Your privacy

1. Who is responsible for your data?

The existing service notice names Estève Pannetier (Finland) for website administration and coaching, and Jonas Pannetier (France) for research and separate clinical psychology services.

Contact [email protected] about your data or the organisation responsible for your particular service. Separate clinical services require their own agreement and privacy information.

2. What information is collected?

• Contact: your name, email, communication preferences and dated consent records.
• Services: enquiries, coaching selections, retreat waitlist motivation and preferences, newsletter subscriptions, Signals quiz answers, Check-my-FLOW results, Satellite Scan answers and results, and Prompting Playground requests and generated content.
• Payments: transaction and service records. Stripe handles card details; the website does not store your card number.
• Accounts and connections: sign-in profile information, account identifiers, session identifiers and access tokens for services you connect.
• Technical information: requests needed to deliver and protect the site. Optional Google Analytics receives limited public-page and link-click information only after acceptance. Google also receives technical information and cookie identifiers; this is not anonymous collection.

The data needed depends on the feature you use. Do not include confidential client material or information about someone else without permission.

3. Why may we use your data?

A legal basis is the reason the law allows personal data to be used. The existing notice describes these bases:

• Consent: newsletter and waitlist updates, the Signals quiz, optional connected accounts and optional analytics. You can withdraw consent without changing the lawfulness of earlier use.
• Contract: information needed to arrange and deliver a purchased assessment, coaching, retreat, training or consulting service, including related confirmations.
• Legitimate interests: essential website operations and technical troubleshooting, balanced against your rights.
• Legal obligations: required tax and accounting records.

Ask us which basis applies to a particular use. Giving a technical permission to connect an account does not itself settle every legal basis for using its data.

4. How is your information used?

• Respond to enquiries, arrange sessions and deliver the service you select.
• Sign you in and manage your account.
• Prepare communication reflections, Scan dashboards and practice materials.
• Send results, purchase confirmations and support messages.
• Send newsletters or retreat updates when you request them.
• Process payments and keep required accounting records.
• Maintain the website, investigate technical problems and protect access.
• Export to your connected Notion workspace when you initiate an export; use the team workspace for relevant service records where that integration is enabled.

5. Who may receive it?

Providers support different parts of the service. Their involvement depends on the feature and enabled connection:

• Estève and Anu: Scan results emails copy both coaches and include your submitted answers. Email copies are separate from your website account.
• Stripe: payments. Stripe privacy information.
• Replit: website hosting. The actual publishing and database locations depend on the project settings; an EU location is not assumed.
• Resend: purchase, assessment-results and dashboard emails.
• Typeform: the Scan questionnaire and submitted answers sent to the website service.
• Cloudflare: website delivery and protection, including technical request information.
• Calendly: booking details when you schedule a session. Calendly privacy information.
• Google: sign-in if chosen; optional Google Analytics 4 after acceptance. How Google uses partner-site information.
• LinkedIn: sign-in if chosen.
• Notion: team contact/service records and optional exports to a workspace you connect.
• Thesys: AI-assisted visualisations and content when enabled. The submitted prompt and supplied data are sent to Thesys. Thesys privacy information.
• Fathom: optional meeting recording and AI notes only after explicit agreement before recording starts. You can decline recording and still attend the discovery call.

The existing notice states that we do not sell or rent your personal data or share it for third-party marketing. Ask us for the recipients and provider arrangements for your service.

6. Sign-in and connected workspaces

OAuth is a way to let a service connect without giving us your password for that service.

• Google sign-in: name, email, profile picture and account identifier. The sign-in scopes are openid, email and profile; they do not grant access to your contacts, calendar or Drive.
• LinkedIn sign-in: name, email and profile identifier through openid, profile and email scopes. This sign-in does not grant access to connections, posts or company pages, or permission to post.
• Notion: workspace name and identifiers plus a connection token. Permissions depend on the pages and capabilities granted to the integration. A connection is not a guarantee that no reading is possible.

