This Privacy Policy describes how Leading srl STP ("we", "us", "our"), operating the Calibrate service at calibrateapp.net, collects, uses, and protects information about you when you use our platform.
1. Who we are
The data controller is: Leading srl STP
Via Lazzaretto 1, 20060 Gessate (MI), Italy
Email: carlo@carloperfetto.com
2. Data we collect
We collect the following categories of personal data:
Account data — your email address, hashed password, and professional role (coach, mentor coach, or school/organisation). Collected when you register.
Billing data — name, company, VAT number, and address, collected only if you purchase a paid plan and request invoicing.
Usage data — number of evaluations run, AI model used, token counts, and associated cost. Used for internal analytics and plan management.
Evaluation reports and AI-generated analysis — the structured ICF competency reports, micro-analysis, and annotated transcripts generated by the AI. Stored in your account so you can access your history and work on sessions in Review Mode.
Session transcripts and audio — text or audio you submit for evaluation. These are sent to our AI providers for processing. The original transcript or audio file is not permanently stored in our database; only the AI-generated outputs (report, micro-analysis, annotated transcript) are retained.
Sharing data — when you share an evaluation via link, the name entered by the recipient and the timestamps of when they opened the link and marked their review as done are recorded and visible to you in the app. This data is stored as part of the evaluation record.
Review notes — free-text notes you write in Review Mode, stored in your account.
3. How we use your data
To provide, operate, and improve the Calibrate service.
To manage your account and credits.
To process payments and generate invoices.
To send transactional emails (account verification, password reset, receipts).
To respond to support requests.
To comply with legal obligations.
We do not sell your personal data. We do not use your data for advertising purposes.
4. Legal basis for processing (GDPR)
Contract performance — processing necessary to provide the service you signed up for (Art. 6(1)(b) GDPR).
Legitimate interests — internal analytics and service improvement (Art. 6(1)(f) GDPR).
Legal obligation — invoicing and tax records (Art. 6(1)(c) GDPR).
5. Third-party processors
We share data with the following sub-processors, each bound by their own data processing agreements. Our AI providers are accessed through their secured commercial / paid APIs — never public consumer AI apps — and, under those terms, your content is not used to train their models:
Anthropic (USA) — processes session transcripts to generate ICF competency reports, via Anthropic's commercial API. Under Anthropic's Commercial Terms of Service, customer content is not used to train their models (a binding commitment), and is retained for at most 30 days for abuse-monitoring purposes only, never for training. Data Processing Addendum · Sub-processors ·Privacy policy.
Google (USA) — transcribes and analyses audio recordings via the Gemini API on a paid-tier (commercial) plan. Under the Gemini API terms for paid services, Google does not use your prompts, uploaded files or responses to train or improve its models. Gemini API terms · Privacy policy.
Cloudflare (USA) — hosts the application and stores account and report data in Cloudflare D1 (EU region where available). Privacy policy.
Stripe (USA) — processes payment card data. We do not store card numbers. Privacy policy.
Transfers to the USA are made under Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V.
AI transparency. Coaching sessions submitted to Calibrate are analysed with the assistance of AI, as described above. When you submit a session — your own, or another coach's as a mentor coach or reviewer — you are responsible for informing everyone involved that the recording or transcript will be processed by an AI system, and for holding the necessary consent. This mirrors ICF's guidance on the use of AI in mentor coaching and the transparency obligation of Article 50 of the EU AI Act.
6. Data retention
Account data — retained while your account is active and for 12 months after deletion.
Evaluation reports, micro-analysis, annotated transcripts, and review notes — retained while your account is active. Deleted when you delete your account or when you delete an individual evaluation.
Sharing data (recipient name, open timestamp, completion timestamp) — retained as part of the evaluation record and deleted with it.
Billing records — retained for 10 years as required by Italian tax law.
Original session transcripts and audio files — not stored in our database beyond the duration of the AI processing call. Our AI providers may retain content transiently under their own terms (Anthropic: up to 30 days, for abuse-monitoring only; Google paid tier: per the Gemini API terms) and never use it to train their models.
7. Your rights (GDPR)
If you are based in the EEA, UK, or Switzerland, you have the following rights:
Access — request a copy of the data we hold about you.
Rectification — request correction of inaccurate data.
Erasure — request deletion of your account and associated data (available directly in-app via Account → Danger zone).
Portability — request your data in a machine-readable format.
Objection — object to processing based on legitimate interests.
Restriction — request that we limit processing of your data.
No solely-automated decisions — Calibrate's analysis is a formative, developmental aid, not an automated decision that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. Reports are intended to be reviewed and interpreted by a human mentor coach, who retains judgment over any use made of them; Calibrate takes no automated action on the basis of a report. You may always request human review of, and contest, any output.
Passwords are stored as bcrypt hashes and are never readable by us. All data in transit is encrypted via HTTPS/TLS. Access to the database is restricted to our Cloudflare Worker infrastructure.
9. Cookies & local storage
Calibrate does not use tracking, advertising, or profiling cookies, and loads no third-party analytics scripts. To keep you signed in and remember your session preferences we use your browser's localStorage — a strictly-necessary technology that, under GDPR/ePrivacy, requires no consent banner. Our infrastructure provider, Cloudflare, may set its own strictly-necessary cookies for security and network performance (for example on the admin area protected by Cloudflare Access); these are essential to operate the service and are not used to track you.
10. Children
Calibrate is intended for professional use and is not directed at children under 16. We do not knowingly collect data from minors.
11. Changes to this policy
We may update this policy from time to time. We will notify registered users by email for material changes. The "Last updated" date at the top of this page reflects the most recent revision.