Privacy Policy⁠

We collect the following categories of personal information.

Account information

• Name, email address and password credentials used to create and secure your account.
• Account type and role, such as organisation administrator, employee, individual member, coach or platform administrator.
• Optional profile details, including job title, location, time zone, language preferences and profile photograph.

Organisation and employee information

• Company name, billing contact, team structure and the names and work email addresses of employees an organisation invites to the platform.
• Credit allocations, credit requests and approvals made within an organisation account.

Coach profile information

• Professional biography, specialisms, qualifications, accreditations, experience, languages, coaching tier, session and workshop formats and pricing.
• Availability, working hours, booking rules and preferred meeting platform.
• Payout details required to pay coaches for delivered sessions.

Booking and coaching information

• Discovery Call and coaching session bookings, including date, time, duration, format, status and cancellation or rescheduling history.
• Session notes, goals, reflections and feedback you choose to record on the platform.

Payment and credit information

• Credit purchases, subscription plans, invoices, transaction references and credit ledger history.
• Billing name, billing email and billing address.

Messages and communications

• Secure messages exchanged between members and coaches on the platform.
• Enquiries, demo requests, support requests and correspondence with our team.

Technical and usage information

• Device and browser type, IP address, approximate location derived from IP address and operating system.
• Pages viewed, features used, session timestamps, referring pages and diagnostic or error logs.

We use personal information for the following purposes.

• To create, secure and administer user, organisation, employee, individual and coach accounts.
• To match members with suitable coaches and to display coach profiles to eligible members.
• To schedule, confirm, reschedule and cancel Discovery Calls, coaching sessions and workshops.
• To process credit purchases, subscriptions, allocations and coach payouts.
• To enable secure messaging between members and coaches.
• To send transactional emails such as booking confirmations, reminders, invitations and account notifications.
• To provide aggregated, anonymised reporting to organisations about engagement and usage.
• To maintain platform security, prevent fraud and misuse and investigate incidents.
• To improve the platform, develop new features and provide customer support.
• To comply with legal, accounting and regulatory obligations.

Our lawful bases for processing are performance of a contract with you, our legitimate interests in operating and improving a secure platform, compliance with legal obligations, and your consent where consent is required, for example for non-essential cookies or optional marketing emails. You can withdraw consent at any time.

Coaching conversations are confidential. Content you share in a coaching session is not visible to your employer, and We Almighty does not share the substance of your coaching conversations, session notes or goals with your organisation.

Where an organisation funds coaching, the organisation receives only the information it needs to administer the programme, such as credit usage, booking volumes and aggregated engagement statistics. Individual reporting is presented in a way designed to protect the confidentiality of participants.

• Private session notes recorded by a coach are visible only to that coach.
• Goals, reflections and personal notes recorded by a member are visible only to that member and, where the member chooses to share them, to their coach.
• Coaches are contractually required to keep coaching content confidential, subject to their professional and legal obligations.

Coaches are not required by We Almighty to record their private coaching notes on the platform, unless a particular feature or engagement explicitly states otherwise. Where a coach maintains professional records independently, the coach is responsible for those records and for handling them in accordance with applicable data protection requirements and their professional obligations.

Private coaching notes are not made accessible to an employer or client organisation simply because that organisation funded the coaching, unless there is an appropriate lawful basis and this has been made clear to the relevant individual.

We Almighty does not currently use private coaching conversations, private session notes or private coach-uploaded materials to train general-purpose AI or machine learning models.

We may use technology, including AI-enabled functionality, to operate, secure, support and improve the service where appropriate.

Aggregated or appropriately anonymised information may be used to understand platform usage and improve the service, provided individuals cannot reasonably be identified.

If we materially change how private coaching content is used in relation to AI or machine learning, we will update this policy and inform users where required.

Coaches may choose to connect one or more Google Calendar or Microsoft Outlook accounts. Connecting a calendar is optional.

