Privacy Policy
Last updated: 9 July 2026
The short version
Your coaching sessions are between you and your coach. Session content — what you say, your notes, your goals — is never visible to your employer or HR.
Sessions can be transcribed to help your coach prepare a summary. The transcript is permanently deleted once the summary is done — and in all cases within 7 days of the session, no exceptions. Audio is never stored. We don't retain session content; that's a deliberate choice, not a limitation. Prefer no transcription at all? Your coach can work from their own notes instead.
Your organisation sees aggregate numbers only — sessions and actions completed across everyone using coaching, broken down by level, never by name — and only when the group is large enough that no individual can be identified.
The rest of this page explains the details: what we collect, why, where it's processed, and your rights.
1. Who we are
Human-Capital.ai ("HCA", "we", "us") is an executive coaching platform operated by Admired Leadership Asia Pte. Ltd., 137 Telok Ayer Street, #08-01, Singapore 068602.
HCA is subject to the Singapore Personal Data Protection Act 2012 (PDPA) as its primary data protection regime. For users in the EU and UK, the EU and UK General Data Protection Regulation (GDPR) also applies. Under both regimes, HCA is the organisation responsible (data controller) for personal data processed through the platform, except where we process data on the instructions of your employer or coach, in which case we act as a data intermediary (processor).
Our Data Protection Officer, as required under the PDPA, can be contacted at: privacy@human-capital.ai
2. What data we collect
Account data. Name, email address, professional role, organisation, and login credentials for coaches, coachees, and HR users.
Coach profile data. For coaches: biography, photograph, credentials, specialisms, languages, and career history, provided by the coach and published only with the coach's explicit approval.
Session data. Where transcription is used: a real-time transcript of the coaching session. Financial information and the names of third parties are removed automatically before processing; individuals are referred to by initials. Audio is never recorded or stored. The transcript is permanently deleted immediately after the session summary is generated. What is retained: the session summary, agreed actions, and goals — visible only to the coach and the coachee.
Coachee identity protection. Coachees are identified within the coaching workflow by coach-assigned aliases. The mapping between alias and identity is stored separately with restricted access.
Reflections and practice data. Optional reflections and practice activity entered by coachees in their own portal, visible to the coachee and their coach only.
Usage data. Standard technical logs (IP address, browser type, timestamps) for security and service operation.
What we do not collect. We do not collect special category data by design. If such information arises in a coaching conversation, it exists only transiently in the transcript and is deleted with it.
3. How we use data
- To provide the coaching platform: scheduling, session summaries, goals, and actions
- To generate AI-assisted session summaries and private coach development feedback (see section 5)
- To provide employers with anonymised, aggregate programme reporting (see section 6)
- To operate, secure, and improve the service
- To meet legal obligations
We do not sell personal data. We do not use personal data for advertising. We do not use your data to train AI models.
4. Legal bases (GDPR) and consent (PDPA)
Under the GDPR, we rely on:
- Performance of a contract: operating the platform for coaches, coachees, and client organisations
- Consent: session transcription. Transcription requires the coachee's agreement and can be declined entirely — the platform fully supports coaching without transcription
- Legitimate interests: service security, operation, and improvement, balanced against the rights of data subjects
Under the PDPA, we collect, use, and disclose personal data with consent, and only for purposes that a reasonable person would consider appropriate in the circumstances. Deemed consent applies where you voluntarily provide personal data for an obvious purpose, such as creating an account. We notify you of purposes at or before collection — this policy is that notification. Consent to transcription is sought expressly and can be withdrawn at any time.
5. AI processing and sub-processors
Session transcripts are processed to produce summaries using the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Recall.ai (Hyperdoc Inc.) | Meeting capture — real-time session audio | United States |
| Deepgram, Inc. | Real-time speech-to-text transcription | United States |
| Anthropic, PBC (Claude API) | Session summarisation | United States |
| Supabase Pte Ltd | Database, authentication, storage | Seoul, South Korea (primary); processing may occur in the United States and Singapore |
| Vercel Inc. | Application hosting | United States / global CDN |
| Resend (Plus Five Five, Inc.) | Transactional email — account and service notifications | United States |
Each sub-processor is bound by a data processing agreement. None uses HCA data to train models. Anthropic deletes API inputs and outputs within 30 days and does not use them for model training.
6. What your employer can see
If your coaching is sponsored by your organisation, HR users see:
- Aggregate programme data: total sessions and actions completed, broken down by career band — never by name
- Thematic insights across the coaching programme, generated only when seven or more individuals are being coached, so no individual is identifiable
- Programme administration data: number of engagements, coach bios, spend
HR users cannot see: session content, transcripts, summaries, goals, reflections, notes, or anything a coachee has written. This separation is enforced in the platform's architecture, not by policy alone.
7. Google and Microsoft meeting integrations
Where you connect the platform to Google Meet or Microsoft Teams to transcribe a session:
- We access meeting audio in real time solely to produce a live transcript for the coaching session
- Audio is never stored; the transcript is deleted immediately after the session summary is generated
- We access no other data from your Google or Microsoft account
- Google user data is used only to provide this user-facing transcription feature. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide the transcription feature (see sub-processors above), do not use it for advertising, and do not allow humans to read it except with your explicit consent, for security purposes, or to comply with law
8. Retention
| Data | Retention |
|---|---|
| Session audio | Never stored |
| Session transcripts | Deleted immediately after summary generation, and in all cases permanently deleted within 7 days of the session |
| Session summaries, goals, actions | Duration of the coaching engagement + 12 months, then deleted |
| Account data | Duration of the account + 12 months, then deleted |
| Aggregate reporting data | Retained in anonymised form |
9. International transfers
HCA operates from Singapore. Our database is hosted in Seoul, South Korea; other sub-processors are located primarily in the United States, and Supabase may process data in the United States and Singapore in the course of providing its service. Where personal data of EU/UK residents is transferred outside the EEA/UK, we rely on Standard Contractual Clauses with each sub-processor. Consistent with the PDPA's transfer limitation obligation, we transfer personal data outside Singapore only where the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA — the data processing agreements with our sub-processors serve this purpose.
In the event of a data breach that is likely to result in significant harm or is of significant scale, we will notify the PDPC and affected individuals as required under the PDPA, and the relevant EU/UK authorities and data subjects as required under the GDPR.
10. Your rights
Under the GDPR and equivalent laws, you may request: access to your data, correction, deletion, restriction of processing, portability, and objection to processing based on legitimate interests. Where processing is based on consent (transcription), you may withdraw consent at any time — including declining transcription for any or all sessions.
Under the PDPA, you have the right to request access to your personal data and information about how it has been used or disclosed in the past year, to request correction of errors or omissions, and to withdraw consent (with reasonable notice) — after which we will stop the relevant processing, though this may affect our ability to provide parts of the Service.
To exercise any right: privacy@human-capital.ai. We respond within 30 days. You may also lodge a complaint with your local supervisory authority — in Singapore, the Personal Data Protection Commission (PDPC); in the EU/UK, your national data protection authority.
11. Security
Access controls are enforced at the database level (row-level security), coachee identities are aliased, transcripts are transient by design, and access to identity mappings is restricted. No security is absolute, but the platform is built so that the most sensitive data — session content — is not retained at all.
12. Children
The platform is designed for working professionals and is not directed at anyone under 18.
13. Changes
We will post any changes to this policy on this page and, for material changes, notify account holders by email.