Privacy Policy

1. Who We Are

Paulo Technologies Inc. ("Paulo," "we," "us," or "our") operates a behavioral signal platform designed to support employee well-being and team health. Our platform is built on a foundational commitment: what you share stays with you.

This Privacy Policy explains what personal data we collect, why we collect it, how it is used and protected, and what rights you have over it.

2. Who This Policy Applies To

This Policy applies to:

• Individual users (employees completing check-ins)
• Managers receiving aggregated team summaries
• Organizational administrators
• Visitors to our website

3. What Data We Collect

We collect only the minimum data necessary to operate the platform. We do not engage in passive monitoring of any kind.

A. Account Information

• Full name
• Work email address
• Role (Individual Contributor, Manager, or Administrator)
• Team assignment

B. Check-In Data

When you submit a check-in, we collect:

• Your selected Signal State (e.g., Clear, Tense, Scattered)
• Your selected Influencing Domain (e.g., Workload & Pressure, Personal Well-being)
• Optional written reflection (up to 1,000 characters)
• Optional voice reflection (up to 3 minutes)

All check-in data is voluntarily submitted. You are never required to provide a written or voice reflection.

C. Usage Data

• Check-in frequency
• Engagement with coaching prompts
• Weekly summary views
• Email or push notification interactions

What We Do Not Collect

We do not collect, access, or infer data from:

• Calendar content or metadata
• Email content
• Meeting transcripts or recordings
• Keystroke or screen activity
• Productivity or output metrics
• Passive tone or sentiment signals

Paulo processes only what you intentionally provide.

4. How We Use Your Data

For Individual Users

Your check-in data is used exclusively to:

• Generate a personalized micro-coaching response
• Identify recent signal patterns (based on your last 3–5 check-ins)
• Deliver weekly momentum summaries

Your individual reflections, signal history, and check-in content are never shared with your manager, HR, or your organization's administrators.

For Managers

Managers receive team-level summaries only. These summaries are generated when five (5) or more team members complete check-ins within a reporting window. This threshold is a structural privacy protection, not a setting that can be adjusted.

Team summaries include:

• Average Signal State score across the team
• Trend indicators over time
• Aggregated keyword pattern clusters
• Suggested coaching prompts

Managers never have access to:

• Individual check-in responses
• Individual written or voice reflections
• Any individual's signal history

5. Our Privacy Architecture

Paulo is structurally designed to prevent surveillance or punitive use. Three protections are built into the platform and cannot be disabled by your employer:

These are architectural controls, not policy preferences. Your employer cannot purchase or configure access to individual-level data.

6. AI Processing

Paulo uses AI systems, including third-party APIs (currently OpenAI), to generate coaching prompts and pattern insights.

Our commitments regarding AI use:

• No automated psychological profiling
• No diagnostic or clinical labeling of any kind
• No tone-based inference from your written or voice content
• No passive behavioral monitoring

Optional reflections may be temporarily processed to generate a coaching response. Your data is not used to train publicly available AI models.

7. Data Storage and Security

We implement industry-standard security controls, including:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Secure cloud infrastructure (AWS or GCP)
• Role-based access controls
• Restricted internal access on a need-to-know basis

We do not sell your data. We do not use your data for advertising. We do not share identifiable data with third parties outside of the service providers necessary to operate the platform.

8. Data Retention

• Account data is retained while your account is active.
• Check-in data is retained to support your personal trend history and coaching continuity.
• Upon organizational termination of service, data may be deleted within 30 days, unless otherwise required by contract or applicable law.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of your account and associated data
• Withdraw consent at any time
• Request data portability
• Lodge a complaint with the relevant data protection authority in your jurisdiction

To exercise any of these rights, contact us at: privacy@paulocoach.ai. We will respond to verifiable requests within the timeframes required by applicable law.

10. Organizational Data Ownership

Client organizations retain ownership of aggregated, anonymized organizational data generated through use of the platform. Paulo does not:

• Resell organizational data to third parties
• Use identifiable data for cross-client benchmarking without prior anonymization
• Transfer identifiable user data outside of the service relationship

11. Legal Compliance

Paulo is committed to compliance with:

• GDPR (General Data Protection Regulation)
• CCPA (California Consumer Privacy Act)
• PIPEDA (Canada's Personal Information Protection and Electronic Documents Act)

We apply data minimization principles across all processing activities.

12. Children

Paulo is not intended for individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platform, contact us immediately at privacy@paulocoach.ai.

13. Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you via in-app notification or email at least 30 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated Policy.

14. Contact