Privacy Policy

This is a working draft. Before going live, have it reviewed by counsel familiar with your jurisdiction (GDPR, CCPA, etc.). It describes practices we believe to be accurate as of the date above, but it does not constitute legal advice.

What we collect

We collect the minimum information needed to deliver coaching services and operate the platform.

• Account information — name, email, hashed password.
• Business records — information about your family business (name, industry, address, ownership structure, employees, family members, non-family team) that you or your coach enter.
• Engagement data — coaching session details, notes, goals, assessments, messages between coach and client.
• Usage data — IP address, device type, pages visited, and security audit logs (sign-ins, role changes, sensitive actions). Used to detect and prevent abuse.
• Photos — only when you upload a profile photo for a person.

How we use it

• To deliver the coaching engagement you signed up for.
• To send transactional email — assessment invitations, session reminders, and security notifications.
• To generate AI-assisted diagnostic briefs (assessment data is sent to Anthropic per their Privacy Policy).
• To investigate security incidents and meet legal obligations.

We do not sell, rent, or share your data with advertisers. We do not use your data to train AI models.

Who we share it with

The platform is built on a small, deliberate set of vendors:

• Supabase — database, authentication, file storage. Privacy.
• Vercel — application hosting. Privacy.
• Anthropic — AI processing for diagnostic briefs. Privacy.
• Resend — transactional email delivery. Privacy.

We share data with these vendors only to the extent needed to operate the platform. We do not give them permission to use your data for their own purposes.

Where data is stored

Database, files, and email logs are stored in regions provided by the vendors above (typically the United States). If you have a residency requirement, contact us at privacy@familybusinessperformance.group.

How long we keep it

• Account and engagement data: while your account is active, plus up to 90 days after deletion.
• Audit logs: up to 2 years (security and compliance).
• Email logs: per Resend's retention policy.
• Backups: rolling 30 days.

Your rights

You can:

• See your data — every record about you and your business is visible inside the app.
• Export your data — request a copy at privacy@familybusinessperformance.group. We'll deliver within 30 days.
• Delete your account — request deletion at the same address. Some records may be retained for legal or audit purposes.
• Correct your data — most fields are editable directly inside the app. For anything you can't change, email us.

Cookies

We use a small number of strictly-necessary cookies for authentication (Supabase sets these). We do not use advertising or analytics cookies.

Children

The platform is intended for adult business owners and their advisors. We do not knowingly collect data from children under 13.

Changes

If we update this policy materially, we'll notify active accounts by email and post the change on this page with a new “last updated” date.

Contact

Privacy questions: privacy@familybusinessperformance.group
Security issues: security@familybusinessperformance.group