Joint Privacy Policy

1. Scope and controller

This privacy policy applies to the websites coach2ai.com, praisumer.com and mentor2ai.com and to the single underlying Coach2AI / Mentor2AI platform, including the coach-specific client portals. The platform is operated as a web-based application; there is no native mobile app. The user interface is available in German and English.

The controller for its own processing activities is: praisumer GmbH, Schulgasse 22, 2540 Bad Vöslau, Austria. Contact: info@praisumer.com.

Note for end users (the coaches' clients): If you use a coaching portal or platform instance operated by a coach or a company, that coach or company is the controller of your personal data. In that case, Praisumer processes this data as a processor on the instructions of the coach or company, on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Platform operation involves different responsibilities. Praisumer is, in principle, an independent controller for the website, B2B customer management, contract initiation and contract administration, invoicing and payment processing, its own support, security, abuse prevention and compliance with legal obligations. The respective coach or company is, in principle, the controller of the end users' personal data within their coaching offering. To that extent, Praisumer processes this data as a processor on behalf of the coach or company.

The specific allocation of roles may depend on the particular use, the contract and the specific design of the offering. The branding of a client portal or the use of a custom domain does not, in itself, change this allocation of roles.

2. The platform's role model

Praisumer may act on behalf of a coach within the application or access tenant data where this is necessary for a specific support, maintenance, troubleshooting or security purpose. Such login-as or administrative access takes place only when authorized, only for that purpose, only to the extent necessary, and is logged. It is not general access for arbitrary purposes.

3. What data is processed

Depending on how the offering is used and on the settings of the respective coach or company, the following data in particular may be processed:

• Account and authentication data, in particular e-mail address, password- or login-related data and verification status. Login is by e-mail address and password; social logins are not offered.
• Profile and organization data of Praisumer, coaches, companies and clients, and information assigning a person to a coach or tenant. The same person may be held as separate client records with different coaches; these records cannot see one another.
• Clients' coaching and profile data, in particular goals, check-ins, metrics, assessment answers and information entered in conversations or forms.
• Chat content and the resulting conversation logs, including the context assembled by the system and the generated replies.
• Files and documents that coaches upload to their knowledge base or that clients share in the chat, including text, audio, video and image files. Extracted text, transcriptions, image descriptions and embeddings may be derived from them.
• Health data, where a client actively provides such information as input, a screenshot or a file. This may include, for example, information on activity, training, nutrition, sleep, body measurements, vital signs, illnesses or other information about physical or mental health. There is no direct connection to Apple Health. Health data is processed only if the user actively provides it and has previously given explicit consent pursuant to Art. 9(2)(a) GDPR.
• Subscription, payment and billing data, in particular name, e-mail address, plan and amounts, and status information on subscriptions and payments. Card and bank details are entered in Stripe forms and do not pass through the application.
• Calendar and booking data, if a coach connects Google Calendar or Microsoft 365 / Outlook: the e-mail address of the connected calendar account, busy periods (free/busy only – the titles, descriptions, locations and attendees of existing events are not evaluated), the list of calendars, calendar settings such as time zone, default event length or working hours, and the events the platform creates for booked sessions, with their attendees and the generated Meet or Teams links. Details are set out in section 6.5.
• Usage, billing and AI logs, including the AI usage attributed to and metered per tenant.
• Data arising from contact requests, support and administrative measures, including logged support and administrative access.
• Hostnames for coach subdomains and custom domains, and data required for DNS, TLS and the issuing of certificates.

4. Purposes of processing and legal bases

Processing takes place only for specified purposes. These include, in particular, operating and providing the websites and the platform, setting up and managing accounts and tenants, technically supporting the coaching services for which the respective coach or company is responsible, handling chat messages and files, document search, bookings, optional payment and commission processing, sending transactional e-mails, support and administration, security and abuse prevention, and compliance with legal obligations. End-user data is not used for cross-tenant product improvement.

