Privacy Policy

This Privacy Notice for Passeri Studio Ltd, trading as Practice With Robin ('we', 'us', or 'our'), describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

• Visit our website at https://www.practicewithrobin.com or any website of ours that links to this Privacy Notice
• Use Robin. Robin is a platform for coaches' professional development. Members find peer coaching partners, keep in touch, arrange and hold sessions, keep professional records, take courses and take part in communities. Our help centre describes how each feature works.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed — except for session recordings and transcripts, where the coach hosting the session decides (see the section 'SESSION RECORDINGS AND TRANSCRIPTS'), and for the professional contacts and coaching logs a coach keeps, where that coach decides (see the section 'PROFESSIONAL CONTACTS AND COACHING LOGS'). If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered 'special' or 'sensitive' in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not collect or use sensitive personal information for our own purposes. What people say in a session, or to an AI feature, may include sensitive things they choose to share. We store that content to provide the service and never analyse it for our own purposes. An AI analysis of a session transcript runs only when the host asks for it, and only the host can see the result (see the section 'SESSION RECORDINGS AND TRANSCRIPTS').

Do we collect any information from third parties? Only when you connect another service or buy something: the profile details you share when you sign in with another account, your free/busy times when you connect a calendar, and purchase records from our payment provider.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
14. SESSION RECORDINGS AND TRANSCRIPTS (WHEN A HOST STARTS OR ADDS THEM)
15. AI FEATURES (WHEN YOU USE ONE)
16. GOOGLE CALENDAR (WHEN YOU CONNECT YOUR GOOGLE CALENDAR)
17. PROFESSIONAL CONTACTS AND COACHING LOGS (WHEN A COACH KEEPS RECORDS)
18. DO WE MAKE UPDATES TO THIS NOTICE?
19. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
20. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names and email addresses
• contact preferences and sign-in data
• profile information you choose to add, such as your coaching background, experience, focus, languages, time zone and availability
• messages you send to other members, and posts, comments, ratings and other content you add to communities, events and courses
• information about the sessions you arrange and attend, such as times, duration and who took part
• recordings and transcripts of sessions, when the host of a session starts or adds them (see 'SESSION RECORDINGS AND TRANSCRIPTS')
• files you share with other members
• what you send to and receive from our AI features, including your voice when you speak to one (see 'AI FEATURES')
• professional contacts and coaching logs a coach keeps (see 'PROFESSIONAL CONTACTS AND COACHING LOGS')
• purchase records, such as what you bought, when, the price and your country. Our payment provider takes your card details. We do not see or store them.
• what you send us when you contact us or give feedback

Sensitive Information. We do not collect or use sensitive information for our own purposes. What people say in a session, or to an AI feature, may include sensitive things they choose to share. We store that content to provide the service and do not analyse it for our own purposes. An AI analysis runs only when the person who controls the content asks for it (see 'SESSION RECORDINGS AND TRANSCRIPTS' and 'AI FEATURES').

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called 'HOW DO WE HANDLE YOUR SOCIAL LOGINS?' below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. When you are signed in, we can link usage information to your account. Automatically collected information may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: http://www.practicewithrobin.com/cookie-policy.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called 'crash dumps'), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
• Call metadata. Collected during video calls, including call start time, end time, duration, and participant identifiers. This data is generated automatically when coaches use Robin's video call feature.

