Privacy Policy

1.1 Data Protection Officer

We have not appointed a designated Data Protection Officer because our processing activities do not require one under Article 37 GDPR. All privacy questions are handled by the privacy contact above.

1.2 UK data subjects

For UK-based data subjects, the equivalent rights and obligations apply under the UK GDPR and the UK Data Protection Act 2018. References to the GDPR in this policy should be read as including the UK GDPR where the data subject is located in the United Kingdom. The UK supervisory authority is the Information Commissioner's Office (ico.org.uk); see also Section 11.2.

4.1 Data about coaches

When you sign up as a coach, we collect and process:

• Account data: email address, full name, profile image, locale preference, account status flags. Faronto uses passwordless authentication; we do not store passwords.
• Business profile: business name, biography, specialties, time zone, booking-page slug, accent colour, availability schedule, invoice footer, default currency.
• Authentication data: session tokens, magic-link tokens, OAuth identifiers (where you sign in with Google or Microsoft).
• Billing identifiers: Paddle customer ID, plan tier, subscription status. Card numbers are processed by Paddle directly and never reach our servers.
• Connected-account identifiers: Stripe Connect account ID (for invoicing your clients), Google or Microsoft calendar OAuth tokens (encrypted at rest), Zoom OAuth tokens.
• AI preferences: coaching methodology, session-summary style, how many hours before a session a prep briefing is generated, and whether session summaries are automatically prompted.
• Usage and technical data: IP address, browser/device information, log data, page views, performance metrics, product analytics events, session replay metadata and masked interaction data. See Section 7.
• Referral and marketing data: referral code, referral attribution, marketing source domain, locale, UTM parameters, referring page, handoff identifier, nurture-email unsubscribe status, and (where you opt in to product updates) a marketing-consent record: the timestamp, the form or setting through which you gave consent, and the version of the consent text shown to you.
• Support correspondence: emails and other communications you send to us.

4.2 Data about coachees (clients of coaches)

When a coach uses Faronto to manage their work with clients, the coach uploads or generates personal data about those clients. We process this data on the coach's instructions as a processor, under the Data Processing Agreement.

The data we may store on the coach's behalf includes:

• Identity and contact: name, email address, phone number (optional), business title (optional).
• Coaching content: coach notes about the client, private coach-only notes, session transcripts, AI-generated session summaries and prep briefings, client pre-session input, action items, goals, progress notes, files and articles shared in the client library.
• Session data: scheduled sessions, meeting links, video meeting IDs, calendar event IDs, time zones, outcome ratings, feedback comments.
• Communications: coaching nudges and reminders sent on behalf of the coach.
• Client portal access: when a coach enables portal access for a client, the client signs in through the same login screen as coaches; we store session and authentication data and last-visit timestamps.
• Billing: for coaches who use Stripe Connect to invoice their clients, we store invoice totals, status, due dates and Stripe invoice IDs. The actual invoice is created on the coach's connected Stripe account.

4.3 Data about website visitors

When you visit our marketing website without signing up, we collect limited technical data: your IP address, user-agent, request paths and timing data, aggregated performance metrics via Vercel Analytics and Vercel Speed Insights, and product analytics data through PostHog EU when analytics is enabled. If you move from a marketing site to app.faronto.com, we may pass a limited attribution envelope so signup, login and referral flows can be measured correctly. See Section 7 for cookie and similar-technology details.

6.1 What is sent to OpenAI

We send only the minimum context required to produce the requested output:

• Prep briefing: client first name and bio, the coach's notes about the client, active goals and recent goal-progress notes, open action items, summaries of the most recent past sessions, and the coach's custom instructions (if any).
• Session summary: the session transcript text the coach has added to the session, the client's active goals, and the coach's coaching-methodology preference.
• Nudge draft: client first name, active goals and recent progress, open action items, summaries of recent sessions, the coach's chosen tone and custom instructions (if any).

6.2 What is not sent to OpenAI

Important clarification: the free-text fields the coach edits (the client's bio and goals, individual action-item descriptions, session prep notes, session summary notes, and uploaded session transcripts) are sent to OpenAI as written when the corresponding feature is used. We do not parse or scrub those fields before sending. If a coach types a phone number, an email address, or a billing amount inside one of those free-text fields, that information will be included in the request to OpenAI even though we would not have sent the equivalent structured field. Coaches should treat AI features as if everything they type into a client record could be read by OpenAI.

• Email addresses, phone numbers, billing data and invoices as structured fields.
• Audio or video recordings; we do not record sessions.
• Files, images or attachments stored in the client library.

6.3 No automated decision-making

AI output is shown to the coach as suggestions to review. Faronto does not make decisions that produce legal or similarly significant effects on coachees solely through automated processing. Article 22 GDPR is therefore not triggered.

7.1 How to control cookies

When you first visit our marketing site or sign in to the application, you are shown a cookie banner that lets you accept or refuse non-essential cookies and trackers (including PostHog product analytics, session replay, and Vercel Speed Insights). Strictly necessary cookies (authentication, session, locale, referral attribution) load without consent because the service cannot work without them. You can change your choices at any time using the "Manage Preferences" link in the footer of our websites and the application. You can also clear cookies in your browser at any time; disabling strictly necessary cookies will prevent you from logging in. If your browser sends a Global Privacy Control or Do-Not-Track signal, we treat it as a refusal of non-essential cookies and trackers.

8.1 Changes to sub-processors

We may add or replace sub-processors over time. The list above is the authoritative current list. Coaches will be notified of material changes by email at least 30 days in advance, with a right to object on reasonable grounds, as set out in the Data Processing Agreement.

8.2 Other recipients

We may also share personal data with our professional advisors (lawyers, accountants), and with public authorities where required by law. We do not sell personal data and we do not share it for advertising purposes.

9.1 Non-EEA Controllers

For Controllers established outside the EEA, additional or alternative transfer mechanisms apply: the UK Addendum to the EU SCCs for UK Controllers; the FDPIC-amended SCCs for Swiss Controllers; service-provider obligations under applicable US state privacy laws (CCPA / CPRA, VCDPA, CPA, CTDPA, UCPA and successor or equivalent laws) for US Controllers; and other jurisdiction-specific mechanisms agreed in good faith, as set out in §§11.3–11.6 of the Data Processing Agreement.

11.1 How to exercise your rights

If you are a coach, you can exercise most of these rights from inside your account, or by contacting privacy@faronto.com. We respond within one month and may extend by two further months for complex requests, with notice.

If you are a coachee, the coach is the controller for your data. Please address your request to your coach directly. If you are unable to reach your coach, contact us and we will help relay the request.

11.2 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The Dutch authority is the Autoriteit Persoonsgegevens (AP), autoriteitpersoonsgegevens.nl. You may also contact the supervisory authority of the EU member state where you live or work. For UK-based data subjects, the competent authority is the Information Commissioner's Office (ico.org.uk).

12.1 Breach notification: who notifies whom

The 72-hour figure above refers to the controller's onward notification obligation to the supervisory authority under Article 33 GDPR. Where Faronto acts as a processor on a coach's behalf (for example, in relation to coachee data), we notify the controlling coach of a personal data breach within the period set out in Section 9 of the Data Processing Agreement so the coach can in turn discharge their own Article 33 obligation in time.