For Praisumer's own processing activities, the following legal bases apply in particular: contract initiation and performance under Art. 6(1)(b) GDPR, insofar as the data subject is a party to the contract; the management of B2B contracts, contact persons and access, and the handling of contact and demo requests, on the basis of Art. 6(1)(b) or (f) GDPR; accounting, bookkeeping and other legal obligations under Art. 6(1)(c) GDPR; and IT security, abuse prevention, technical support and the reliable provision of the websites and platform on the basis of Art. 6(1)(f) GDPR. The legitimate interests lie in secure and uninterrupted operation, the handling of business communication and protection against abuse. Where Praisumer obtains consent, the processing is based on Art. 6(1)(a) GDPR. For end-user data within a coaching offering, the respective coach or company determines the applicable legal basis and informs the clients of it.

Where consent is required, it must be obtained freely, on an informed basis, for a specific purpose and in a verifiable way. It can be withdrawn with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected. Health data requires explicit consent under Art. 9(2)(a) GDPR. Complete technical logging of the user ID, time and text version of the consent is not currently part of the platform. The respective controller must therefore keep equivalent proof of consent; without verifiable consent, health data must not be processed.

Support and administrative access ("login-as"): For troubleshooting, maintenance and resolving support requests, authorized Praisumer staff may access tenant data and accounts. Such access is strictly limited to its purpose and to the extent strictly necessary, and is logged in a traceable way (time, acting staff member, purpose). Unsolicited access to confidential end-user data for other purposes does not take place.

5. Technical architecture and data flow

The platform is a Next.js application that runs as a single server process on a netcup server in Germany. Cloudflare provides DNS and a TLS proxy. The administration interface, the coach dashboard, the client portals and the API functions – including chat, uploads, Stripe webhooks and scheduled tasks – are all provided by this application.

Supabase provides the PostgreSQL database, authentication and a small private file store. The Supabase instance is located in Frankfurt. The database may store accounts, profiles, client data, goals, check-ins, metrics, assessment answers, health histories, chat transcripts, subscription and payment status, AI usage data and the document search index. Records are assigned to the respective coach tenant; tenant separation is enforced in the database.

Cloudflare R2 is used for a private bucket for coach knowledge-base files and files shared by clients in the chat, and for public buckets for coach product images and coach intro videos. Private R2 files can only be reached through short-lived, signed links. Logos, favicons, profile photos and assessment uploads are stored privately in Supabase Storage and are likewise served through signed links.

All traffic reaches the application through Cloudflare. The application server is the only platform component that communicates with the integrated third-party providers. The exceptions, where a user's browser contacts a third party directly, are the Stripe payment form, a coach's affiliate links and the speech input provided by the browser.

6. Particular features and processing operations

6.1 Coaching chat, knowledge base and AI

When a client communicates with a coach's AI persona, the application assembles the context needed for the reply. This may include goals, check-ins, knowledge-base excerpts, files shared by the client and – where available and validly consented to – health information. OpenAI generates the reply. The chat history is stored in the database; check-ins and metrics may be captured from the conversation. Coaches and companies have no general access to their end users' individual chat histories. Where the respective product configuration provides analytics features, they receive only aggregated or summarized insights, topics or progress information within their own tenant. End-user data is not analyzed across coaches or tenants.

OpenAI is the only AI provider named in the architecture overview. OpenAI is used for chat replies, embeddings for document search, transcription of audio and video, image description and – if a coach activates hybrid mode – a hosted web search. All AI usage is logged and metered per tenant. Longer audio and video files are split into segments with ffmpeg on our own server before being sent for transcription.

Praisumer does not use inputs, chat content or uploaded documents to train its own general AI models or for cross-tenant product improvement. Under its business and API terms, OpenAI does not by default use data from the API to train or improve its models unless data sharing is expressly opted into. This is to be distinguished from Zero Data Retention: a ZDR configuration is not assumed to be enabled. Depending on the endpoint and configuration used, API content or abuse-monitoring data may by default be retained by OpenAI for up to 30 days; individual features may require different retention.

For customers in the EEA, the OpenAI data processing agreement is concluded with OpenAI Ireland Ltd. Where data is transferred to affiliated companies or sub-processors outside the EEA, OpenAI bases the transfer, under its data processing agreement, on an applicable adequacy decision or on standard contractual clauses. Praisumer uses the API only within the scope of the agreed processing on behalf.

Transparency notice: Within the platform, end users interact with an automated AI system. The generated replies are based on probability calculations and may be incorrect or incomplete (so-called hallucinations). The platform is no substitute for professional medical, therapeutic, legal or tax advice.

