Privacy Policy
1. Who is responsible for your data
The data controller is Boris Prigmore Ventures, a Polish-registered entity ("we", "us", "our"). Questions or data-subject requests: support@boristhecoach.com.
We comply with the UK Data Protection Act 2018 and UK GDPR, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) where applicable.
2. What we collect, why, and where it lives
| Data | Purpose | Where stored |
|---|---|---|
| Email address | Account identification, magic-link sign-in | Clerk (auth provider) and our application database on Cloudflare |
| Display name (optional) | Shown in the simulator interface | Clerk |
| IP address | Abuse detection, rate-limiting, security logs | Cloudflare logs and our audit log |
| Per-item responses (your best/worst choices) | Scoring, study mode, mastery review | Our application database on Cloudflare |
| Session metadata (timestamps, duration) | Verification of learning; abuse detection | Our application database on Cloudflare |
| Payment data (card details, billing address) | Processing your purchase, invoicing, tax | Lemon Squeezy as Merchant of Record. We do not see or store your card details. |
3. Lawful basis for processing (GDPR / UK GDPR)
- Contractual necessity: for delivering the Service you have purchased (account, sign-in, scoring, content access, payment).
- Legitimate interest: for abuse detection, security logs, and ensuring the integrity of the item bank.
- Legal obligation: for retaining invoices and transaction records under Polish and EU tax law.
- Consent: for any marketing email (you can withdraw consent at any time).
4. Sub-processors and third parties
The service is delivered with the help of the following sub-processors:
- Lemon Squeezy: payment processing as Merchant of Record. See their privacy policy.
- Cloudflare: application hosting (Pages, Workers, D1) and CDN. See their privacy policy.
- Clerk: authentication (email magic links, session management). See their privacy policy.
We do not sell your personal data. We do not share it with advertisers. We do not use it to train any machine-learning model.
5. International transfers
Some of our sub-processors store data outside the European Economic Area, including in the United States. Where this occurs we rely on the European Commission's Standard Contractual Clauses or equivalent safeguards.
6. How long we keep your data
- Account and licence records: for the duration of your licence and for a further 4 years afterwards, to support credential-renewal evidence under ICF Continuing Coach Education (CCE) requirements.
- IP address logs: purged after 90 days.
- Payment and invoicing records: held by Lemon Squeezy and by us for the period required by Polish and EU tax law (currently 5 years).
- Per-item response data: kept for the duration of your licence; you may request deletion at any time.
7. Your rights
Under UK GDPR, EU GDPR, and (where applicable) CCPA, you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Request deletion of your data (subject to legal-retention obligations above);
- Request a portable copy of your data;
- Object to or restrict certain processing;
- Withdraw any consent you have given;
- Lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).
To exercise any of these rights, email support@boristhecoach.com. We respond within 30 days.
8. Cookies and local storage
We use only first-party cookies and browser local storage necessary for the Service to function:
- Authentication session (Clerk): keeps you signed in.
- In-progress exam state (local storage): so refreshing the page doesn't lose your answers.
- Terms-acceptance flag (local storage): records that you've accepted the click-to-agree terms.
We do not use advertising cookies, analytics trackers, or third-party marketing pixels.
9. Security
We use TLS encryption for all data in transit. Authentication is handled by Clerk with magic-link sign-in (no passwords). Payment data is handled exclusively by Lemon Squeezy. The item bank is served from a Cloudflare Worker and protected by rate-limiting and anomaly alerting.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email to active licence-holders at least 14 days before they take effect. The "Last updated" date above will always reflect the current version.
11. Contact
Questions, requests, or complaints: support@boristhecoach.com.