Privacy Policy

Last Updated: February 6, 2026

1. Introduction

GrowthArc ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and services (collectively, the "Platform").

Please read this Privacy Policy carefully. By using the Platform, you consent to the practices described in this policy.

Summary: We collect data to provide our coaching platform services. We don't sell your personal data. You have control over your data and can request its deletion.

2. Information We Collect

2.1 Information You Provide

Category Examples Purpose
Account Information Name, email, password, phone number Create and manage your account
Profile Information Bio, profile photo, qualifications (coaches) Display your profile to others
Coaching Data Goals, habits, journal entries, session notes Provide coaching features
Payment Information Billing address (card details stored by Stripe) Process payments
Communications Messages, emails, support requests Facilitate communication

2.2 Information Collected Automatically

Category Examples Purpose
Device Information Device type, operating system, browser type Optimize user experience
Usage Data Pages viewed, features used, time spent Improve our services
Log Data IP address, access times, error logs Security and troubleshooting
Cookies Session cookies, preference cookies Essential functionality

2.3 Sensitive Information

We may collect sensitive information through coaching interactions, such as:

  • Personal goals and challenges
  • Emotional states and journal entries
  • Health and wellness information (if shared voluntarily)

This information is handled with extra care and is only accessible to you and your chosen coach.

3. How We Use Your Information

We use your information to:

  • Provide Services: Operate the Platform and deliver coaching features
  • Personalize Experience: Customize features and AI recommendations
  • Process Payments: Handle subscriptions and session payments
  • Communicate: Send notifications, reminders, and updates
  • Improve Services: Analyze usage to enhance the Platform
  • Security: Detect and prevent fraud or abuse
  • Legal Compliance: Meet legal obligations

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process data under the following legal bases:

  • Contract: Processing necessary to provide our services
  • Consent: Where you've given explicit consent (e.g., marketing emails)
  • Legitimate Interests: For security, fraud prevention, and service improvement
  • Legal Obligation: Where required by law

5. Information Sharing

5.1 We Share With

  • Your Coach/Clients: Information necessary for the coaching relationship (controlled by your privacy settings)
  • Service Providers: Third parties who help operate our Platform (e.g., Stripe for payments, Supabase for data storage)
  • Legal Requirements: When required by law or to protect rights

5.2 We Do NOT

  • Sell your personal data to third parties
  • Share your coaching data with advertisers
  • Give your coach access to data you've marked private

6. Third-Party Services

Our Platform uses the following third-party services:

Service Purpose Privacy Policy
Supabase Database and authentication supabase.com/privacy
Stripe Payment processing stripe.com/privacy
Google Calendar Calendar integration (optional) policies.google.com/privacy
OpenAI AI features openai.com/privacy
Firebase Push notifications (mobile) firebase.google.com/support/privacy

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

  • Account Data: Until account deletion + 30 days for recovery
  • Coaching Data: Until account deletion (coaches retain their own copies)
  • Payment Records: 7 years for tax/legal compliance
  • Usage Analytics: Anonymized after 24 months
  • Support Communications: 3 years

8. Your Privacy Rights

8.1 All Users

  • Access: Request a copy of your data
  • Correction: Update inaccurate information
  • Deletion: Request deletion of your data
  • Export: Download your data in a portable format
  • Opt-out: Unsubscribe from marketing communications

8.2 Additional Rights (EEA/UK/California)

  • Restriction: Limit how we process your data
  • Objection: Object to processing based on legitimate interests
  • Portability: Receive data in a structured format
  • Withdraw Consent: Withdraw consent at any time

8.3 California Privacy Rights (CCPA)

California residents have additional rights under the CCPA:

  • Right to know what personal information is collected
  • Right to know if personal information is sold or disclosed
  • Right to say no to the sale of personal information (we don't sell data)
  • Right to equal service and price

8.4 Exercising Your Rights

To exercise your rights:

  • Use the Privacy settings in your account
  • Request data export from Settings > Data & Export
  • Email us at privacy@growtharc.com

We will respond to requests within 30 days (or as required by applicable law).

9. Data Security

We implement appropriate security measures including:

  • Encryption of data in transit (TLS 1.3) and at rest (AES-256)
  • Secure authentication with password hashing
  • Regular security audits and penetration testing
  • Access controls and employee training
  • Incident response procedures

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) for EU data transfers
  • Using processors who comply with equivalent data protection standards

11. Children's Privacy

Our Platform is not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

12. Cookies and Tracking

We use cookies and similar technologies. For details, please see our Cookie Policy.

13. Coach-Specific Privacy

13.1 Coach as Data Controller

For client data, coaches act as data controllers and GrowthArc acts as a data processor. Coaches are responsible for:

  • Obtaining appropriate consent from clients
  • Handling client data in compliance with applicable laws
  • Responding to client privacy requests

13.2 Data Processing Agreement

Coaches who need a Data Processing Agreement (DPA) for GDPR compliance can request one by emailing legal@growtharc.com.

14. AI and Automated Processing

Our Platform uses AI to provide features like:

  • Personalized check-in prompts
  • Goal and habit suggestions
  • Engagement reminders

AI features:

  • Are supervised by human coaches
  • Do not make automated decisions with legal effects
  • Can be disabled in your settings
  • Do not use your data to train external AI models

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

  • Email notification
  • In-app notification
  • Updating the "Last Updated" date

Continued use of the Platform after changes constitutes acceptance of the updated policy.

16. Contact Us

For privacy-related questions or concerns:

17. Supervisory Authority

If you are in the EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.