6.2 Documents, files, audio, video and images

Coach knowledge-base files and files shared by clients in the chat are stored in the private R2 bucket. Text is extracted on our own server. Audio and video may be transcribed by OpenAI, and images described by OpenAI. The extracted or generated text is split into sections, embedded by OpenAI and stored as the document search index in the database. A file uploaded by a client is only read into that same client's chat.

6.3 Health information provided actively

A client can actively enter health information in the chat or upload it as a screenshot or file. There is no direct technical connection to Apple Health or any comparable health service. Such content may be processed and stored in order to answer the user's request. Explicit consent is required before processing. The respective coach or company is responsible for the lawfulness and transparency of, and the proof of, that consent; without suitable proof, the health-data feature must not be used.

6.4 Subscriptions, payments and coach payouts

With Coach2AI, the contract for the service offered by the coach is, in principle, concluded between the coach and the end customer. In the standard model, Praisumer may handle the technical payment, subscription and commission processing via Stripe and Stripe Connect; alternatively, it may be agreed that the coach invoices directly. Stripe webhooks update the payment and subscription status. Card and bank details are entered in Stripe-hosted forms and are not received by the platform. With Mentor2AI, there is no end-customer payment processing through the platform; Praisumer invoices the agreed employee accounts directly to the respective corporate customer.

6.5 Calendar and bookings

The calendar integration is optional and on the coach's side. A coach can connect Google Calendar or Microsoft 365 / Outlook via OAuth. The application reads availability, creates an event with the client's e-mail address as attendee when a booking is made, and adds a Google Meet or Teams link. A booking confirmation is sent by transactional e-mail. OAuth refresh tokens are stored in encrypted form.

6.5.1 Google Calendar (Google API Services)

When a coach connects their Google Calendar, the platform requests only the following permissions through the Google Calendar API and uses them only for booking sessions:

Storage: We store only the e-mail address and ID of the connected Google account, the permissions granted, the OAuth access and refresh tokens – encrypted with AES-256-GCM – and, for each booked session, the IDs of the Google event and calendar it was created in and its Meet link. The time zone and default event length may be adopted as defaults in the coach's booking settings. Busy periods are fetched from Google fresh for each request and are not stored.

No sharing, no sale, no AI training: Data the platform receives from Google APIs is not sold, not used for advertising, and not shared with third parties, except with the hosting and infrastructure providers listed in section 7 to the extent technically necessary to operate the feature, or where required by law. It is not transferred to OpenAI or any other AI provider, and it is not used to develop, improve or train AI or machine-learning models. The AI chat receives no calendar data – only whether a booking is possible.

Human access: Praisumer staff do not read data received from Google APIs unless the coach has expressly agreed in a specific case (for example as part of a support request), it is necessary for security purposes (such as investigating abuse or a bug), or it is required by law.

Revocation and deletion: A coach can disconnect at any time in the settings under "Calendar integrations". Access is first revoked at Google; the stored tokens and account data are then deleted. Access can also be revoked at any time at https://myaccount.google.com/permissions. Session events already created remain in the coach's and the client's calendars until they are deleted there. Otherwise, section 9 applies.

Limited Use:

Coach2AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.5.2 Microsoft 365 and Outlook

When a coach connects a Microsoft account, the platform uses the following Microsoft Graph permissions: Calendars.ReadWrite (reading busy periods and creating the booked session events), MailboxSettings.Read (time zone and working hours; available for work and school accounts only), and offline_access, openid, profile and email (a lasting connection and showing which account is connected). Of existing events, only the start, end and status (free/busy) are evaluated. Section 6.5.1 applies accordingly to storage, sharing, human access and deletion. Microsoft provides no interface through which an application can revoke its own access; after disconnecting in the settings, the coach can additionally remove the permission at https://myapps.microsoft.com.

6.6 White-label portals and domains

Every coach can have their own branded client portal on a subdomain or their own custom domain. Logos, favicons and colors are stored in Supabase Storage and served on the respective domain. For coach subdomains and custom domains, TLS certificates are issued per hostname through Let's Encrypt.

7. External services used

The following overview describes the services named in the technical documentation, their role, the data they receive and the processing location stated there.

