Privacy Policy

Mosaic Coaching Studio (the “Platform”) is a coaching platform operated by gothamCulture LLC (“we”, “us”). It is used by coaching providers and the organizations that sponsor coaching, and by their coaches, coachees, sponsors and administrators. Some organizations use the Platform under their own name and web address; it is still operated by us, and this policy still applies.

When an organization uses the Platform to run a coaching program, that organization decides who is invited and what the program records. We process that information on its behalf and under our agreement with it. If you have a question about a program you take part in, you can ask that organization or us.

• Account and profile information — your name, email address, sign-in details, time zone, photo, and the profile details you or your organization add (for coaches: biography, credentials, professional links, and, where you are paid through the Platform, rate, payout details and tax identifier).
• Coaching content — engagements, session details, goals, notes, action items, forms and assessments you complete, feedback and ratings, and messages exchanged in the Platform’s chat.
• Scheduling information — session times and, if you connect a calendar, the information described under “Calendar connections” below.
• Contact information for reminders — if your program uses text-message reminders, your mobile phone number.
• Billing information — invoices, subscriptions and payment status. Card details are entered with and held by our payment processor, Stripe; we do not receive or store full card numbers.
• Email records — the emails the Platform sends you and whether they were delivered, bounced or opened. Where a coach writes to you from an engagement, the text of that email is kept so the coach can refer back to it.
• Security and technical information — sign-in attempts, error reports, and your IP address, which we use briefly to limit repeated requests and protect accounts.

• To provide the Platform: run coaching programs, schedule sessions, and show each person what they are entitled to see.
• To send service emails and, where your program uses them, reminders.
• To bill organizations and pay coaches.
• To keep the Platform secure, prevent abuse, and fix problems.
• To provide optional AI features, only as described below.

We do not sell personal information, we do not use it for advertising, and we do not share it with anyone for their own marketing.

You can choose to connect a Google, Microsoft Outlook or Apple iCloud calendar, or to subscribe to a calendar feed. Connecting is optional; the Platform works without it.

What we access in your Google account. When you connect Google Calendar, you are asked to allow access to your email address, to view your calendars and events, and to manage events. We use that access only as follows:

• Your email address — to show which Google account is connected.
• Your list of calendars — to let you choose which calendars should count as busy. We store only the identifiers of the calendars you choose, not their names.
• Busy times — for the calendars you choose, we read only the start and end time of each event, whether it is marked busy or free, and whether you declined it. We do not request or store event titles, descriptions, locations or other attendees. We use these times only so that sessions are not offered or booked when you are busy, and we delete busy times once they are more than seven days in the past.
• Session events — we add your coaching sessions to your primary calendar, and update or remove them when a session changes or is cancelled. These events contain the session title (which includes the coachee’s name and organization), time, description and location or meeting link, are marked private, and have no attendees added.

How we store and share it. Access tokens are encrypted at rest. We do not share Google user data with anyone, do not use it for advertising, do not sell it, and do not send it to any AI model. People at gothamCulture do not read it except when you ask us to help with a problem, when needed for security, or when required by law.

Disconnecting. When you disconnect a calendar, we delete the stored tokens and busy times. Session events already added to your calendar stay there unless you delete them. You can also remove our access at any time from your Google Account at myaccount.google.com/permissions.

The Platform’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft Outlook and Apple iCloud connections work the same way: we read busy times only, and Microsoft calendars also receive your session events. An Apple app-specific password or calendar-feed address you give us is stored encrypted.

Some features use AI: summarising a recorded session into notes, suggesting coach matches, linking action items to goals, and summarising feedback for program administrators. These run on Microsoft Azure OpenAI.

• AI is used for an engagement only if the organization has AI switched on and the participant has explicitly agreed. Not answering counts as no.
• Session recordings are held only in your browser until they are transcribed, then cleared. We do not store the audio or the full transcript; we keep the summary note.
• AI-generated session summaries are visible only to their author and the engagement’s assigned coach, and are deleted 14 days after the engagement is completed.
• Our AI provider does not use this content to train its models.

Within a coaching program, information is shown to the people involved according to their role — for example, a coach sees their coachees’ engagements, and organization administrators see program information. Private notes stay private to their author unless they choose to share them.

Outside the Platform, we share information only with service providers that help us run it, under agreements that limit their use to providing that service:

• Supabase — database, sign-in and file storage
• Vercel — hosting
• Microsoft Azure OpenAI — the AI features above
• Stripe — payments
• Resend — email delivery
• Twilio — text-message reminders, where used
• Cloudflare — bot protection on sign-in forms
• Zoom — creating meetings for sessions, where a coach connects Zoom
• Google, Microsoft and Apple — calendar connections you choose to make
• Intuit QuickBooks — accounting for invoices and coach payments
• gothamCulture’s own partner and survey systems — for coach records and for assessments run as part of a program

We may also disclose information if required by law, to protect the rights and safety of people using the Platform, or as part of a merger or sale of our business, in which case this policy would continue to apply to it.

We use only the cookies and browser storage the Platform needs to work: to keep you signed in, remember which organization’s site you are using, remember settings such as dismissed messages, and let the Platform work offline. We do not use analytics, advertising or tracking cookies.

We keep information for as long as the organization running your program uses the Platform, or as our agreement with it requires, and delete it when asked. Some things are deleted sooner automatically: calendar busy times after seven days, AI session summaries 14 days after an engagement ends, sign-in records after 90 days, and IP-based request limits after a day.

Information is encrypted in transit and at rest. Calendar and video-meeting credentials are additionally encrypted by us. Access is controlled per organization and per role, and accounts can be protected with two-step sign-in. No system is perfectly secure, but we work to protect your information and will notify affected people and organizations of a breach as the law requires.

The Platform and its data are hosted in the United States. If you use it from elsewhere, your information will be transferred to and processed in the United States.

You can see and update much of your information in the Platform. You can disconnect a calendar or Zoom at any time, and decline AI processing. You can ask us to access, correct or delete your personal information, or ask a question about how it is used, by writing to chris.cancialosi@gothamculture.com. Where your information is part of an organization’s coaching program, we may need to work with that organization to respond. Depending on where you live, you may have further rights under local law, and we will honour them.

The Platform is intended for adults and is not directed to children. We do not knowingly collect information from children under 16.

We will update this page when our practices change, and change the date at the top. If a change is significant, we will tell the organizations using the Platform before it takes effect.

gothamCulture LLC
chris.cancialosi@gothamculture.com