Google API

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To publish anonymous community statistics. We may use the professional association, experience, coaching focus and language details you display on your profile to produce anonymous statistics about the Robin community for publication on our website.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them. This never includes the content of your messages, transcripts, or recordings.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.
• To learn from what you tell us directly. Robin is founder-operated, and the team uses Robin as ordinary members. When you communicate directly with the founder or another Robin representative — in a 1:1 chat with us, on a call with us, in a community space we take part in, or through feedback you submit — we may use what you share to inform product research, decisions, and improvements. This covers only what a Robin representative legitimately sees as a participant in the conversation; it never includes private conversations between other members, and never session recordings or transcripts (even of a call a Robin representative took part in). When you rate a course, a person at Robin reads your rating and any note.
• To provide AI features you use. When you use one of Robin's AI features, we send what it needs to our AI providers to run it. This can include your voice, if you speak to it. See the section 'AI FEATURES' below. We never use this content to train AI models, and neither may our AI providers.
• To capture, store and deliver session recordings and transcripts on the host's instruction. When the host of a session starts a recording or transcription, or adds a transcript, we capture and store it as that host's data processor. See the section 'SESSION RECORDINGS AND TRANSCRIPTS' below. We never use this content for any purpose of our own.
• To take payments. When you buy something from us, our payment provider sells it to you as the merchant of record and processes your payment. We keep a record of the purchase to give you access, handle refunds and meet our legal obligations. When you buy a place from a host, the host sells it to you, and you pay on the host's own Stripe checkout. Through Stripe, the host gets your email address, the name and country on your card, the last four digits of your card and the amount, with the event and your Robin member number, to manage your place and any refund. The host never sees your full card details. We keep a record of who paid, how much and any refund, so that we can show your place, take our fee and help with refunds.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
  • Analyse how our Services are used so we can improve them to engage and retain users
  • Learn from feedback and conversations you have directly with the Robin team
  • Investigate specific reports of misconduct to keep coaches safe on the platform (scoped and logged as described in our Terms and Conditions, Section 28)
  • Diagnose problems and/or prevent fraudulent activities
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Our role depends on what we are doing with the information. In legal terms, Passeri Studio Ltd is the 'data controller' under UK and European data protection laws for Robin's account and platform processing, including profiles, connections, scheduling, attendance history, and the operation and security of the service, since we determine the means and purposes of that processing.

There are two exceptions. Session recordings and transcripts: when the coach hosting a session starts a recording or transcription, that coach is the 'data controller' of the resulting artifact, and we process it only on their behalf as their 'data processor', under the Data Processing Terms in our Terms and Conditions (Section 29). See the section 'SESSION RECORDINGS AND TRANSCRIPTS' below. Professional contacts and coaching logs: when a coach or their business uses Robin to maintain professional contact records and a private coaching log, that coach or business is the controller for that record-keeping, and we act as their processor under the Data Processing Terms for Professional Records (Section 29A). This also applies when they use session information from Robin in those records. Our separate responsibility for Robin's platform processing does not transfer to the coach. See the section 'PROFESSIONAL CONTACTS AND COACHING LOGS' below.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e. express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e. implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ('third parties') who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They may use their own service providers only under written contracts that protect your information to the same standard. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

We share personal information with service providers in these categories:

• hosting, database and file storage
• sign-in and account security
• email delivery
• video calls, and speech-to-text for calls
• AI models, voice AI and speech-to-text
• product analytics, logs and support records
• protection against abuse, such as rate limits
• cookie consent
• team messaging, for feedback and messages you send us

Our sub-processors page names each provider, what it does, where it processes data and the safeguard for any transfer. We update that page before a new provider starts to receive personal information.

Organisations that decide for themselves. Some organisations process your information for their own purposes as well as for ours. For what you buy from us, our payment provider sells to you as the merchant of record and handles your payment details under its own privacy notice. When you buy a place from a host, the host handles what they get through Stripe as a separate controller, and Stripe processes your payment under its own privacy notice. If you sign in with another account or connect a calendar, that provider handles its side under its own terms. If you accept advertising cookies, our advertising partner receives information about your visit. Our sub-processors page names each one.

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Other Users. Other members can see your profile and what you share with them or post, such as messages, community posts, comments and course ratings. A course rating is shown with your first name.

Community invitations. If you own or administer a community, we show your first name, profile photo and community role in the “Admins” section of its public-facing invitation page only with your consent. This is off by default, applies separately to each community, and only you can turn it on. You can withdraw consent at any time by turning off “Show me on the invite page” in that community’s settings. Promotion to admin does not give consent. Signed-in members can still see you as an owner or admin.

When you share your personal community invitation link, your first name and profile photo identify you as the inviter to anyone who opens that link, including people who are not signed in. The sharing dialog explains this before you copy the link. This is separate from the owner/admin setting: turning that setting off does not remove your identity as the inviter on links you shared. Ordinary members are not listed to signed-out visitors. Private community conversations, resources, artwork and event details remain protected.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests. The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

To the extent these online tracking technologies are deemed to be a 'sale'/'sharing' (which includes targeted advertising, as defined under the applicable laws) under applicable US state laws, you can opt out of these online tracking technologies by submitting a request as described below under section 'DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?'

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: http://www.practicewithrobin.com/cookie-policy.