8. Third-country links and data transfers

The technical processing locations are not limited exclusively to the European Union or the European Economic Area. The application server and database are located in Germany. Cloudflare uses a global edge network. OpenAI processes EEA data on the basis of its data processing agreement via OpenAI Ireland Ltd.; access from or onward transfers to the USA may take place. Stripe and Stripe Connect, as well as the optional calendar integrations with Google or Microsoft, may also involve EU/US links. Let's Encrypt is based in the USA. With speech input, the browser may send the microphone audio directly to the respective browser vendor – typically Google for Chrome and Apple for Safari – rather than to the Praisumer server.

With affiliate links, the client's browser leaves the platform and opens the respective merchant's website. According to the architecture overview, the application transfers no data to the merchant; the respective merchant is responsible for any further processing on its site.

9. Retention, deletion and termination

General server and security logs are automatically deleted or anonymized after no more than 14 days. This period is not to be equated with the retention of login-as audit logs; such audit logs are kept only as long as necessary for security, evidentiary, abuse-prevention and support purposes. Application data is deleted no later than 30 days after the end of the contract, unless statutory retention obligations prevent this. Where paid archiving has been separately agreed, the data required for later reactivation is kept for the duration of the archiving arrangement and deleted no later than 30 days after it ends. Invoicing and accounting data is, in principle, kept for 7 years in accordance with tax law requirements, in particular § 132 BAO (Austrian Federal Fiscal Code). There is currently no self-service function for export or deletion; requests are handled manually.

Deletions within the platform cannot automatically determine the independent retention obligations or storage of external services. Requests for deletion, export or restriction of processing are to be addressed to the respective controller; Praisumer supports the coach or company with end-user data within the scope of the processing on behalf.

10. Rights of data subjects

In accordance with the GDPR and applicable Austrian data protection law, data subjects have in particular the following rights:

• The right of access to the personal data processed and to information about the processing.
• The right to rectification of inaccurate data or completion of incomplete data.
• The right to erasure, where the legal requirements are met.
• The right to restriction of processing.
• The right to data portability, where the requirements are met and the processing is carried out by automated means on a suitable legal basis.
• The right to object, on grounds relating to their particular situation, to processing based on legitimate interests; in the case of direct marketing, a right to object exists insofar as direct marketing is used at all.
• The right to withdraw consent with effect for the future, insofar as the processing is based on consent.
• The right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, where the legal requirements are met.

Requests concerning a coaching offering are, in principle, to be addressed to the respective coach or company, because that party is the controller of the end-user data. Matters concerning Praisumer's own processing can be addressed to info@praisumer.com. If responsibility is unclear, the request can also be sent to this address; it will then be forwarded to the responsible party or handled within the existing roles.

Data subjects also have the right to lodge a complaint with the Austrian Data Protection Authority. This right exists without prejudice to any other administrative or judicial remedy.

Competent supervisory authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0 | E-mail: dsb@dsb.gv.at | Website: dsb.gv.at

11. Security of processing

The architecture provides for TLS / HTTPS protection via Cloudflare and Let's Encrypt. Private files in Cloudflare R2 and Supabase Storage are not served openly but through short-lived or signed links. OAuth refresh tokens for calendar integrations are stored in encrypted form. The assignment of data to coach tenants is enforced in the database. AI calls are logged and metered per tenant; administrative access is logged.

12. Cookies, tracking, advertising and communication

No analytics or tracking SDKs, advertising or marketing pixels or separate error-tracking services are used. Push notifications, SMS and marketing or newsletter mailings are not provided. E-mails are sent exclusively as transactional e-mails, for example for invitations, e-mail verification, password resets, billing notices and booking confirmations. Demo and other contact requests are made via the published e-mail address; no separate form service is used for this. Only technically necessary cookies required to operate the platform are used.

13. Age limit

The platform is intended for persons aged 18 and over. A client confirms on joining that they are 18 or older. Use by persons under 18 is not intended. If it becomes known that data of a minor has been processed contrary to this requirement, the respective controller should be contacted.

14. No services beyond those described

Social logins, native mobile apps, push notifications, SMS, analytics or tracking SDKs, advertising or marketing pixels and an error-tracking service are not part of the platform as currently described. If features are added in the future, this privacy policy must be updated before they are used.

15. Changes to this privacy policy

We may update this privacy policy when the platform, the services used, legal requirements or responsibilities change. The version published on the website at the time is authoritative. In the event of material changes, data subjects will be informed in accordance with the legal requirements.