Privacy Policy

This Privacy Policy applies to Coach House websites, applications, communications, and services operated by Coach House Solutions Group ("Coach House," "we," "us," or "our"). It does not govern third-party sites or services that have their own privacy policies.

For account, product, billing, security, and direct-support information, Coach House determines why and how information is handled. An organization may separately control information its administrators and members place in an organization workspace. In that situation, contact the organization first about its decisions; we assist it as required by law and our agreement.

We collect information you provide, information generated when you use the service, information from organizations and integrations you connect with, and public or licensed source information used for nonprofit and resource discovery.

• Identifiers and account information, including name, email address, authentication records, account role, organization membership, profile image, and consent records.
• Organization and workspace information, including profiles, programs, team records, notes, roadmaps, tasks, policies, documents, media, public-page settings, invitations, and collaboration activity.
• Financial and transaction information, including budgets, revenue or expense activity, source and freshness records, donation or payer references, financial evidence, tax or fiscal documents, subscription status, invoice details, and payment-processor identifiers. Coach House does not receive or store full payment-card numbers entered into Stripe.
• Communications, including support requests, survey or feedback responses, email preferences, and messages you send through the service.
• Device, network, and usage information, including IP address, browser and device characteristics, pages and features used, referring pages, timestamps, errors, performance measurements, authentication events, and security logs.
• Location information when you choose a location feature, plus organization addresses, service areas, map searches, and map viewport requests.
• Information from integrations and third-party sources, such as payment status from Stripe, authentication events from Supabase, public resource directories, provider websites, public records, and information supplied by an organization administrator.

Depending on the features you use, content may include precise device location, financial or tax records, account credentials, communications, and government or taxpayer identifiers in designated fiscal documents. We use sensitive information only to provide the requested feature, secure the service, comply with law, and other purposes permitted with your consent.

Do not place sensitive information in public fields, ordinary notes, or AI prompts. Coach House is not intended to collect protected health information under HIPAA or information from children. If an organization uploads information about another person, it is responsible for having a lawful basis and giving required notice.

We use personal information only for reasonably necessary and proportionate purposes connected to the service and our legal obligations.

• Create and authenticate accounts; manage organizations, roles, invitations, subscriptions, and preferences.
• Provide nonprofit discovery, maps, workspaces, education, documents, reporting, fiscal workflows, communications, and support requested by users.
• Process purchases, maintain transaction records, prevent duplicate or fraudulent charges, and reconcile payment status with Stripe.
• Personalize the experience, preserve selected settings, provide location-relevant results, and maintain records users choose to collect or share.
• Monitor reliability, measure performance, troubleshoot errors, prevent abuse, enforce access controls, investigate incidents, and protect users and the service.
• Communicate about accounts, security, transactions, service changes, support, and marketing where permitted; honor opt-outs and consent withdrawals.
• Comply with law, enforce agreements, respond to lawful requests, establish or defend claims, conduct audits, and maintain required fiscal, consent, and transaction evidence.
• Create aggregated or de-identified information that is not reasonably linkable to a person and use it for research, reporting, service planning, and improvement.

Where a law requires a legal basis, we rely on performance of a contract to provide requested services; legitimate interests in security, support, administration, and improvement; compliance with legal obligations; consent for optional processing such as device location or certain communications; and protection of vital or legal interests when applicable.

You may withdraw consent at any time, but withdrawal does not affect prior lawful processing and may prevent an optional feature from working.

We disclose information only as described below, at your direction, or as otherwise disclosed when information is collected. Service providers may use information only to provide contracted services and for other purposes permitted by their agreements and law.

• Supabase provides authentication, database, storage, and related infrastructure.
• Vercel provides hosting, logs, performance monitoring, and privacy-oriented site analytics.
• Stripe processes payments and provides subscription, invoice, and transaction status. Stripe receives payment information directly under its own policy.
• Mapbox provides maps, geocoding, tiles, and map interactions and receives map requests and associated device and network information.
• Resend and Supabase deliver account, authentication, support, and permitted marketing email.
• hCaptcha may process interaction, device, and network information to detect automated abuse when CAPTCHA is enabled.
• OpenAI may process prompts, instructions, and relevant context when an authorized user invokes an AI-assisted feature.
• Professional advisers, auditors, insurers, contractors, and support providers may receive information when reasonably necessary and subject to confidentiality or legal duties.
• Government authorities or other parties may receive information when we reasonably believe disclosure is legally required or necessary to protect rights, safety, security, users, or the public.
• A successor may receive information as part of a merger, financing, reorganization, bankruptcy, or transfer of all or part of the service, subject to appropriate protections and notice where required.

Organization owners, administrators, coaches, and authorized collaborators may access information according to their roles. Information created for an organization may remain with that organization if a member leaves. Organizations are responsible for configuring roles and public settings appropriately.

Information you or an administrator marks public can be viewed, indexed, copied, and shared outside Coach House. This may include an organization profile, programs, team information, contact details, location, public documents, resource listings, or roadmap content. Private workspace and designated fiscal documents are not made public merely because an organization has a public profile.