Browser analytics and service records are separate. Your analytics cookie choice controls PostHog browser analytics and session replay. Separately, we use account-linked records of actions on Robin — such as connections, messages sent (not their content), bookings and call attendance — in PostHog to understand and improve the service, relying on the legitimate interests described in Section 3. Declining analytics cookies does not switch off that server-side analysis. You can object to this use of your service records by contacting us; we assess and respond to objections under the rights described in Section 11. This is separate from changing your cookie preferences.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

We store your account data in the United Kingdom. Some of our service providers process it in other countries, mainly the United States and the European Economic Area. Our sub-processors page shows where each provider processes data.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

When we transfer personal information from the UK or EEA to a country without an adequacy decision, we use a lawful safeguard, such as the European Commission's Standard Contractual Clauses with the UK Addendum, or the provider's certification under the EU-US Data Privacy Framework. Our sub-processors page names the safeguard for each provider. You can ask us for a copy by contacting us.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Records the law requires us to keep, such as payment, tax and accounting records, are kept for as long as the law requires. No other purpose in this notice will require us keeping your personal information for longer than six (6) months past the termination of the user's account.

Some information follows other rules. Session recordings and transcripts follow the host's decisions (see 'SESSION RECORDINGS AND TRANSCRIPTS'). Professional contacts and coaching logs follow the keeping coach's decisions (see 'PROFESSIONAL CONTACTS AND COACHING LOGS'). What you send to and receive from our AI features is kept while you have an account and deleted with it (see 'AI FEATURES'). Copies our providers hold are deleted in line with our agreements with them.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18 or the equivalent age as specified by law in your jurisdiction, please contact us.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below or updating your preferences.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookie Notice: http://www.practicewithrobin.com/cookie-policy.

If you have questions or comments about your privacy rights, you may contact us.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section 'WHAT INFORMATION DO WE COLLECT?'

Category H consists of session recordings and transcripts, which we hold for the session host as their processor, and recordings and transcripts of your use of our voice AI features, which we hold as controller and which are private to you. We never use either for our own purposes (see the sections 'SESSION RECORDINGS AND TRANSCRIPTS' and 'AI FEATURES').

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - As long as the user has an account with us
• Category B - As long as the user has an account with us
• Category D - As long as the law requires us to keep purchase records
• Category F - As long as the user has an account with us
• Category G - As long as the user has an account with us
• Category H - As long as the user has an account with us
• Category I - As long as the user has an account with us
• Category J - As long as the user has an account with us

Sources of Personal Information

Learn more about the sources of personal information we collect in 'WHAT INFORMATION DO WE COLLECT?'

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, 'HOW DO WE PROCESS YOUR INFORMATION?'

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?'

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be 'selling' of your personal information. This never applies to session recordings, transcripts, or the content of private messages, which we process only on the session host's behalf and never for research, product development, or any purpose of our own (see the section 'SESSION RECORDINGS AND TRANSCRIPTS').

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed categories A, B, D, F, G, H, I and J to service providers for a business purpose in the preceding twelve (12) months.

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under 'WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?'

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ('profiling')

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can contact us, or refer to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorised agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by contacting us. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California 'Shine The Light' Law

California Civil Code Section 1798.83, also known as the 'Shine The Light' law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?'

14. SESSION RECORDINGS AND TRANSCRIPTS (WHEN A HOST STARTS OR ADDS THEM)

Robin's video calls can be recorded and transcribed — but only when the coach hosting the session starts it, never by default, and never by us. These artifacts are handled differently from the rest of your data:

Who is responsible. The host who starts a recording or transcription, or adds a transcript, is the data controller of the result: they decide that it exists, what it is for, and how long it is kept. We (Passeri Studio Ltd) act as their data processor — we capture, store, secure, and deliver the artifact on their instructions, under the Data Processing Terms in our Terms and Conditions (Section 29). For everything else described in this notice, we are the controller.

What happens technically. During a call, audio and video pass through our video-call provider. If the host starts transcription, a speech-to-text provider turns the audio into text. We store finished recordings and transcripts in the United Kingdom, encrypted at rest, with an additional layer of application-level encryption on transcripts. Our sub-processors page names each provider.

AI analysis at the host's instruction. A host can ask Robin to analyse a transcript with AI. For example, it can give feedback on the host's own coaching, write a summary of the session, or find who said what in a transcript the host adds. Before the first analysis of a transcript, we ask the host to confirm that the other person agreed to it, and we record when they confirmed. We then send the transcript to our AI provider, which must not use it to train its models. A summary can describe what each participant said, not only the host. We store each result encrypted at rest. Only the host can see it unless they share it, and we delete it with the transcript.

Transcripts a host adds. A host can add the transcript of a session they held elsewhere, such as on Zoom or in person. The host is the controller of that transcript and must tell you before adding it. We store it in the same way, and analyse it only when the host asks, as described above. You do not need a Robin account to ask about it. Contact us and we will pass your request to the host and help them answer it.

