Privacy and cookies

Michelle is your Coach (Pty) Ltd, registration 2017/294327/07, 94 Poplar Road, Kyalami, Gauteng 1684, South Africa, operates Kairos and is the responsible party under POPIA and controller for the app data described here. Email michelleisyourcoach@gmail.com for access, correction, objection, deletion or other privacy requests. Michelle Nolting is the Information Officer. Paddle acts separately as merchant of record for sales and explains its payment processing in its privacy notice. This notice covers Kairos and its included mentoring, not separate coaching programmes or communities.

Birth details do leave the device: the setup form sends them in the request body, not in a web address. A cookie containing them is transmitted with relevant requests and processed on the server. Birth details are not intentionally written to the member database, which contains an email address and two access dates. Vercel request logs record the path and timing of requests; we do not write cookie contents to logs of our own. Clearing browser storage removes the local cookie, but does not delete your account or purchase records. A shared device or browser can expose locally held settings to its users. Do not enter names in the birth fields.

We do not use member data in an AI system.

Sex at birth is optional. The traditional ten-year-cycle calculation uses it; the rest of the app remains available without it. We do not use it to infer identity or make eligibility decisions. If you enter another person’s details, you are responsible for obtaining an appropriate basis and informing them; contact us if a person asks about processing of their details.

We use your email to invite registered users to quarterly group sessions and send service reminders. We do not treat these necessary service messages as consent to unrelated marketing. Joining the Kairos Telegram group is optional and requires an affirmative choice. If you join, your profile and messages may be visible to other group members, and Telegram applies its own privacy practices. Email remains the default route for session notices.

Group mentoring sessions are recorded. We will tell you before recording begins. We do not currently publish recordings or share them with members.

What is recorded. Audio, video, the display names participants join with, the chat, and anything shared on screen. We do not have Zoom produce a transcript.

Why. So that the people on the call can go back to what was covered.

Our lawful basis is our legitimate interests in giving members a record of a session they attended and paid for. Attendance is optional, and the arrangement below means no one has to be recorded.

Who can open a recording. Michelle Nolting, and nobody else. Zoom holds the file in order to store and deliver it; see section 4.

Where they are kept, and for how long. In Zoom’s cloud, under our Zoom Workplace Pro account, which is registered in South Africa. Zoom deletes a recording automatically 30 days after the session. A deleted recording then sits in the account’s trash, which we empty by hand every month.

If you would rather not be recorded, say so before or during the session and we will stop recording. Please know what that means for the others: we stop for the whole session, so nobody receives a recording of it. You are not asked to justify the request and it does not affect your access or your welcome on the call.

Any future publication or sharing of a recording would need its own lawful basis and its own notice to you before it happened.

We use Vercel for hosting (the app runs in Frankfurt), Upstash for the EU member list, Resend for transactional email and Paddle for sales/payment administration. A European service region does not guarantee that personnel, subprocessors, backups or support have no access from elsewhere. We use supplier agreements and applicable transfer safeguards and assess transfers under POPIA section 72 and GDPR Chapter V where relevant. Paddle’s seller-side processing is governed by its own arrangements; we do not receive your full card number. We do not sell your personal information.

Zoom. We use Zoom for every live group mentoring session and for the cloud recording described in section 3. Automatic transcription is switched off. Zoom processes the meeting and participant data needed to provide those functions: the display name you join with, your audio and video, the chat, anything you share on screen, and the connection details of your device. Our account is a Zoom Workplace Pro account registered in South Africa, so a recording of a session attended from the EU or the UK is stored under an account outside those regions. Zoom’s own data processing terms govern what it does with that material, and we rely on the transfer protections in them. Storage and retention are in section 3.

We keep the account email and access dates during the access period and thereafter only as needed for support, disputes, legal records or a documented retention rule. Transaction records may be retained by Paddle under its own policy. The browser cookie remains until its set expiry, you clear it or you replace it. Server, security, email and support records are kept according to the operational schedules of the relevant systems. We limit access to authorised people, use appropriate technical and organisational protections and review suppliers. No system can be guaranteed perfectly secure.

How long a recording is kept, and how it is deleted, is in section 3.

Depending on the law that applies, you may request access, correction, deletion or restriction, object to certain processing, receive portable data, withdraw a consent where that is the basis, and complain to a supervisory authority. We may need to verify your identity and may retain information where law requires it. If birth fields were not retained, we cannot retrieve or delete a server-side member-database copy that does not exist; you can clear the browser cookie. For Paddle payment records, you can also contact Paddle directly. South African requests may be directed to our Information Officer at the email above and complaints to the Information Regulator. EU/UK residents may complain to their local data protection authority.

The app’s birth/profile cookie is used to remember settings and enable the requested reading. We will provide a separate cookie control where a non-essential cookie or analytics technology is deployed. We will update this notice when data flows materially change and date the new version. A future server-stored Journal is not currently available; it will receive a specific notice and controls before launch.

Your browser also remembers two small preferences on this device: whether you have seen the year window, and whether you chose light or dark. Neither is sent to us.