Privacy Policy
Who this covers
This policy explains how New Cyber Executive ("we", "us") handles personal data in the Coaching Portal — the web application at portal.newcyberexecutive.com and the NCE Portal iOS app.
The Portal is private and invite-only. It has no public sign-up: an account exists only because your coach created one for you as part of a coaching engagement. We are the data controller for the information described below.
Questions, requests or complaints: use our privacy request form. It reaches your coach directly, and we reply to the address you give us.
What we collect
We collect only what the coaching relationship needs to work.
- Account details
- Your name and email address, provided by you or by your coach when your account was created.
- Coaching content you write
- Answers to materials and worksheets, session topics, discussion threads, homework activity, and any files you upload. This is the substance of your coaching work and we treat it as the most sensitive data we hold.
- Coaching content your coach writes
- Notes, frameworks shared with you, themes recorded about your work, and review feedback.
- Usage and technical data
- Sign-in times, which frameworks you have opened or acknowledged, notification preferences, and standard server logs (IP address, browser or device type, request times) kept for security and troubleshooting.
- Push notification tokens
- If you use the iOS app and allow notifications, a device token so we can deliver them.
We do not collect payment details through the Portal, we do not use advertising or tracking cookies, and we do not build advertising profiles. The only cookies we set are those required to keep you signed in.
How we use it
- To operate the Portal and show you your own coaching material
- To let your coach prepare for and follow up on sessions with you
- To send you the notifications your settings allow — by email and by push
- To keep the service secure, diagnose faults, and prevent misuse
Our legal basis for this processing is the performance of our coaching contract with you, and our legitimate interest in operating and securing the service.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Who else processes your data
We use a small number of service providers to run the Portal. Each is bound by contract to protect your data, to use it only on our instructions, and to provide protection equivalent to that described in this policy.
| Provider | What it processes |
|---|---|
| Supabase and/or Neon | Database, sign-in, and file storage — all Portal data |
| Vercel | Web hosting and request logs |
| Anthropic | The messages you send to Apollo, our AI coaching assistant, together with the material Apollo draws on to answer you — which can include your own coaching materials and the answers you have written in them. Its Claude models read these to compose each reply. Only if Apollo is switched on for your account. |
| Resend | Your email address and the contents of notification emails |
| Apple | Push notification tokens and notification contents, for delivery to your device |
About the AI assistant. This applies only if Apollo has been switched on for your account. If it hasn't, none of your data reaches an AI provider at all.
If it has: Apollo answers using what you write to it, and it can also draw on your own coaching materials and the answers you have recorded in them, so that its replies fit your actual work rather than being generic. Both go to Anthropic's Claude, which composes the reply. Apollo itself runs on New Cyber Executive's own engine — Claude is the only outside party involved, and the model providers we use do not train their models on your content. Apollo is never shown another client's information, and yours is never shown to them.
Beyond these providers, we disclose personal data only where the law requires it.
International transfers
Our service providers are based in the United States, so your data is transferred and stored there. Where you are in the UK or the European Economic Area, these transfers rely on Standard Contractual Clauses or an equivalent approved safeguard in our agreements with each provider.
How long we keep it
We keep your coaching data for as long as your engagement is active, because its value to you is that it accumulates — earlier work stays available for later reference.
Nothing in the Portal is deleted as an automatic side effect of deleting something else. Deletions are deliberate, individual acts: removing a piece of work removes that piece of work and nothing beyond it. When an engagement ends, we retain your data so you can return to it, until you ask us to remove it.
Your rights
You can ask us to:
- Give you a copy of the personal data we hold about you
- Correct anything inaccurate
- Delete your account and your data
- Provide your data in a portable format
- Restrict or object to how we process it
To delete your account, send a privacy request choosing "Delete my account and data", or ask your coach directly. We will confirm, then permanently remove your account, your coaching content and your uploaded files. We will complete this within 30 days and tell you when it is done.
We respond to all requests within one month. There is no charge. If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority — in the UK, the Information Commissioner's Office.
Security
All traffic is encrypted in transit. Access to the Portal is by single-use sign-in link — there are no passwords to be guessed or reused.
Children
The Portal is for executive coaching clients and is not intended for anyone under 18. We do not knowingly collect data about children.
Changes
If we change this policy we will update the date at the top of this page, and tell you directly if the change materially affects how we handle your data.