Privacy Policy

We collect the following categories of personal information.

Account information

• Name, email address and password credentials used to create and secure your account.
• Account type and role, such as organisation administrator, employee, individual member, coach or platform administrator.
• Optional profile details, including job title, location, time zone, language preferences and profile photograph.

Organisation and employee information

• Company name, billing contact, team structure and the names and work email addresses of employees an organisation invites to the platform.
• Credit allocations, credit requests and approvals made within an organisation account.

Coach profile information

• Professional biography, specialisms, qualifications, accreditations, experience, languages, coaching tier, session and workshop formats and pricing.
• Availability, working hours, booking rules and preferred meeting platform.
• Payout details required to pay coaches for delivered sessions.

Booking and coaching information

• Discovery Call and coaching session bookings, including date, time, duration, format, status and cancellation or rescheduling history.
• Session notes, goals, reflections and feedback you choose to record on the platform.

Payment and credit information

• Credit purchases, subscription plans, invoices, transaction references and credit ledger history.
• Billing name, billing email and billing address.

Messages and communications

• Secure messages exchanged between members and coaches on the platform.
• Enquiries, demo requests, support requests and correspondence with our team.

Technical and usage information

• Device and browser type, IP address, approximate location derived from IP address and operating system.
• Pages viewed, features used, session timestamps, referring pages and diagnostic or error logs.

We use personal information for the following purposes.

• To create, secure and administer user, organisation, employee, individual and coach accounts.
• To match members with suitable coaches and to display coach profiles to eligible members.
• To schedule, confirm, reschedule and cancel Discovery Calls, coaching sessions and workshops.
• To process credit purchases, subscriptions, allocations and coach payouts.
• To enable secure messaging between members and coaches.
• To send transactional emails such as booking confirmations, reminders, invitations and account notifications.
• To provide aggregated, anonymised reporting to organisations about engagement and usage.
• To maintain platform security, prevent fraud and misuse and investigate incidents.
• To improve the platform, develop new features and provide customer support.
• To comply with legal, accounting and regulatory obligations.

Our lawful bases for processing are performance of a contract with you, our legitimate interests in operating and improving a secure platform, compliance with legal obligations, and your consent where consent is required, for example for non-essential cookies or optional marketing emails. You can withdraw consent at any time.

Coaching conversations are confidential. Content you share in a coaching session is not visible to your employer, and We Almighty does not share the substance of your coaching conversations, session notes or goals with your organisation.

Where an organisation funds coaching, the organisation receives only the information it needs to administer the programme, such as credit usage, booking volumes and aggregated engagement statistics. Individual reporting is presented in a way designed to protect the confidentiality of participants.

• Private session notes recorded by a coach are visible only to that coach.
• Goals, reflections and personal notes recorded by a member are visible only to that member and, where the member chooses to share them, to their coach.
• Coaches are contractually required to keep coaching content confidential, subject to their professional and legal obligations.

You may choose to connect an external calendar, such as Google Calendar or Microsoft Outlook, to help keep your availability accurate and to prevent double bookings.

Connected calendars are used only to determine availability and to manage bookings. We request the minimum access required to read busy and free time and, where you enable it, to create and update We Almighty booking events.

• Private calendar information such as event titles, descriptions, locations, notes and attendees is never displayed publicly, never shown to other users and is not used for any purpose other than availability and booking management.
• External calendar entries appear on the platform only as unlabelled busy periods.
• Access tokens are stored in encrypted form and are used solely to perform the availability and booking functions you have enabled.
• You can disconnect a calendar at any time from the Scheduling area of your workspace. Disconnecting revokes our access and removes the stored tokens.

Google user data and Limited Use

We Almighty's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar data we access is limited to your calendar list, your free and busy times, and the coaching events We Almighty creates on your behalf.
• We use this data solely to display accurate availability to members and to create, update or cancel coaching sessions you have booked. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties except as needed to provide this feature or where required by law.
• Google user data is not used to train generalised artificial intelligence or machine learning models.
• Only the calendar owner and, where a booking involves them, the other participant in that booking can see the resulting session details. No human at We Almighty reads your calendar data except with your explicit permission for support, for security purposes, or where required by law.
• Google access and refresh tokens are stored encrypted at rest. Disconnecting your calendar in the Scheduling area revokes our access with Google and deletes the stored tokens and cached busy periods immediately. You can also revoke access at any time from your Google Account permissions page.

Payments are processed by Stripe, our third-party payment provider. Payment card information is entered directly into Stripe's secure environment and is processed securely by Stripe. We Almighty does not store your full payment card details.

