Privacy Policy

This Privacy Notice for Passeri Studio Ltd, trading as Practice With Robin ('we', 'us', or 'our'), describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

• Visit our website at https://www.practicewithrobin.com or any website of ours that links to this Privacy Notice
• Use Robin. Robin is a free online platform where coaches find practice partners for accreditation hours. Coaches create a profile, browse a private directory, and connect with coaches from other programmes for free, reciprocal practice — without sharing personal contact details. Robin provides in-app messaging, scheduling, and video calls so coaches can practise, build hours, and develop their skills in one place. The platform collects user names, email addresses, coaching profile information, in-app messages between practice partners, and — when the coach hosting a session starts them — recordings and text transcripts of video calls.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed — except for session recordings and transcripts, where the coach hosting the session decides (see the section 'SESSION RECORDINGS AND TRANSCRIPTS'), and for the professional contacts and coaching logs a coach keeps, where that coach decides (see the section 'PROFESSIONAL CONTACTS AND COACHING LOGS'). If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered 'special' or 'sensitive' in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not collect or use sensitive personal information for our own purposes. Where a session host records or transcribes a call, the content may include sensitive disclosures a participant chooses to make; we store that content only on the host's behalf and never analyse it for our own purposes. A host may ask for Robin's feedback on their own coaching from a transcript, or for Robin's summary of the session. Each runs only at the host's instruction, and only the host can see the result (see the section 'SESSION RECORDINGS AND TRANSCRIPTS').

Do we collect any information from third parties? We do not collect information from third parties, except the profile information you choose to share with us when you register using a social login (see 'HOW DO WE HANDLE YOUR SOCIAL LOGINS?').

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
14. SESSION RECORDINGS AND TRANSCRIPTS (WHEN A HOST STARTS THEM)
15. AI PRACTICE SESSIONS (WHEN YOU PRACTISE WITH OUR AI CLIENT)
16. ASK ROBIN (WHEN YOU ASK OUR AI ASSISTANT)
17. GOOGLE CALENDAR (WHEN YOU CONNECT YOUR GOOGLE CALENDAR)
18. PROFESSIONAL CONTACTS AND COACHING LOGS (WHEN A COACH KEEPS RECORDS)
19. DO WE MAKE UPDATES TO THIS NOTICE?
20. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
21. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• email addresses
• contact preferences
• contact or authentication data
• coaching profile information (niche, experience level, timezone, availability, bio)
• usernames
• in-app messages between practice partners
• call transcripts generated by automated speech-to-text technology, when the coach hosting the session starts transcription
• call recordings (audio and video), when the coach hosting the session starts recording
• AI practice session recordings and transcripts, when you use the AI Practice feature (see 'AI PRACTICE SESSIONS')
• call metadata, including call time, duration, and participants

Sensitive Information. We do not collect or use sensitive information for our own purposes. Session recordings and transcripts may contain sensitive disclosures participants choose to make; these are stored on the session host's behalf and never analysed for our own purposes. Where a host asks for Robin's feedback on their own coaching, we analyse the transcript only at that host's instruction. The result is about the host, and only the host can see it (see the section 'SESSION RECORDINGS AND TRANSCRIPTS'). The same care applies to AI practice sessions, which are private to you and never analysed for our own purposes (see the section 'AI PRACTICE SESSIONS').

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called 'HOW DO WE HANDLE YOUR SOCIAL LOGINS?' below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. When you are signed in, we can link usage information to your account. Automatically collected information may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: http://www.practicewithrobin.com/cookie-policy.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called 'crash dumps'), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
• Call metadata. Collected during video calls, including call start time, end time, duration, and participant identifiers. This data is generated automatically when coaches use Robin's video call feature.