What we access and why

• Your list of calendars, so you can choose which calendars are checked for clashes and which calendar receives bookings.
• Free and busy times on the calendars you select, to show members accurate availability and prevent double bookings. We read only start and end times, not event titles, descriptions, locations or attendees.
• Adding bookings (optional and off by default). If you turn on "Allow adding bookings", you grant a separate, additional permission. We then create, update and remove only the coaching-session events booked through We Almighty, in the one calendar you choose. We never read, change or delete any other events in your calendar.

What we store and how it is protected

• The email address of the connected account, the calendars you selected, the permissions you granted and the connection status.
• Access and refresh tokens, encrypted at rest and used only to perform the features you have enabled.
• For each session added to your calendar, the event's identifier in your calendar and a record of whether it synced successfully, so we can update or remove it later.
• Busy times are fetched when needed and are not kept as a permanent copy of your calendar.

Sharing

• We do not sell calendar data or use it for advertising.
• We share it only with service providers that host and store data on our behalf, or where required by law.
• Details of a session booked through We Almighty are shared with the other participant in that session.
• External calendar entries appear on the platform only as unlabelled busy periods.

Disconnecting, revoking access and deletion

• You can disconnect any calendar account at any time from Scheduling → Calendar connections in your workspace.
• Disconnecting revokes our access with Google or Microsoft and immediately deletes the stored tokens, calendar selections and sync records for that account.
• Session events already added to your calendar remain there; you can delete them yourself.
• You can also revoke access at any time from your Google Account permissions page (myaccount.google.com/permissions) or your Microsoft account settings.
• If you ask us to delete your account, your calendar connections are deleted with it. Your rights under UK GDPR are described in the "Your Rights" section below.

Google user data and Limited Use

We Almighty's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar data we access is limited to your calendar list, the free and busy times of calendars you select, and only the coaching-session events We Almighty creates on your behalf where you have enabled this.
• We use this data solely to display accurate availability to members and to create, update or cancel coaching sessions you have booked. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties except as needed to provide this feature or where required by law.
• Google user data is not used to train generalised artificial intelligence or machine learning models.
• Only the calendar owner and, where a booking involves them, the other participant in that booking can see the resulting session details. No human at We Almighty reads your calendar data except with your explicit permission for support, for security purposes, or where required by law.
• Google access and refresh tokens are stored encrypted at rest. Disconnecting your calendar revokes our access with Google and immediately deletes the stored tokens and related records. Busy times are not stored permanently.

Payments are processed by Stripe, our third-party payment provider. Payment card information is entered directly into Stripe's secure environment and is processed securely by Stripe. We Almighty does not store your full payment card details.

• We receive limited transaction information from Stripe, such as the last four digits of a card, card brand, expiry, transaction status and reference.
• Coach payout details are collected to pay coaches for delivered sessions and are held securely with access restricted to authorised personnel and processes.
• Stripe processes payment information as an independent controller in accordance with its own privacy policy.

The platform provides secure in-app messaging so members and coaches can arrange and support their work together.

• Messages are stored securely and are accessible only to the participants in the conversation.
• Automated safeguards may redact certain sensitive content, such as direct contact details, to keep engagements on the platform and to protect users.
• We do not read messages routinely. Authorised staff may access message content only where strictly necessary, for example to investigate a safeguarding concern, a report of abuse, a technical fault or where we are legally required to do so.

We use cookies and similar technologies to operate the platform, keep you signed in and understand how the service is used.

• Essential cookies are required for authentication, session management and security. The platform cannot function without them.
• Preference cookies remember choices such as your workspace or display settings.
• Analytics cookies help us understand aggregate usage so we can improve the platform.

You can control cookies through your browser settings. Blocking essential cookies may prevent you from signing in or using core features. Further detail is available in our Cookie Policy.

We Almighty does not sell your personal information. We share information only in the circumstances described below.