• We receive limited transaction information from Stripe, such as the last four digits of a card, card brand, expiry, transaction status and reference.
• Coach payout details are collected to pay coaches for delivered sessions and are held securely with access restricted to authorised personnel and processes.
• Stripe processes payment information as an independent controller in accordance with its own privacy policy.

The platform provides secure in-app messaging so members and coaches can arrange and support their work together.

• Messages are stored securely and are accessible only to the participants in the conversation.
• Automated safeguards may redact certain sensitive content, such as direct contact details, to keep engagements on the platform and to protect users.
• We do not read messages routinely. Authorised staff may access message content only where strictly necessary, for example to investigate a safeguarding concern, a report of abuse, a technical fault or where we are legally required to do so.

We use cookies and similar technologies to operate the platform, keep you signed in and understand how the service is used.

• Essential cookies are required for authentication, session management and security. The platform cannot function without them.
• Preference cookies remember choices such as your workspace or display settings.
• Analytics cookies help us understand aggregate usage so we can improve the platform.

You can control cookies through your browser settings. Blocking essential cookies may prevent you from signing in or using core features. Further detail is available in our Cookie Policy.

We Almighty does not sell your personal information. We share information only in the circumstances described below.

• With coaches, where you book or enquire about a session, so they can deliver the engagement.
• With your organisation, where it funds your coaching, limited to administrative and aggregated engagement information rather than coaching content.
• With service providers who process information on our behalf under written contracts, including hosting and database providers, payment processing, email delivery, calendar and meeting platforms, error monitoring and analytics.
• With professional advisers, auditors or insurers where necessary and proportionate.
• With regulators, law enforcement or other authorities where we are legally required to do so, or to establish, exercise or defend legal claims.
• With a buyer or successor in the event of a merger, acquisition or reorganisation, subject to this policy continuing to apply.

We maintain technical and organisational measures appropriate to the sensitivity of the information we hold.

• Encryption of data in transit and at rest, and encryption of third-party access tokens.
• Row level security and role based access controls so users can access only the records they are entitled to see.
• Secure authentication, session management and audit logging of privileged actions.
• Least privilege access for staff, with access granted only where required to operate or support the service.
• Ongoing monitoring, security review and prompt investigation of suspected incidents.

No system can be guaranteed to be completely secure. Please use a strong, unique password and tell us promptly if you believe your account has been compromised.

We keep personal information only for as long as necessary for the purposes described in this policy, and then delete it or anonymise it.

• Account and profile information is retained while your account is active and for a reasonable period afterwards to handle queries and disputes.
• Booking, credit and transaction records are retained for the period required by accounting, tax and audit obligations.
• Messages and session notes are retained for the duration of the coaching relationship and a reasonable period afterwards.
• Technical logs are retained for a short period for security and diagnostic purposes.

You can ask us to delete your account and we will do so subject to any legal retention obligations.

Under UK data protection law you have the following rights.

• Access — obtain a copy of the personal information we hold about you.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure — ask us to delete your personal information where there is no continuing lawful reason to keep it.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Portability — receive certain information in a structured, commonly used and machine readable format.
• Withdraw consent — withdraw consent where our processing relies on it.

To exercise any of these rights, contact us using the details below. We will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to resolve your concern first.

We are based in the United Kingdom, and some of our service providers are located outside the UK, including in the European Economic Area and the United States.

Where personal information is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with additional measures where required.

We work with carefully selected providers to deliver the platform. Each processes information for a defined purpose under contract with us, or as an independent controller where noted.

• Stripe — payment processing for credit purchases and subscriptions.
• Google Calendar and Microsoft Outlook — optional calendar connections used to determine availability and manage bookings.
• Zoom, Microsoft Teams and Google Meet — optional meeting platforms used to host coaching sessions and Discovery Calls.
• Cloud hosting, database and authentication providers — secure storage and operation of the platform.
• Email delivery providers — transactional email such as confirmations, reminders and invitations.
• Analytics and error monitoring providers — aggregated usage insight and diagnosis of technical faults.

Where you connect a third-party meeting or calendar service, that provider's own privacy policy also applies to information processed within its service.

We may update this policy from time to time to reflect changes to the platform, new integrations or changes in law. When we do, we will revise the effective date at the top of this page.

Where changes are significant, we will provide additional notice, for example by email or an in-app notification. Please review this page periodically.

If you have questions about this policy, how we handle your personal information, or you wish to exercise your data protection rights, please get in touch.

• Email: privacy@wealmighty.co
• Online: send a message through our contact page at wealmighty.co/contact
• Postal enquiries can be arranged on request by email.