Google API

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To publish anonymous community statistics. We may use the professional association, experience, coaching focus and language details you display on your profile to produce anonymous statistics about the Robin community for publication on our website.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them. This never includes the content of your messages, transcripts, or recordings.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.
• To learn from what you tell us directly. Robin is founder-operated, and the team uses Robin as ordinary members. When you communicate directly with the founder or another Robin representative — in a 1:1 chat with us, on a call with us, in a community space we take part in, or through feedback you submit — we may use what you share to inform product research, decisions, and improvements. This covers only what a Robin representative legitimately sees as a participant in the conversation; it never includes private conversations between other members, and never session recordings or transcripts (even of a call a Robin representative took part in).
• To provide AI features you use. When you start an AI practice session, we process your voice (via our voice-AI provider) to run the conversation, and we record and transcribe the session so you can review it — see the section 'AI PRACTICE SESSIONS' below. Where we offer AI-generated feedback or summaries, we process the content you ask to be analysed through our AI provider to generate it. When you ask Robin, our AI assistant, a question, we send your question and the account details needed to answer it to our AI provider — see the section 'ASK ROBIN' below. We never use this content to train AI models, and neither may our AI providers.
• To capture, store, and deliver session recordings and transcripts on the host's instruction. When the coach hosting a session starts a recording or transcription during a call, we capture and store it as that coach's data processor — see the section 'SESSION RECORDINGS AND TRANSCRIPTS' below. Recordings capture the call's audio and video; transcripts are generated by automated speech-to-text technology (currently provided by Deepgram, engaged via Daily.co). We never use this content for any purpose of our own.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
  • Analyse how our Services are used so we can improve them to engage and retain users
  • Learn from feedback and conversations you have directly with the Robin team
  • Investigate specific reports of misconduct to keep coaches safe on the platform (scoped and logged as described in our Terms and Conditions, Section 28)
  • Diagnose problems and/or prevent fraudulent activities
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Our role depends on what we are doing with the information. In legal terms, Passeri Studio Ltd is the 'data controller' under UK and European data protection laws for Robin's account and platform processing, including profiles, connections, scheduling, attendance history, and the operation and security of the service, since we determine the means and purposes of that processing.

There are two exceptions. Session recordings and transcripts: when the coach hosting a session starts a recording or transcription, that coach is the 'data controller' of the resulting artifact, and we process it only on their behalf as their 'data processor', under the Data Processing Terms in our Terms and Conditions (Section 29). See the section 'SESSION RECORDINGS AND TRANSCRIPTS' below. Professional contacts and coaching logs: when a coach or their business uses Robin to maintain professional contact records and a private coaching log, that coach or business is the controller for that record-keeping, and we act as their processor under the Data Processing Terms for Professional Records (Section 29A). This also applies when they use session information from Robin in those records. Our separate responsibility for Robin's platform processing does not transfer to the coach. See the section 'PROFESSIONAL CONTACTS AND COACHING LOGS' below.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e. express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e. implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ('third parties') who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organisation apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

The third parties we may share personal information with are as follows:

• AI Service Providers — Anthropic
• Voice AI for practice sessions — ElevenLabs
• Allow Users to Connect to Their Third-Party Accounts — Google account and Facebook account
• Cloud Computing Services — Supabase
• Communicate and Chat with Users — Loops
• Social Media Sharing and Advertising — Facebook advertising
• User Account Registration and Authentication — Clerk
• Web and Mobile Analytics — PostHog
• Website Hosting — Vercel
• Website Performance Monitoring — PostHog
• Video calls between practice partners — Daily.co
• Automated speech-to-text transcription of video calls — Deepgram

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Other Users. When you share personal information (for example, by posting comments, contributions, or other content to the Services) or otherwise interact with public areas of the Services, such personal information may be viewed by all users and may be publicly made available outside the Services in perpetuity. If you interact with other users of our Services and register for our Services through a social network (such as Facebook), your contacts on the social network will see your name, profile photo, and descriptions of your activity. Similarly, other users will be able to view descriptions of your activity, communicate with you within our Services, and view your profile.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

To the extent these online tracking technologies are deemed to be a 'sale'/'sharing' (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by submitting a request as described below under section 'DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?'

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: http://www.practicewithrobin.com/cookie-policy.

Browser analytics and service records are separate. Your analytics cookie choice controls PostHog browser analytics and session replay. Separately, we use account-linked records of actions on Robin — such as connections, messages sent (not their content), bookings and call attendance — in PostHog to understand and improve the service, relying on the legitimate interests described in Section 3. Declining analytics cookies does not switch off that server-side analysis. You can object to this use of your service records by contacting us; we assess and respond to objections under the rights described in Section 11. This is separate from changing your cookie preferences.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States, United Kingdom and Germany. Regardless of your location, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?' above), including facilities in the United States, United Kingdom, Germany, and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

European Commission's Standard Contractual Clauses:

We have implemented measures to protect your personal information, including by using the European Commission's Standard Contractual Clauses for transfers of personal information between us and our third-party providers. These clauses require all recipients to protect all personal information that they process originating from the EEA or UK in accordance with European data protection laws and regulations. Some of our providers instead rely on the EU-US Data Privacy Framework, under which they are certified — for example Daily.co, our video-call provider. Further details of the safeguards in place with each provider can be provided upon request.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than six (6) months past the termination of the user's account.

