Privacy Policy

• Account information: your email address, an optional display name, and — if you sign in with Google or LinkedIn — basic profile details those providers share (name, email, profile photo).
• Learning activity: the lessons and assessments you start, your attempts, scores and feedback, post-session survey answers, certificates you claim, and support requests you send.
• Session recordings: while you work in a streamed desktop exercise we record the session — a screen recording of the desktop and a transcript of your interaction with the AI agent. This is how your work gets scored.
• Payments: billing is handled by Stripe. We store your subscription status and Stripe customer id — never your card number.
• Technical data: cookies needed to keep you signed in, and standard server logs (IP address, browser type, pages requested) used for security and operations.
• Product analytics: when enabled, anonymized usage events (for example which pages are visited and where users drop off) to understand and improve the product.

To provide the Service: run your exercises, score your work, track course progress, issue certificates, and manage your membership. To communicate with you about your account (sign-in links, receipts, support replies). To keep the Service secure and to improve it — including reviewing session recordings to understand where exercises fail or confuse people.

Your session activity and work products are processed by AI models (provided by Anthropic) to power the in-session agent and to generate your scores and feedback. We do not use your personal data or session content to train AI models.

Only service providers that run Coaptiv, under their own contractual and privacy obligations:

• Vercel (web hosting), Prisma (database), Hetzner (the cloud infrastructure your exercise desktops run on), Cloudflare (storage of session recordings),
• Stripe (payments), Resend (transactional email), Anthropic (AI models),
• Reddit (ad measurement): our ad landing pages (URLs starting with /for/) load a Reddit pixel that reports the page visit to Reddit and sets a Reddit cookie in your browser — this applies to any visitor to those pages. Separately, if you sign up or purchase after arriving from a Reddit ad, we send Reddit a hashed (not readable) identifier and the conversion event so Reddit can measure the ad’s performance. The pixel does not load anywhere else on the Service,
• and sign-in providers you choose to connect (Google, LinkedIn).

We do not sell your personal data. We do not share it with ad networks except the Reddit ad measurement described above (the pixel on our ad landing pages, and hashed conversion events for visitors who arrived from a Reddit ad). We may disclose information if required by law, or as part of a business transfer (in which case this policy continues to apply).

If you claim a certificate, its verification page is public and shows the name you chose, the course, and the issue date — never your scores. Nothing else about your account is public.

We keep your account data while your account is active. Session recordings and transcripts are retained so we can operate and improve scoring and let you review your results. If you request deletion of your account, we delete your account data and session recordings within 30 days, except where we must retain records to comply with law (for example payment records).

You can request access to, correction of, deletion of, or an export of your personal data at any time by emailing privacy@coaptiv.ai (or via support). We respond within 30 days.

• California residents:you have the rights provided by the CCPA/CPRA — to know, access, correct, and delete your personal information, and to not be discriminated against for exercising those rights. We do not sell or “share” personal information as defined by the CCPA.
• EEA/UK visitors: we process your data to perform our contract with you, to pursue the legitimate interests described above, or with your consent. You additionally have rights to object, to restrict processing, to data portability, and to lodge a complaint with your local supervisory authority.

We use industry-standard measures to protect your data — encrypted connections, access controls, and isolated per-session sandboxes. No system is perfectly secure; we cannot guarantee absolute security.

The Service is not directed to children and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

We may update this policy; for material changes we will give notice before they take effect (for example by email or an in-product notice). Questions or requests: email privacy@coaptiv.ai.