What we never do. We never use recordings, transcripts, or your private messages to train AI or machine-learning models, for analytics, to develop or improve our products, for advertising, or for any purpose of our own. Our staff do not read or watch them as a matter of course; the single narrow exception — investigating a specific misconduct report — is described in our Terms and Conditions (Section 28).

What participants can do. The host decides whether to share a recording or transcript with the other participant. Once the host shares one with you, you can view and download it. You can ask the host to delete one, and we help you ask, as our help centre describes. When the host deletes one, it is deleted for everyone. If the host's account is deleted, their session recordings and transcripts are deleted with it.

Retention. We keep transcripts until the host deletes them. We keep recordings while the host has access to recording. When that access ends, we warn the host and keep the recordings for at least 30 days, so that the host can download them, before we delete them. Transcripts of calls started from a chat, made under our earlier shared-ownership rules, keep those rules: they belong to both participants, either participant may delete them, and unpinned ones are deleted 30 days after the call.

What you say in a session. A recording or transcript contains whatever the participants chose to say, which may include personal or sensitive disclosures. We store that content as instructed. We do not scan, categorise or analyse it for our own purposes, and we analyse it only at the host's instruction, as described above.

15. AI FEATURES (WHEN YOU USE ONE)

Robin has AI features that you start yourself. For example, you can rehearse a coaching session with an AI client, ask Robin's AI assistant a question, or get feedback on a spoken or typed reply in a course. Each feature is labelled as AI. This section gives the rules that apply to all of them. AI analysis of a session recording or transcript is different: the host controls it, and the section 'SESSION RECORDINGS AND TRANSCRIPTS' applies.

Who is responsible. We (Passeri Studio Ltd) are the data controller. Our legal basis is performance of a contract: you start the feature to use it, and the processing below is how we deliver it.

What we send, and to whom. When you use an AI feature, we send what it needs to our AI providers. If you speak, your voice goes to our voice-AI and speech-to-text provider. Text goes to our AI model provider. When you ask Robin's AI assistant a question, we also send your recent messages in that conversation, articles from our help centre, and the facts from your own account that it needs to answer. It does not look up the content of your transcripts, your recordings or your messages with other members. These providers act on our behalf, mainly in the United States, under the safeguards in 'IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?'. Our sub-processors page names them.

What we store. We store what you need to look back at, such as transcripts of sessions with an AI client, your conversation with the assistant, and your course replies and the feedback on them. We store it in the United Kingdom, encrypted at rest, with an additional layer of application-level encryption. When you speak a reply in a course, we do not keep the recording, only the text you send. The audio of a session with an AI client is held by our voice-AI provider on our behalf.

Private to you. No other member can see what you do in an AI feature.

Analytics. We record that you used a feature, and facts such as its cost and speed. We do not send what you say or write, or the replies, to our analytics provider.

What we never do. We never use this content to train AI or machine-learning models, and our providers may not either. We do not use it for advertising or to profile you. Our staff do not read or listen to it as a matter of course.

What you say. You may choose to say sensitive things. We store that content to provide the feature and do not scan, categorise or analyse it for our own purposes.

Reaching a person. AI can get things wrong, and it does not give coaching advice. Our contact form reaches a person.

Retention. We keep this content while you have an account, so you can look back at it, and we delete it with your account. Copies our providers hold are deleted in line with our agreements with them. You can ask us to delete any of it sooner by contacting us.

16. GOOGLE CALENDAR (WHEN YOU CONNECT YOUR GOOGLE CALENDAR)

Robin offers an optional feature that lets you connect your Google Calendar so your coaching sessions stay in sync with it. We access your Google Calendar data only if you explicitly choose to connect your Google account for this purpose and grant the permissions shown on Google's consent screen.

We request two Google Calendar permissions:

• See and edit events on your calendars (https://www.googleapis.com/auth/calendar.events) — so that when you book or confirm a coaching session on Robin, we can add it to your Google Calendar, update it if the session is rescheduled, and remove it if the session is cancelled. We only ever create, update, or delete events that Robin itself created; we never read, change, or delete any other event on your calendar, and we never add guests or send invitations.
• View your availability (free/busy) (https://www.googleapis.com/auth/calendar.freebusy) — so we can see the times you are already busy and remove those times from your bookable availability on Robin, preventing double-bookings. We read only free/busy time windows — never the titles, descriptions, locations, guests, or any other content of your events.