• With coaches, where you book or enquire about a session, so they can deliver the engagement.
• With your organisation, where it funds your coaching, limited to administrative and aggregated engagement information rather than coaching content.
• With service providers who process information on our behalf under written contracts, including hosting and database providers, payment processing, email delivery, calendar and meeting platforms, error monitoring and analytics.
• With professional advisers, auditors or insurers where necessary and proportionate.
• With regulators, law enforcement or other authorities where we are legally required to do so, or to establish, exercise or defend legal claims.
• With a buyer or successor in the event of a merger, acquisition or reorganisation, subject to this policy continuing to apply.

We maintain technical and organisational measures appropriate to the sensitivity of the information we hold.

• Encryption of data in transit and at rest, and encryption of third-party access tokens.
• Row level security and role based access controls so users can access only the records they are entitled to see.
• Secure authentication, session management and audit logging of privileged actions.
• Least privilege access for staff, with access granted only where required to operate or support the service.
• Ongoing monitoring, security review and prompt investigation of suspected incidents.

No system can be guaranteed to be completely secure. Please use a strong, unique password and tell us promptly if you believe your account has been compromised.

We keep personal and coaching-related information only for as long as reasonably necessary for the purpose for which it was collected, including legitimate operational, security, legal, accounting or regulatory requirements. Different categories of data may have different retention periods.

• Account and profile information is retained while your account is active and for a reasonable period afterwards to handle queries and disputes.
• Booking, credit and transaction records are retained for the period required by accounting, tax and audit obligations.
• Messages and session notes are retained for the duration of the coaching relationship and a reasonable period afterwards.
• Technical logs are retained for a short period for security and diagnostic purposes.

Where information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable data protection requirements.

You can ask us to delete your account and we will do so subject to any legal retention obligations.

Where a coach's membership or account is terminated, their public profile is removed or unpublished, subject to a reasonable administrative processing period. Once the profile has been removed, we cease publicly displaying the coach's profile photograph, biography and other profile materials.

Any licence granted to We Almighty over coach-created content continues only to the extent reasonably necessary for existing obligations, backups, legal requirements, security, disputes or records relating to activity while the coach used the platform. Certain information may still need to be retained for legitimate legal, regulatory, accounting, security or record-keeping reasons.

Under UK data protection law you have the following rights.

• Access — obtain a copy of the personal information we hold about you.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure — ask us to delete your personal information where there is no continuing lawful reason to keep it.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Portability — receive certain information in a structured, commonly used and machine readable format.
• Withdraw consent — withdraw consent where our processing relies on it.

To exercise any of these rights, contact us using the details below. We will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to resolve your concern first.

We are based in the United Kingdom, and some of our service providers are located outside the UK, including in the European Economic Area and the United States.

Where personal information is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with additional measures where required.

We work with carefully selected providers to deliver the platform. Each processes information for a defined purpose under contract with us, or as an independent controller where noted.

• Stripe — payment processing for credit purchases and subscriptions.
• Google Calendar and Microsoft Outlook — optional calendar connections used to determine availability and manage bookings.
• Zoom, Microsoft Teams and Google Meet — optional meeting platforms used to host coaching sessions and Discovery Calls.
• Cloud hosting, database and authentication providers — secure storage and operation of the platform.
• Email delivery providers — transactional email such as confirmations, reminders and invitations.
• Analytics and error monitoring providers — aggregated usage insight and diagnosis of technical faults.

Where you connect a third-party meeting or calendar service, that provider's own privacy policy also applies to information processed within its service.

We may update this policy from time to time to reflect changes to the platform, new integrations or changes in law. When we do, we will revise the effective date at the top of this page.

Where changes are significant, we will provide additional notice, for example by email or an in-app notification. Please review this page periodically.

If you have questions about this policy, how we handle your personal information, or you wish to exercise your data protection rights, please get in touch.

• Email: privacy@wealmighty.co
• Online: send a message through our contact page at wealmighty.co/contact
• Postal enquiries can be arranged on request by email.