Where available, manage connections in Portal Settings (English). The Notion disconnect action clears its token and workspace identifiers from the active account record. It does not erase data already exported to Notion or prove deletion from backups or provider systems. Contact us to check the scope of a disconnection or deletion.

7. Processing outside Europe

Providers may process data outside the European Economic Area, including in the United States. Provider contracts, service settings and the destination determine which safeguards apply.

Contact [email protected] for the locations and transfer safeguards that apply to your information, and how to obtain a copy of those safeguards. Provider documentation alone does not confirm our account settings or agreements.

8. How long is information kept?

The existing notice lists the following periods. The team needs to confirm the service-specific schedule and how deletion is carried out:

• Contact and marketing records: 24 months after the last interaction, unless consent is withdrawn sooner.
• Retreat waitlists: until the retreat cycle ends, plus 12 months.
• Assessment answers and results: ask us for the applicable period. This application does not provide automatic anonymisation.
• Connection tokens: while connected, subject to disconnection or account-deletion requests.
• Portal account records: until deletion is requested, subject to records that must be retained.
• Contracts and payments: the earlier notice states 6–10 years. The period depends on the record and applicable national accounting law; this is not a single EU-wide retention rule.
• Analytics: the browser preference and configured GA cookie expiry are 180 days. Google account-side retention is a separate setting.

Website records, coach inboxes, exports, recordings, provider records and backups may need separate handling. Contact us for the period and deletion process for each.

9. Your data protection rights

Under the GDPR, subject to its conditions and exceptions, you can:

• Ask for access and a copy of your personal data.
• Correct inaccurate or incomplete information.
• Request erasure or restrict its use.
• Receive eligible data in a machine-readable format (portability).
• Object to use based on legitimate interests; object to direct marketing at any time.
• Withdraw consent at any time, including analytics or newsletter consent.
• Challenge a decision based solely on automated processing that has legal or similarly significant effects, where this protection applies.
• Complain to a data protection authority or seek a court remedy.

Send requests to [email protected]. We must respond without undue delay, normally within one month. Complex or numerous requests may take up to two extra months; we must explain the extension within the first month. We may need proportionate information to confirm your identity.

10. Ask for deletion

Email [email protected] with the subject “Data deletion request” and tell us which service or records you mean. Account or connection controls, where available, can help you manage access; disconnecting a provider is not the same as deleting every copy.

We will explain the action taken, any records that must remain for a legal reason and any applicable limits. The response period described above is not a promise that all website, provider, email and backup copies disappear within 30 days.

11. Protecting your information

The website uses account access controls and sessions. Its password-hashing code uses scrypt with a separate salt. Production sessions are configured to use secure, HTTP-only cookies; public production connections use HTTPS.

These measures reduce risk but do not guarantee complete security. Ask us about access, monitoring, provider agreements and safeguards for your service. Do not send passwords or sensitive material in a support email.

12. AI and human judgement

AI can support content and dashboard preparation. A coach-prepared dashboard can include AI-assisted material. People remain responsible for the service and for deciding how to use their reflections.

The ACX teaching map is not a clinical diagnosis, certification or legal compliance assessment. Read the AI policy for the tools, limits and questions to ask.

Estève’s related communication and AI research is described at Arbora research. That link does not authorise transfer of your data to Arbora.

13. Children

Services are intended for adults aged 18 or over. The existing notice states that we do not knowingly collect information from children under 16. If a child has submitted information, contact us promptly so we can investigate and address it.

14. Changes to this notice

We may update this notice when practices or legal requirements change. Significant changes will be announced by email or a website notice. If consent is needed for a new use, we must ask separately; browsing the site does not give that consent.

15. Questions and complaints

Contact [email protected] about a concern. You may also complain to the authority where you live, work or believe a breach occurred. You do not have to contact us first.

• Finland: Office of the Data Protection Ombudsman.
• France: CNIL.