How we use this data. We use your Google Calendar data solely to provide the calendar-sync feature described above. We do not use it for advertising, profiling, or any purpose unrelated to the feature.

How we store this data. We store the access and refresh tokens that allow us to act on your behalf in encrypted form (encrypted at rest). We store a cache of your free/busy time windows (start and end times only) and the identifiers of the events Robin created on your calendar. We do not store the content of any other events on your calendar.

How we share this data. We do not sell your Google Calendar data, and we do not share it with third parties except as strictly necessary to provide the feature (for example, the infrastructure and hosting providers that store the encrypted tokens and free/busy cache on our behalf under contract) or where required by law.

Your control. You can disconnect your Google Calendar at any time from your Robin calendar settings. Disconnecting stops all further access and deletes the stored access and refresh tokens.

Limited Use. Robin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as necessary to provide these features, to comply with applicable law, or in connection with a merger or acquisition; we do not use it for serving advertisements; and we do not allow humans to read this data except with your affirmative consent, for security purposes (such as investigating abuse), or to comply with applicable law.

17. PROFESSIONAL CONTACTS AND COACHING LOGS (WHEN A COACH KEEPS RECORDS)

In Short: A coach can keep private contacts and a coaching log on Robin. The coach who keeps them is responsible for those records; we store and manage them on that coach's instructions and never use their content for our own purposes.

What these records contain. Coaches can keep names, email addresses, phone numbers, organisations, private notes and tags for people they coach or do peer coaching with, including people without Robin accounts. Coaching logs can contain session dates, durations, contact references, notes and tags.

Where the information comes from. A coach can enter information they collect directly from you or obtain from another source. At the coach's instruction, Robin can also add details you show to that coach on Robin, such as your profile name and picture, and the dates and attendance of sessions you arranged together, as our help centre describes. Robin does not copy your account email address or phone number into another coach's records. An existing saved contact may already contain details the coach entered.

Why the information is kept. The coach decides the purposes of their professional records, such as maintaining coaching relationships, reflection or credentialing evidence. They are responsible for identifying an appropriate lawful basis and giving you the privacy information that applies to their use. A request for permission to include you in a credentialing log does not authorise unrelated uses of your details.

What Robin does. We store, display, update, export and delete these private records on the coach's instructions. We do not use their content for advertising, product research, analytics or AI training, and we keep it out of our analytics and monitoring tools. Separate operational information about feature use, such as the number of rows in an export, is platform information governed by our own purposes and lawful bases; it does not include the exported details or notes.

How long records are kept. The coach is responsible for deciding how long their professional records are needed and for deleting them. Our processing lasts while we provide that record-keeping service, subject to the deletion and return provisions in the Professional Records terms. Removing your own Robin account does not itself instruct another coach to delete their professional records or copies they have exported.

Questions and rights requests. For information a coach keeps for their professional purposes, you can contact that coach to ask how it is used or to exercise your applicable data rights. You can also contact us; we will pass the request to the relevant coach and assist with the information held on Robin. You do not need a Robin account to contact us. We handle requests about our own platform processing ourselves. Access or erasure is assessed under the applicable law; it does not automatically give someone access to another person's information or to every part of a coach's notes.

Exported and shared copies. A coach can export their records and may share them with a credentialing body or another recipient they choose. Those copies are outside Robin; the coach is responsible for them.

18. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We tell you before a change that matters to you.

We may update this Privacy Notice. We list each change, with its date, on this page.

• Small changes, such as clearer wording, or a change that does not affect how we use your information, take effect when we publish them.
• Other changes, such as a new purpose, a new kind of information or a new kind of recipient, we announce with a notice in Robin at least 30 days before they take effect.
• Where we rely on your consent, we ask again before we use your information in a new way.

This notice tells you how we handle your information. It is not a contract term, and we never treat your continued use as consent.

19. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact us or write to us by post at:

Passeri Studio Ltd (trading as Practice With Robin)
66 Paul Street
London EC2A 4NA
United Kingdom

If you are a resident in the United Kingdom, we are the 'data controller' of your personal information, except where this notice says that a host or a coach is (see the sections 'SESSION RECORDINGS AND TRANSCRIPTS' and 'PROFESSIONAL CONTACTS AND COACHING LOGS'). We have appointed Jon McCallum to be our representative in the UK. You can contact them directly regarding our processing of your information, or write to them by post at:

Jon McCallum
Passeri Studio Ltd
66 Paul Street
London EC2A 4NA
United Kingdom

20. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us.