisfied |

We do not use your clients' data, recordings, or transcripts to train models, for benchmarking, or for any purpose beyond what you've instructed — doing so would make us a controller of that data, which our Data Processing Agreement commits us not to become.

3. Sub-processors and international transfers

We use a limited set of sub-processors to run the Service — see the current list at /subprocessors, which names each vendor, its purpose, its location, and its transfer mechanism. Several sub-processors are located in the United States; where that is the case, we rely on EU Standard Contractual Clauses (not solely on Data Privacy Framework certification) as the transfer safeguard. We will give notice of any material change to this list per the commitment stated there.

4. Retention

We retain coach account data for as long as your account is active plus a reasonable period afterward for legal, tax, and dispute-resolution purposes. Client data (as processor) is retained per your own instructions and settings, and deleted or returned to you at the end of your subscription per our Data Processing Agreement, Section 7.

5. Your rights

If you are a coach (our direct customer): you may access, correct, export, or request deletion of your account data by contacting us at info@coachstra.com. You are also the controller responsible for handling these requests from your own clients.

If you are a coach's client: Coachstra is not your controller. Please contact your coach directly to exercise your data protection rights. If you contact us directly, we will forward your request to your coach and will not act on it ourselves, consistent with our role as processor.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), or your own country's supervisory authority if you are located elsewhere in the EU.

6. Cookies

Coachstra sets only strictly necessary cookies: session and authentication cookies, short-lived OAuth security (CSRF) cookies used only during a third-party connection flow you initiate, and one preference cookie that remembers your chosen interface theme, set only after you explicitly choose it. We do not set analytics, advertising, or tracking cookies. Because none of our cookies require consent under applicable law, we do not show a cookie banner; if that changes, this policy and our practice will change with it.

7. Security

We rely on our infrastructure providers' security measures (encryption in transit and at rest, access controls) and apply role-based access controls of our own — see our Data Processing Agreement's Technical and Organisational Measures annex for detail.

8. Children

The Service is intended for use by professional adults (coaches) and is not directed at children. We do not knowingly collect data from children through our own controller-role processing of coach account data.

9. Changes to this policy

We will notify you of material changes and, where required, ask you to re-accept before continuing to use the Service.

10. Contact

info@coachstra.com.

This document is a draft pending review by a Belgian privacy lawyer. It is not yet in effect and must not be relied upon as binding until that review is complete — see Issue #35.