1. Controller and scope
Emergent Mindlab, LLC is the controller of personal data processed through mindlabcoaches.com. Contact privacy@mindlabcoaches.com for any privacy request. Coaches act as independent controllers of the personal data they collect from their own Clients in the course of delivering their services.
2. Data we collect
We collect the following categories of personal data:
- Account data — name, email address, password hash, role, authentication provider identifiers, and profile photo.
- Coach profile data — biography, genres, credentials, languages, location, rates, offerings, media, and branding.
- Booking and scheduling data — requested and confirmed session times, time zone, availability windows, calendar connection tokens, and meeting links.
- Communications — messages exchanged on the Platform, information requests, review text and reports, and email delivery events (sent, delivered, bounced, complained, unsubscribed).
- Transaction data — subscription tier, plan status, payment status, payout status, earnings ledger entries, refunds, and the last four digits and brand of a card as reported by our processor. We never store full card numbers.
- Technical data — IP address, device and browser type, operating system, referring pages, pages viewed, timestamps, and cookie or local-storage identifiers.
- Support data — anything you send us when you contact us.
3. Sensitive information
Do not submit health, medical, genetic, biometric, precise-location, government-identifier, or other special-category data through free-text fields, messages or profile content. If you do, you consent to our processing of it for the purpose of operating the Platform, and you acknowledge that the Platform is not designed as a medical records system and is not HIPAA-compliant.
4. Why we process data and our legal bases
- To provide the Platform, create accounts, match Clients and Coaches, run bookings and messaging — performance of a contract.
- To process subscriptions, payments and payouts and to prevent fraud — contract and legitimate interests.
- To send transactional email (booking requests, confirmations, reminders, cancellations, receipts, security notices) — contract; these are operational and are not marketing.
- To send optional product or marketing email — consent, withdrawable at any time.
- To secure the Platform, investigate abuse, moderate content, and enforce our Terms — legitimate interests and legal obligation.
- To analyse and improve the Platform in aggregate — legitimate interests, and consent where cookies require it.
- To comply with tax, accounting, anti-money-laundering and other legal obligations — legal obligation.
5. Who we share data with
We do not sell your personal data and we do not share it for cross-context behavioural advertising.
We share data with: the Coach or Client you transact with (to the extent needed to deliver the session); payment and payout processors; cloud hosting and database providers; email delivery providers; calendar and video providers you connect; analytics providers; and professional advisers. We may disclose data where required by law, to respond to lawful requests, to enforce our agreements, or in connection with a merger, financing or sale of assets, subject to equivalent protections.
6. International transfers
Data may be processed in the United States and other countries whose laws differ from yours. Where required, we rely on Standard Contractual Clauses or another lawful transfer mechanism with our processors.
7. Retention
We keep account and profile data while your account is active and for up to 24 months after closure to handle disputes and enforce agreements. Transaction and tax records are kept for at least 7 years where required by law. Message and booking history is kept for the life of the account and then deleted or anonymised. Email delivery logs are kept for 90 days. Backups age out on a rolling schedule.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal data; to data portability; to withdraw consent; to opt out of sale or sharing (we do neither); and to appeal a refusal. EEA/UK users may lodge a complaint with a supervisory authority. Exercise any right at privacy@mindlabcoaches.com; we respond within the period required by applicable law and will not discriminate against you for exercising a right. We may need to verify your identity first.
9. Security
We use encryption in transit, row-level access control on our database, scoped access tokens, hashed credentials, least-privilege administrative access, and logging. No system is perfectly secure; you are responsible for keeping your credentials safe. We will notify affected users and regulators of a qualifying breach as required by law.
10. Children
The Platform is for adults 18 and older. We do not knowingly collect data from children. If we learn we have, we will delete it.
11. Changes
We will post any updated Privacy Policy with a new version identifier and will request acknowledgement once when changes are material. After you acknowledge a version, you will not be prompted about it again.