Your privacy — how this works

Ingrained is the data controller for all personal data processed through this product. Contact: privacy@ingrained.coach

We process your data under the following lawful bases (UK GDPR Art. 6): contract performance (subscription and coaching sessions), legitimate interests (security, fraud prevention, service improvement), legal obligation (payment record retention), and consent (screen recording, push notifications, marketing email — all optional, all withdrawable). Where a coaching conversation happens to contain health or other special category data, our condition is your explicit consent under Art. 9(2)(a). The full detail is in the Privacy Policy.

No. Self-funded accounts have no employer link of any kind. Your organisation has no dashboard, no reporting, no visibility into your use of this product. There is no HR module, no team admin panel.

This is different from employer-purchased coaching platforms (BetterUp, CoachHub, Ezra) which are sold to HR and give employers reporting. This product is bought by you, for you, and visible only to you.

No. This product runs on the Anthropic enterprise API. Under Anthropic's enterprise terms, conversations through the API are not used to train AI models. Your session transcripts are private API calls — not training data.

Session transcripts are encrypted with AES-256 at rest, in an EU database (Supabase, Frankfurt). Generating a coaching reply involves processing by our AI and hosting providers in the US (Anthropic, Railway) under Standard Contractual Clauses; nothing is used to train AI models. Only your account can access your transcripts.

Retention periods: Coaching session data is retained for the duration of your subscription plus 30 days after cancellation. Assessment data is retained for as long as your account exists. Payment records are retained for 7 years (legal accounting obligation). You can delete everything else at any time.

We use the following data processors — all bound by data processing agreements:

• Supabase — Database and authentication (EU (Frankfurt)). Privacy policy
• Anthropic — AI coaching responses — enterprise API, never used to train models (US, under Standard Contractual Clauses). Privacy policy
• Stripe — Payment processing — card data never reaches our servers (US/EU, under Standard Contractual Clauses). Privacy policy
• Resend — Transactional email — profile links, receipts, data exports, and the daily prompt if you turn it on (US, under Standard Contractual Clauses). Privacy policy
• PostHog — Product usage analytics — cookieless, no advertising features. You can opt out at any time. Screen recording is off unless you accept it, and never runs on your profile, coaching or account pages (EU (Frankfurt)). Privacy policy
• Railway — Backend hosting (US, under Standard Contractual Clauses). Privacy policy
• Cloudflare — Frontend delivery — no personal data stored (Global edge). Privacy policy

The ICF Code of Ethics (revised 2025 to include AI coaching systems) establishes confidentiality obligations for technology-assisted coaching. This product is built to those standards. Coaching conversations are treated as confidential material and not shared with any third party.

We always set one strictly necessary cookie — a Supabase authentication session token that keeps you signed in. Under UK PECR that one needs no consent, but we tell you about it.

With your permission we also use PostHog (hosted in the EU, Frankfurt) to understand which parts of the product work and which don't. It runs cookieless — no analytics cookie and no persistent identifier — and it is only loaded if you accept on the first-visit notice. Decline and no analytics code is fetched at all.

We use no advertising cookies and no ad personalisation. Screen recording is off unless you switch it on. If you do, it covers the public and assessment pages only — to see where the product confuses people — with all typing masked, and it is switched off on your profile, your coaching sessions and your account pages, which are never recorded either way. You can withdraw that consent whenever you like. We never send your assessment results, profile or session content to analytics.

You have seven rights under UK and EU GDPR: access, portability, erasure, rectification, restriction of processing, objection, and the right not to be subject to solely automated decisions. All rights except complaint are exercised directly from within the app — no support email required.

If you believe we have not handled your data lawfully, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection supervisory authority (0303 123 1113).