Privacy Policy

Overview

Coaching Call Dashboard (“we”, “us”, “our”) provides tools to analyse coaching sessions using AI and manual notes (the “Service”). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information: when you sign in with Google (openid, email and profile), we receive your name, email address, profile photo, and a Google user identifier.
• Google OAuth tokens: signing in with Google requests identity information only. Coaches separately connect their Google Calendar to OpenCal, our scheduling service, as described below, and OpenCal receives access and refresh tokens for that connection. These tokens let it keep bookings in sync without asking you to consent on every request.
• Content you provide: recordings, transcripts, notes, and any other materials you upload or import into the Service.
• Usage and device data: basic logs needed to operate and secure the Service (e.g., request metadata, timestamps, error logs).

Google Drive and Sheets

Coaching Call Dashboard does not request access to your Google Drive or your Google Sheets, and it cannot see, read or change any file in them. Recordings and transcripts of coaching calls are made available to the Service by Alpha's coaching team, not through your Google connection; once imported, they are stored and used only as described in this policy.

Google Calendar access

Coaching Call Dashboard itself does not request access to your Google Calendar. When a coach connects Google Calendar to OpenCal for scheduling, OpenCal requests the three scopes below: one to create and keep in sync the booking events it creates on the coach's own calendar, one to check free/busy times, and one to create the booking's Google Meet meeting. It does not request full Calendar access, and it does not create, rename, share, or delete calendars. To keep its own bookings in sync, OpenCal reads changes to the events it created; it stores only the busy times it needs to avoid double-booking, and never shows unrelated event content to anyone.

• OpenCal booking scope: https://www.googleapis.com/auth/calendar.events.owned lets OpenCal create a booking event on the coach's calendar (with the student as a guest and, when configured, a Google Meet link), update or cancel it when the booking is rescheduled or cancelled, and receive change notifications so the booking stays in sync. It applies only to events on the coach’s own primary calendar. OpenCal does not use this scope to create, rename, or delete calendars.
• OpenCal availability scope: https://www.googleapis.com/auth/calendar.events.freebusy lets OpenCal check when the coach is busy so it only offers students free times. It reads busy intervals only, not event details.
• OpenCal meeting scope: https://www.googleapis.com/auth/meetings.space.created lets OpenCal create a Google Meet meeting space, owned by the coach, for each booked session, and put its link on the booking. The space is separate from the calendar event, so Google does not share the coach's recording with the event's guests. OpenCal does not read, join, or change any other meeting, and does not access recordings or transcripts with this scope.

Changes in progress

We are moving to the narrower permissions described above. Until that change is complete, coaches who connect Google in our production service may still be asked for our earlier read-only Drive, Sheets and Calendar permissions, and OpenCal may request calendar.events instead of calendar.events.owned. Accounts that connected earlier may still hold those permissions. During this period the Service uses an earlier Drive permission only to import that coach's own call recordings, and an earlier Calendar permission only for administrators' read-only schedule analysis (event times and busy status, never descriptions or attendees). It does not currently use any Google Sheets permission. You can revoke any of them at any time in your Google Account.

Data protection mechanisms

• Authenticated access controls: app APIs require an authenticated session. Administrative operations (including admin ingestion settings and job controls) are restricted to admin-authorized requests.
• Session integrity: session cookies are signed on the server, set as HTTP-only, and validated on each protected request.
• OAuth token handling: Google OAuth tokens are stored server-side and refreshed server-side for ongoing authorized operations.
• Credential redaction in logs: server logging redacts token, authorization, secret, and password fields before output.
• Encrypted transport: communication with Google APIs and other external APIs used by the Service occurs over HTTPS.

How we use information

• To provide, maintain, and improve the Service.
• To authenticate you and keep your account secure.
• To process uploaded/imported content to generate analysis outputs you request.
• To troubleshoot issues and prevent abuse.

Sharing

We do not sell Google user data. We may share information with service providers that help us operate the Service (for example, hosting and database providers). They are permitted to process data only to provide services to us and not for their own purposes.

Retention

We retain information for as long as needed to provide the Service. You can delete uploaded/imported items in the Service. You can also revoke app access from your Google Account permissions at any time.

Your choices

• Revoke Google access: you can revoke the app's grant at any time through your Google Account security settings. Revocation ends the Service's access to your Google Calendar data; you must authorize the app again before those connected features can resume.
• Delete content: you can delete imported/uploaded items in the Service.
• Contact us: you can request account deletion or ask privacy questions using the contact details below.

AI features

Some features of the Service, such as summaries and the administrators' analytics assistant, use AI models from OpenAI and Anthropic, reached through Trilogy's own AI gateway. We do not send Google user data received through Google APIs (including Google Calendar events, free/busy information and Google Meet meeting details) to these AI services, in raw, aggregated or derived form. We never use Google user data to develop, improve or train generalized or foundational AI or machine-learning models, and we do not allow any AI provider to do so. We do not use self-hosted or offline AI models.

Google API Services User Data Policy

Coaching Call Dashboard's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing features described in this policy and never to serve advertisements. This includes not transferring Google user data to AI or machine-learning services, and not using it to train AI or machine-learning models. Authorized organization administrators may view the reduced Calendar event details described above for scheduling and coaching operations after a coach authorizes the Calendar connection. We do not otherwise allow humans to read Google user data except with the user's affirmative consent for specific data, for security purposes such as investigating abuse, or to comply with applicable law.

Contact

For privacy questions or requests, contact support@trilogy.com.