Privacy policy
Last updated 8 August 2026
This policy explains what personal information Coaching Workbench collects, why, and what we do with it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
The responsible party is Dust consulting CC, 165 Cent Street, Lynnwood-Glen, Pretoria 0081, Gauteng, South Africa. Our information officer can be reached at privacy@coachingworkbench.com.
1. Two different roles
This matters, so it comes first.
- Coaches. For a coach’s own account information we are the responsible party.
- A coach’s clients. For information a coach records about their clients, the coach is the responsible party and we are an operator processing it on their instruction. We do not decide what a coach stores about a client, and we do not use it for our own purposes. If you are a coaching client with a question about your information, please ask your coach first.
2. What we collect
From coaches: name, email address, and any practice details you enter (business name, address, VAT number for invoicing). Payment card details are collected and held by Paystack, not by us — we receive only a token and the outcome of each charge.
Entered by coaches about their clients: whatever the coach records — name, contact details, role and organisation, session notes, assessment results, messages and files. Some of this may be sensitive, which is why it is separated per coach and never used for anything but showing it back to that coach and, where the coach chooses, to that client.
Automatically: basic technical logs needed to run and secure the service, such as timestamps and error records. We do not run advertising trackers or third-party analytics profiling on this site.
3. Why we process it
- To provide the Service you signed up for (performance of a contract).
- To take payment and issue receipts (performance of a contract, legal obligation).
- To keep the Service secure and to investigate misuse (legitimate interest).
- To send service messages such as billing and important changes. Marketing email, if any, is sent only with consent and can be stopped at any time.
4. Who we share it with
We do not sell personal information. We share it only with the operators needed to run the Service:
- Supabase — database, authentication and file storage. Your data is stored in Paris, France (AWS region eu-west-3).
- Netlify — website and application hosting.
- Paystack — card payments and subscription billing.
- Anthropic — the AI model behind the drafting features. Text you send to a drafting feature is transmitted to generate that draft.
- Google — only if you connect Google Calendar, and only for the calendar events you create.
5. Where your data is stored, and cross-border transfer
Client records, session notes, assessment results and uploaded files are stored in Paris, France, in the European Union. This is a transfer of personal information outside the Republic of South Africa, and section 72 of POPIA permits it: personal information in the EU is protected by the General Data Protection Regulation (GDPR), a law that upholds principles for lawful processing substantially similar to POPIA’s, including onward-transfer restrictions.
Our other operators — hosting, payments, the AI drafting features and, if you connect it, Google Calendar — may process data in other countries. Where they do, we rely on their contractual commitments to protect it to a standard comparable to POPIA.
6. AI-assisted features
When you use a feature that drafts text, the content you supply for that draft is sent to our AI provider to produce it. Do not paste anything into those fields that you would not be willing to have processed in that way. Drafts are returned to you and stored in your account like any other content.
7. How long we keep it
Account and client data is kept while your account is open. If you close your account we delete or irreversibly anonymise your data within 90 days, except records we are legally required to retain — for example invoices and payment records, which South African tax law requires us to keep for five years.
8. Security
Data is encrypted in transit. Access is restricted by row-level database rules so one coach cannot reach another coach’s data. Client portal links use unguessable tokens and can be revoked by the coach. No system is perfectly secure; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
9. Your rights
Under POPIA you may ask us to confirm what personal information we hold about you, to correct or delete it, or to object to processing. You may also complain to the Information Regulator of South Africa. Write to privacy@coachingworkbench.com and we will respond within a reasonable period.
10. Cookies
This marketing site sets no cookies. The application stores a session token in your browser so you stay signed in. That is required for the app to work and is not used for tracking.
11. Changes
We will post any update here and change the date above. Material changes will also be emailed to account holders.
12. Contact
Dust consulting CC
165 Cent Street, Lynnwood-Glen, Pretoria 0081, Gauteng, South Africa
Email: privacy@coachingworkbench.com
Phone: +27 83 262 4873