Privacy Policy

This Privacy Policy explains how Cairn (“the Platform,” “we,” “us”) collects, uses, discloses, and protects personal data. The Platform is a software service that lets executive coaches run their clients through reflective and assessment tools under the coach’s own name.

Who is responsible for your data. When a coach uses the Platform with their clients, the coach is generally the controller of their clients’ personal data and the Platform acts as a processor on the coach’s behalf. For a coach’s own account and billing information, the Platform acts as a controller. If you are a client, or someone who gave feedback through the Platform, and have a question about your data, please contact your coach first; we will support their response.

1. Data we collect

• Coach account data: name, email address, and authentication credentials (password hashes are managed by our auth provider — we never store plaintext passwords).
• Client data: the name and email address of each client a coach invites, and the client’s status.
• Client personal profile: optional contact and personal details a client chooses to share in the Intro Coaching exercise (such as work and home contact information, birthday, and family names). We encrypt these at the application layer before storing them; only the client’s coach can view them.
• Reflective & assessment responses: the answers, reflections, and selections clients enter into the tools (for example, the Values Clarification and Intro Coaching exercises).
• Reviewer feedback: for assessment tools such as CEO Assessment Plus and Leadership Style Analysis, the names and email addresses of the people a coach invites to give feedback (“reviewers”), and the feedback they submit about the client.
• Payment metadata: subscription status and billing identifiers. Full card numbers are handled directly by our payment processor and are never stored on our servers.
• Technical & usage data: essential session information and aggregate, cookieless usage analytics (see “Cookies” below).

2. How and why we use data

We use personal data to:

• provide the tools and deliver results to coaches and clients;
• authenticate coaches and grant clients and reviewers secure, tokened access to their exercises;
• generate an AI-assisted reading of certain reflective responses (the Values tool) to support the coaching conversation;
• send transactional email (invitations, results, receipts);
• process subscription billing;
• maintain security, prevent abuse, and keep tenant data isolated between coaches; and
• comply with legal obligations.

3. Legal bases (GDPR)

Where the EU/UK General Data Protection Regulation applies, we (or the coach as controller) rely on the following legal bases:

• Contract: to provide the service a coach or client has requested (account setup, running a tool, delivering results).
• Legitimate interests: to secure the Platform, prevent fraud and abuse, and improve reliability, balanced against your rights.
• Legal obligation: to keep records required for tax, accounting, and compliance.
• Consent: where a coach, client, or reviewer voluntarily provides reflective or feedback responses. Consent can be withdrawn at any time.

4. Sub-processors we share data with

We do not sell personal data. We share it only with vendors that process data on our behalf under contract, and only as needed to run the service:

We do not use your reflective or assessment content to train third-party AI models. Content sent to our AI sub-processor is used only to generate the reading you requested.

5. International data transfers

Our sub-processors are located in the United States. If you access the Platform from the EEA, the UK, or another region, your personal data will be transferred to and processed in the United States. Where required, such transfers are made under appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with the data protection commitments in our agreements with each sub-processor.

6. Data retention

We keep personal data only as long as needed for the purposes above:

• Account data is kept while a coach’s account is active and for a limited period after closure.
• Client and assessment data is retained while the coaching relationship is active and until a coach or client requests deletion.
• Payment records are retained as required by tax and accounting law (typically several years).

For specifics, see our Data Retention Policy. When data is deleted from our live systems, residual copies may persist in encrypted backups for a limited period before they expire (see “Your rights” below).

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Under the EU/UK GDPR these include the rights of access, rectification, erasure (“right to be forgotten”), data portability, and objection. Under the California Consumer Privacy Act as amended by the CPRA, California residents have the rights to know, delete, correct, and to opt out of the “sale” or “sharing” of personal information — we do not sell or share personal information in that sense, and we will not discriminate against you for exercising your rights.

To exercise a right, write to us through our contact page. If you are a client, or someone who gave feedback through the Platform, you can also ask your coach, who controls your data; we will help them fulfil your request. We respond to verified requests within the timeframes required by law (for example, within one month under the GDPR, extendable where permitted). Note that deletion removes data from our live systems promptly, but residual copies in encrypted backups expire on a rolling schedule and are not restored except for disaster recovery.

8. Cookies

We use essential first-party cookies only — the session cookie that keeps a signed-in coach authenticated. We do not use third-party advertising or tracking cookies. Our usage analytics are cookieless and do not build a profile of you. Because we only use strictly necessary cookies, no consent banner is required; we show a brief informational notice instead.

9. Security

Data is encrypted in transit, access is scoped per coach through database row-level security so one coach cannot see another’s data, and secret keys are held server-side only. No system is perfectly secure, but we work to protect your data with reasonable technical and organizational measures.

10. Children

The Platform is intended for use by adults in a professional coaching context and is not directed to children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, where changes are material, provide a more prominent notice.

12. Contact

Questions about this policy or your data? Write to us through our contact page.