Session recordings and transcripts follow the host's retention decisions rather than the timeline above — see the section 'SESSION RECORDINGS AND TRANSCRIPTS' below. They are deleted when the host deletes them, and at the latest when the host's account is deleted. Professional contacts and coaching logs follow the keeping coach's decisions — see the section 'PROFESSIONAL CONTACTS AND COACHING LOGS' below. Audio of AI practice sessions held by our voice-AI provider is deleted in line with our agreement with them — see the section 'AI PRACTICE SESSIONS' below. Your conversation with Ask Robin is deleted with your account — see the section 'ASK ROBIN' below.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18 or the equivalent age as specified by law in your jurisdiction, please contact us.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below or updating your preferences.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookie Notice: http://www.practicewithrobin.com/cookie-policy.

If you have questions or comments about your privacy rights, you may contact us.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section 'WHAT INFORMATION DO WE COLLECT?'

Category H consists of session recordings and transcripts: peer-session artifacts are held on the session host's behalf as their processor, and AI practice recordings and transcripts are held by us as controller, private to the practising coach — in both cases never used for our own purposes (see the sections 'SESSION RECORDINGS AND TRANSCRIPTS' and 'AI PRACTICE SESSIONS').

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - As long as the user has an account with us
• Category B - As long as the user has an account with us
• Category F - As long as the user has an account with us
• Category G - As long as the user has an account with us
• Category H - As long as the user has an account with us
• Category I - As long as the user has an account with us
• Category J - As long as the user has an account with us

Sources of Personal Information

Learn more about the sources of personal information we collect in 'WHAT INFORMATION DO WE COLLECT?'

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, 'HOW DO WE PROCESS YOUR INFORMATION?'

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?'

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be 'selling' of your personal information. This never applies to session recordings, transcripts, or the content of private messages, which we process only on the session host's behalf and never for research, product development, or any purpose of our own (see the section 'SESSION RECORDINGS AND TRANSCRIPTS').

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?'

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ('profiling')

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can submit a data subject access request, contact us, or refer to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorised agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by contacting us. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California 'Shine The Light' Law

California Civil Code Section 1798.83, also known as the 'Shine The Light' law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?'

14. SESSION RECORDINGS AND TRANSCRIPTS (WHEN A HOST STARTS THEM)

Robin's video calls can be recorded and transcribed — but only when the coach hosting the session starts it, never by default, and never by us. These artifacts are handled differently from the rest of your data:

Who is responsible. The host who starts a recording or transcription is the data controller of the result: they decide that it exists, what it is for, and how long it is kept. We (Passeri Studio Ltd) act as their data processor — we capture, store, secure, and deliver the artifact on their instructions, under the Data Processing Terms in our Terms and Conditions (Section 29). For everything else described in this notice, we are the controller.

What happens technically. During a call, audio and video flow through Daily.co, our video infrastructure provider (US, certified under the EU-US Data Privacy Framework). If the host starts transcription, the audio is transcribed by Deepgram (automated speech-to-text; US, engaged via Daily.co) — we instruct Deepgram, via Daily.co, to exclude the call audio from its model-improvement programme. The finished transcript or recording is stored in our database and file storage in London (UK), encrypted at rest; transcripts carry an additional layer of application-level encryption (AES-256-GCM). If the host asks for Robin's feedback on their own coaching, we send the full transcript to Anthropic, our AI provider (US, engaged via the Vercel AI Gateway with Anthropic pinned as the provider), which returns observations on the host's turns only and must not use the content to train its models. If the host asks for Robin's summary of the session, we send the full transcript to Anthropic on the same route, under the same terms. The summary describes the session as a whole — what the client brought, the topics covered and what the host did — so, unlike the feedback, it describes the participant's side too. We store the feedback and the summary encrypted at rest, only the host can see them, and we delete them with the transcript.

What we never do. We never use recordings, transcripts, or your private messages to train AI or machine-learning models, for analytics, to develop or improve our products, for advertising, or for any purpose of our own. Our staff do not read or watch them as a matter of course; the single narrow exception — investigating a specific misconduct report — is described in our Terms and Conditions (Section 28).

What participants can do. Anyone who was in the session can view and download its transcript at any time; a session's recording is available to the host, who may choose to share it. Deletion is the host's decision: you can send the host a deletion request from the transcript page (or simply message them), and when the host deletes an artifact the deletion is permanent for everyone. If the host's account is deleted, their session artifacts are deleted with it.

