Privacy Policy

• Account data. Your email address and, if you sign in with Google, the basic profile information Google returns (name, email, account identifier). We do not receive or store your Google password.
• Conversation content. The situation you describe, the objective you choose, and the suggestions generated in response. If you are signed in and save a scenario, it is stored against your account so you can return to it.
• Usage data. Counts and timestamps of analyses, used to enforce free and paid limits. For visitors who are not signed in we set a first-party cookie containing a random identifier so the free-analysis limit can be applied.
• Billing data. Your plan, subscription status, renewal date, and a customer/subscription identifier from our payment provider. Card numbers are entered with the payment provider and never reach our servers.
• Essential product analytics. Aggregate, event-level records such as "analysis completed" or "checkout started", used to understand whether the product works. We do not sell data or run advertising trackers.
• Technical logs. Standard server and error logs, which may include IP address, browser type, and timestamps, kept for security and debugging.

• To provide the service you asked for: generating suggestions, saving history and favourites, and keeping you signed in (performance of our contract with you).
• To handle payments, renewals, refunds, and tax obligations (contract and legal obligation).
• To enforce free-usage limits, prevent abuse, and keep the service secure (legitimate interests).
• To fix problems and improve the product using aggregate usage patterns (legitimate interests).

Please avoid submitting more detail than the situation needs — in particular other people's names, health information, financial details, or identifiers.

To produce suggestions, the text you submit and the objective you select are sent to third-party AI model providers, currently including OpenAI models accessed through the Lovable AI gateway. They process the content to return a response and act as our processors for that purpose. We do not use your conversation content to train our own models. If we add or change AI providers, we will update this policy.

• Lovable — application hosting, deployment, and the AI gateway used to reach model providers.
• Supabase — managed database and authentication (account records, saved scenarios, usage counters).
• OpenAI (and any future model providers named in this policy) — generating suggestions from the content you submit.
• Paddle — checkout, subscription billing, invoicing, and merchant-of-record services for paid plans. Stripe may also process billing while we complete our migration.
• PostHog — essential product analytics events.

Each provider handles data under its own terms and only for the purposes above. We do not claim any certification, audit, or security accreditation on their behalf or on ours.

We operate from El Salvador and our providers operate infrastructure in other countries, including the United States and the European Union. Using the service means your data may be transferred to and processed in those countries, under the safeguards our providers make available, such as standard contractual clauses where applicable.

• Account and saved scenarios: while your account is open, until you delete them or ask us to delete your account.
• Usage counters: retained as needed to enforce limits and detect abuse, then aggregated or removed.
• Billing records: retained as long as required for accounting and tax purposes.
• Technical logs and analytics events: retained for a limited operational period, typically months rather than years.

You can view and delete saved scenarios and favourites from inside the app. Depending on where you live, you may also have the right to access, correct, export, restrict, or delete your personal data, or to object to certain processing. To exercise any of these, or to request full deletion of your account and its data, write to support@saycoach.app. We will respond within a reasonable period, and we may need to verify that the request comes from you. Some records — such as billing history — may be retained where law requires it.

We use only functional first-party cookies and local storage: keeping you signed in, remembering your dark-mode preference, and applying the free-analysis limit to visitors who are not signed in. We do not use advertising cookies.

The service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will remove it.

We use access controls, encrypted connections, and row-level database rules so that your saved content is only reachable by your account. No system is completely secure, and we do not guarantee that a breach can never occur. If a breach affects your data, we will notify you where the law requires it.

We may update this policy; material changes will be reflected in the effective date above. The data controller is Andrea Rosales, an individual/sole trader based in El Salvador. For any privacy question, write to support@saycoach.app.