Privacy Policy
Privacy Policy
Last updated: 23 August 2026
This policy explains how Pangolin Enterprises Pty Ltd (“SMB Mastery”, “we”, “us”) handles information within the SMB Mastery coaching platform (the “Service”). It applies to the three types of people who use the Service: the coach, the executive assistant (EA), and coaching clients.
Information we collect
- Account information — your name, email address and role. Sign-in and passwords are handled by our authentication provider (Supabase); we never see or store your raw password.
- Business & coaching details — for clients: company name, program, coaching cadence, and session records.
- Coaching content — session transcripts (uploaded by your coach or EA), AI-generated draft summaries, wins, obstacles, themes and quotes derived from them.
- Your inputs — commitments, operator scorecard metrics, goals, reflections and session feedback that you record in the Service.
- Files — documents uploaded to the platform by the coach or EA.
- Communications — in-app notifications and the transactional emails we send you.
- Technical data — an essential session cookie to keep you signed in, and a small amount of functional data kept in your browser (your light/dark theme choice and in-app guide progress). We do not use advertising or analytics tracking.
How we use your information
We use it only to operate the Service: to authenticate you, run coaching sessions and journeys, produce and deliver session summaries, track commitments and scorecards, send reminders and notifications, and keep the platform secure. We do not sell your information or use it for advertising.
AI processing of transcripts
Session transcripts are analysed by AI to drafta summary, wins, obstacles and suggested commitments. We use Anthropic’s Claude, with Google’s Gemini as a fallback. Importantly, every AI draft is reviewed and approved by a human(the coach or EA) before it is shared with a client — nothing AI-generated is published to a client automatically. AI provider API keys are stored encrypted and used only on our servers.
Who can access your information
Access is strictly role-based and enforced at the database level (row-level security):
- The coach and EA can access the coaching practice’s clients and their coaching records, as required to deliver the service.
- Each client can access only their own information — never another client’s. Clients cannot see unapproved AI drafts.
Third-party service providers
We rely on the following providers to run the Service. They process data on our behalf under their own terms and security commitments:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage (hosting of all application data). |
| Vercel | Application hosting and content delivery. |
| Anthropic (Claude) | AI analysis of coaching-session transcripts. |
| Google (Gemini) | Fallback AI analysis of transcripts. |
| Resend | Delivery of transactional email (invites, summaries, reminders). |
| Cloudflare (Turnstile) | Bot protection on the sign-in and password pages. |
| Google (Calendar & Drive) | Optional calendar sync and encrypted backup storage, only when a coach connects their Google account. |
Some of these providers — in particular the AI providers and hosting — may process data on servers located outside Australia. Where that occurs, we take reasonable steps to ensure your information continues to be handled with an appropriate level of protection.
How we store and protect your information
- Data is hosted on Supabase (PostgreSQL database and file storage) and served through Vercel.
- Access between roles and clients is enforced by database row-level security policies.
- Sensitive credentials and integration tokens are encrypted at rest (AES-256-GCM).
- All traffic is served over HTTPS with strict transport security, and the application sets modern security headers.
Data retention and deletion
We retain your information for as long as your account is active and as needed to provide the Service and meet our legal and record-keeping obligations. Client accounts can be archived (hidden from active use but retained so historical coaching records remain available to authorised staff) or permanently deleted, which cascades to remove the client’s dependent records and uploaded files. You can ask us to delete your information using the contact details below.
Your rights
You may request access to the personal information we hold about you, ask us to correct it if it is inaccurate, or ask us to delete it. To make a request, or if you have a privacy concern, contact us using the details below and we will respond within a reasonable time.
Children
The Service is a business tool and is not directed at children.
Changes to this policy
We may update this policy from time to time. The date at the top reflects the latest version; significant changes will be communicated through the Service where appropriate.
Contact us
Pangolin Enterprises Pty Ltd (trading as SMB Mastery)
74 O'Connell St, North Adelaide SA 5006, Australia
Privacy enquiries: privacy@smbmastery.com.au