Retention. Transcripts are kept until the host deletes them — we do not impose an expiry. Recordings are kept while the host's subscription to the recording feature is active, then deleted after a 30-day warned grace period if it lapses. Transcripts captured before the current Terms and Conditions took effect keep the rules they were made under: either participant can pin or delete them, and unpinned transcripts are automatically deleted 30 days after the call.

What you say in a session. A recording or transcript contains whatever the participants chose to say, which may include personal or sensitive disclosures. We store that content as instructed; we do not scan, categorise, or analyse it for our own purposes. We analyse a transcript only when the host asks for Robin's feedback on their own coaching or for Robin's summary of the session, as described under 'What happens technically' above. Each runs only at the host's instruction, and only the host can see the result.

15. AI PRACTICE SESSIONS (WHEN YOU PRACTISE WITH OUR AI CLIENT)

Robin's AI Practice feature lets you rehearse a coaching session with an AI practice client, in a voice call hosted by an AI facilitator. You are the only human in these sessions, and they exist only when you start one.

Who is responsible. For AI practice sessions we (Passeri Studio Ltd) are the data controller in the ordinary way — there is no session host besides you, so the host/processor model in the previous section does not apply. Our legal basis is performance of a contract: you start the session to use the feature, and the processing below is what delivers it.

What happens technically. During a session, your voice streams to ElevenLabs, our voice-AI provider, which provides the speech recognition, the AI conversation, and the AI voices. ElevenLabs processes this data on our behalf under a data processing agreement. The session is recorded so you can review it, and the audio is held by ElevenLabs on our behalf. We store the session's transcript in our database in London (UK), encrypted at rest with an additional layer of application-level encryption, along with the session's time and duration.

What we never do. We never use your AI practice sessions — audio or transcripts — to train AI or machine-learning models, and our providers may not either. We do not use their content for analytics, advertising, or product development, and our staff do not read or listen to them as a matter of course.

Privacy and retention. Your AI practice sessions are private to you: no other coach can see them. We keep them so you can review your practice. When your account is deleted, the practice data we hold — transcripts and session records — is deleted with it; session audio held by our voice-AI provider is deleted in line with our agreement with them. You can ask us to delete any of it sooner at any time by contacting us.

What you say in a session. A rehearsal may include sensitive things you choose to say. The same care described in the previous section applies: we store that content to provide the feature and do not scan, categorise, or analyse it for our own purposes.

16. ASK ROBIN (WHEN YOU ASK OUR AI ASSISTANT)

Ask Robin is an AI assistant inside Robin. It answers questions about how Robin works and about your own account. It runs only when you ask it something.

Who is responsible. For Ask Robin we (Passeri Studio Ltd) are the data controller. Our legal basis is performance of a contract: you ask a question, and the processing below is how we answer it.

What happens technically. Your conversation with Robin is kept in your Robin thread, in our database in London (UK), encrypted at rest with an additional layer of application-level encryption. When you send a question, we send it to Anthropic, our AI provider (US, engaged via the Vercel AI Gateway with Anthropic pinned as the provider). With it we send your recent messages in the thread and what Robin needs to answer: articles from our help centre, and facts from your own account. Those facts can include your matching preferences and whether matches are waiting, your next and most recent sessions (the date, the session type, and the other coach's first name), your logbook totals, your plan, and whether Robin's feedback on your latest session is ready. Robin does not look up the content of your transcripts, your recordings, or your messages with other coaches. Anthropic must not use this content to train its models.

Analytics. We record that Robin answered, which kinds of account facts it looked up, and the cost and speed of each answer. We do not send the text of your questions or of Robin's answers to our analytics provider.

Reaching a person. Robin can get things wrong, and it does not give coaching advice. When it can't help, it offers our contact form. A person reads what you send there.

What we never do. We never use your conversations with Robin to train AI or machine-learning models, for advertising, or to profile you. Our staff do not read them as a matter of course.

Retention. Your Robin thread stays while your account exists, so you can look back at it. When your account is deleted, we delete the whole thread, including Robin's replies. You can ask us to delete it sooner at any time by contacting us.

17. GOOGLE CALENDAR (WHEN YOU CONNECT YOUR GOOGLE CALENDAR)

Robin offers an optional feature that lets you connect your Google Calendar so your coaching sessions stay in sync with it. We access your Google Calendar data only if you explicitly choose to connect your Google account for this purpose and grant the permissions shown on Google's consent screen.