Device location is optional and requires browser permission. Coach House currently uses raw device coordinates in browser memory to center the map and does not store those raw coordinates in your account or Coach House database. The browser may retain a permission choice, and Coach House may retain a local indication that the prompt was answered.

Mapbox and network providers receive map, tile, viewport, IP, and device requests needed to render the map. You can deny or revoke browser location permission and search manually. Organization addresses, provider locations, and service areas that users submit or sources publish are separate from device location.

When an authorized user chooses an AI-assisted feature, Coach House may send the prompt, instructions, and relevant context to OpenAI or another provider identified at the feature. We use the response to provide the requested function, support safety, and troubleshoot the service.

Do not include confidential, regulated, or sensitive personal information in an AI prompt unless the feature expressly requests it and you are authorized to disclose it. AI output is not used as the sole basis for legal or similarly significant decisions about a person.

We use cookies and similar browser storage for authentication, security, active-organization selection, theme and interface preferences, onboarding state, map permission state, and other functions you request. Disabling required storage may prevent sign-in or features from working.

Vercel Analytics, Speed Insights, application telemetry, and server logs help us understand aggregate use, performance, and errors. We do not use third-party advertising pixels for cross-site behavioral advertising. Browser privacy controls may limit some measurement.

We send transactional and relationship communications for authentication, invitations, purchases, security, support, and material service changes. These are not marketing and may continue while necessary to provide or secure an account.

Marketing email includes an unsubscribe or preference mechanism where required. We honor valid email opt-outs while retaining evidence needed to suppress future marketing. If we offer automated marketing calls or texts, we will obtain any required consent separately and honor reasonable revocation requests, including STOP for covered texts.

Coach House does not sell personal information for money and does not share personal information for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws. We do not knowingly sell or share personal information of people under 18.

Disclosures to service providers, organization collaborators, and third parties you direct are not treated as sales when the law provides an applicable exception. If our practices change, we will update this Policy and provide required opt-out controls before the change applies.

We retain each category only as long as reasonably necessary for the purposes described above, considering account status, organization instructions, contractual commitments, legal and fiscal recordkeeping, security, dispute and fraud prevention, source provenance, and backup schedules.

• Account, workspace, and organization content is generally retained while the account or organization is active and for a limited period afterward to support recovery, export, disputes, and deletion workflows.
• Consent, transaction, subscription, fiscal, tax, audit, and security evidence may be retained longer when necessary to comply with law, document authorization, prevent fraud, or establish and defend claims.
• Operational logs, analytics, support records, and local browser preferences are retained according to their purpose and configured lifecycle, then deleted, aggregated, or de-identified.
• Public-source and resource records may be retained for attribution, provenance, correction, safety, and unpublish history even after they are no longer publicly displayed.
• Backups are protected and expire on a managed schedule. Deletion from active systems may not immediately remove information from backups, legal holds, or records another organization controls.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including server-side authorization, row-level access controls, encrypted transport, restricted storage access, signed links, audit evidence, and service monitoring. No system is completely secure.

If a security incident affects personal information, we will investigate, contain, document, and provide notice to affected people and regulators when required by applicable law. Notify us promptly if you believe an account or information has been compromised.

Depending on where you live and subject to exceptions, you may have rights to know or access personal information; receive a portable copy; correct inaccuracies; delete information; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain sensitive-information uses; appeal a denied request; and receive equal service without unlawful discrimination.

You can update some information in the service, manage email preferences through message links, revoke browser location permission in browser settings, or submit a request to joel@coachhousesolutions.org. Describe the right and account involved. We may verify identity and authority, use information only for verification, and ask an authorized agent for proof. We will respond within the time required by applicable law and explain any denial or appeal method.

The categories collected in the preceding 12 months are the categories listed in Information we collect, including identifiers; customer and commercial records; internet or electronic activity; approximate or precise geolocation when enabled; professional or organization information; user content; and sensitive information described above. Sources, purposes, recipient categories, and retention criteria are also described in this Policy.

We do not offer a financial incentive for personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is no sale or sharing to opt out of under our current practices. Where state law applies, eligible residents may exercise the rights described above and may contact us to appeal a decision.

Coach House is intended for adults and is not directed to children under 13. Accounts require users to be at least 18. We do not knowingly collect personal information from children. If you believe a child provided personal information, contact us so we can investigate and delete it as required.

Coach House is operated from the United States. If you access it from another country, information may be processed in the United States and other locations where our providers operate. Where required, we use lawful transfer mechanisms and protections. You are responsible for determining whether organizational use is permitted in your jurisdiction.

We may update this Policy to reflect service, legal, or operational changes. We will post the new effective date and provide additional notice or request consent when required. Materially different practices will not be applied retroactively without an appropriate legal basis.

Questions, privacy requests, and security reports may be sent to joel@coachhousesolutions.org. Please do not email sensitive documents or credentials; we will provide a safer submission method when needed.