We request two Google Calendar permissions:

• See and edit events on your calendars (https://www.googleapis.com/auth/calendar.events) — so that when you book or confirm a coaching session on Robin, we can add it to your Google Calendar, update it if the session is rescheduled, and remove it if the session is cancelled. We only ever create, update, or delete events that Robin itself created; we never read, change, or delete any other event on your calendar, and we never add guests or send invitations.
• View your availability (free/busy) (https://www.googleapis.com/auth/calendar.freebusy) — so we can see the times you are already busy and remove those times from your bookable availability on Robin, preventing double-bookings. We read only free/busy time windows — never the titles, descriptions, locations, guests, or any other content of your events.

How we use this data. We use your Google Calendar data solely to provide the calendar-sync feature described above. We do not use it for advertising, profiling, or any purpose unrelated to the feature.

How we store this data. We store the access and refresh tokens that allow us to act on your behalf in encrypted form (encrypted at rest). We store a cache of your free/busy time windows (start and end times only) and the identifiers of the events Robin created on your calendar. We do not store the content of any other events on your calendar.

How we share this data. We do not sell your Google Calendar data, and we do not share it with third parties except as strictly necessary to provide the feature (for example, the infrastructure and hosting providers that store the encrypted tokens and free/busy cache on our behalf under contract) or where required by law.

Your control. You can disconnect your Google Calendar at any time from your Robin calendar settings. Disconnecting stops all further access and deletes the stored access and refresh tokens.

Limited Use. Robin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as necessary to provide these features, to comply with applicable law, or in connection with a merger or acquisition; we do not use it for serving advertisements; and we do not allow humans to read this data except with your affirmative consent, for security purposes (such as investigating abuse), or to comply with applicable law.

18. PROFESSIONAL CONTACTS AND COACHING LOGS (WHEN A COACH KEEPS RECORDS)

In Short: A coach can keep private contacts and a coaching log on Robin. The coach who keeps them is responsible for those records; we store and manage them on that coach's instructions and never use their content for our own purposes.

What these records contain. Coaches can keep names, email addresses, phone numbers, organisations, private notes and tags for people they coach or practise with, including people without Robin accounts. Coaching logs can contain session dates, durations, contact references, notes and tags.

Where the information comes from. A coach can enter information they collect directly from you or obtain from another source. Robin can also create a contact using the profile name, account link and profile picture a member uses on Robin, and create a log entry from scheduling and attendance information. Robin does not copy a member's account email address or phone number into another coach's saved contact. An existing saved contact may already contain details the coach entered.

Why the information is kept. The coach decides the purposes of their professional records, such as maintaining coaching relationships, reflection or credentialing evidence. They are responsible for identifying an appropriate lawful basis and giving you the privacy information that applies to their use. A request for permission to include you in a credentialing log does not authorise unrelated uses of your details.

What Robin does. We store, display, update, export and delete these private records on the coach's instructions. We do not use their content for advertising, product research, analytics or AI training, and we keep it out of our analytics and monitoring tools. Separate operational information about feature use, such as the number of rows in an export, is platform information governed by our own purposes and lawful bases; it does not include the exported details or notes.

How long records are kept. The coach is responsible for deciding how long their professional records are needed and for deleting them. Our processing lasts while we provide that record-keeping service, subject to the deletion and return provisions in the Professional Records terms. Removing your own Robin account does not itself instruct another coach to delete their professional records or copies they have exported.

Questions and rights requests. For information a coach keeps for their professional purposes, you can contact that coach to ask how it is used or to exercise your applicable data rights. You can also contact us; we will pass the request to the relevant coach and assist with the information held on Robin. You do not need a Robin account to contact us. We handle requests about our own platform processing ourselves. Access or erasure is assessed under the applicable law; it does not automatically give someone access to another person's information or to every part of a coach's notes.

Exported and shared copies. A coach can export their records and may share them with a credentialing body or another recipient they choose. Those copies are outside Robin; the coach is responsible for them.

19. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

20. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact us or write to us by post at:

Passeri Studio Ltd (trading as Practice With Robin)
66 Paul Street
London EC2A 4NA
United Kingdom

If you are a resident in the United Kingdom, we are the 'data controller' of your personal information — except for session recordings and transcripts, where the coach hosting the session is the controller and we act as their processor (see the section 'SESSION RECORDINGS AND TRANSCRIPTS'). We have appointed Jon McCallum to be our representative in the UK. You can contact them directly regarding our processing of your information, or write to them by post at:

Jon McCallum
Passeri Studio Ltd
66 Paul Street
London EC2A 4NA
United Kingdom

21. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please fill out and submit a data subject access request.