Privacy
California Privacy Notice
Effective: August 4, 2026 — California Consumer Privacy Act (CCPA / CPRA)
California residents may opt out of the sale or sharing of personal information:
Notice at collection
This notice applies to California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). PauseTools applies these protections globally — to all users regardless of location — consistent with our commitment to treating privacy as a baseline, not a jurisdiction-specific accommodation.
This notice describes the categories of personal information we collect, the purposes for which we use it, the sources from which it comes, the third parties with whom we share it, how long we retain it, and the rights you have over it.
Categories of personal information collected
We collect the following categories of personal information when you use PauseTools:
| Category | Examples |
|---|---|
| Identifiers | Name, email address |
| Conversation content | The text of your coaching conversations with Jam, including your Biggest Challenge message at onboarding and all subsequent turns |
| Professional context | Role, team size — collected optionally at onboarding and editable from account settings |
| Internet and network activity | IP address (hashed before storage), browser type, operating system |
| Usage and interaction data | Pauses explored, practice attempts recorded, coaching turns per session, session timestamps |
| Purchase and access data | Order identifier, product SKU, access code assigned |
Sources of personal information
We collect personal information from the following sources:
- Directly from you — when you create an account, complete onboarding, and hold coaching conversations with Jam.
- Your browser and device — IP address, browser type and version, operating system, and session metadata collected automatically when you access the service.
- Our purchase webhook partner — when you purchase the book or an event package, the purchase platform transmits your name, email, order identifier, and product SKU to us via a signed webhook to provision your access code.
Purposes for which we use personal information
- Account access — to create and authenticate your account, deliver your access code, and manage your session.
- AI coaching — to provide a persistent, contextually-grounded coaching conversation with Jam, including assembling context from prior turns and retrieving relevant passages from Pause.
- Fraud prevention — to detect and prevent abuse of the access code system, including rate limiting, lockout enforcement, and redemption-attempt logging.
- Product improvement — to monitor coaching quality, sample AI-generated responses for accuracy and brand-boundary compliance, and aggregate anonymised usage metrics for internal analysis.
- Customer support — to respond to your inquiries and resolve account or access issues within our 24-hour SLA.
Third-party recipients and service providers
We share personal information with the following third-party service providers to operate the service. These providers act as service providers or processors under applicable law — they do not sell your data and are contractually bound to use it only to provide services to us:
| Provider | Role | Data shared |
|---|---|---|
| Anthropic | Large language model (LLM) provider | Coaching conversation content sent to the API to generate Jam's responses. Anthropic retains data for up to 30 days for abuse monitoring under their standard API tier. |
| Voyage AI | Embeddings provider (RAG retrieval) | Coaching conversation content encoded as vector embeddings for semantic retrieval against the Pause corpus. Used only for retrieval — not for model training. |
| Resend | Transactional email provider | Email address and name (where available) for welcome, access code, and notification emails. |
| Supabase | Database and authentication infrastructure | All account data, conversation content, and usage records are stored in Supabase-hosted Postgres. Supabase provides AES-256 at-rest encryption and does not access your data for its own purposes. |
| Vercel | Application hosting and edge network | Request logs (IP address, user agent, HTTP status) are processed by Vercel's edge infrastructure. Data is processed in accordance with Vercel's data processing agreements. |
We do not sell or share personal information with data brokers, advertising networks, or third parties for cross-context behavioral advertising purposes.
Retention periods
We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law:
| Data category | Retention period |
|---|---|
| Account profile (name, email, role, team size) | Indefinitely while your account is active; deleted within 30 days of account deletion request |
| Coaching conversation content (messages, citations) | Indefinitely while your account is active; deleted on account deletion; automatically swept after 24 months of inactivity |
| Practice attempt records | Indefinitely while your account is active; deleted on account deletion |
| Usage analytics (Pause exploration, session metadata) | Indefinitely while your account is active; deleted on account deletion |
| AI response logs (model, tokens, latency) | 90 days in raw form; aggregated (non-identifiable) for 1 year; deleted on account deletion |
| Consent records | 3 years from consent grant or account deletion (legal compliance) |
| Admin audit log entries | 7 years (legal compliance); actor identity nulled on account deletion, record preserved |
| IP addresses | Never stored in raw form — SHA-256 hashed before persistence; deleted on account deletion |
| Anthropic vendor-side retention | Up to 30 days on Anthropic's servers under their standard API tier abuse-monitoring policy; disclosed at deletion |
Your rights under California law
California residents have the following rights under the CCPA / CPRA:
Right to know and access
You have the right to request that we disclose what personal information we have collected about you, including the categories, sources, purposes, and third parties with whom it has been shared. You may export your data at any time from your account settings.
Right to delete
You have the right to request deletion of your personal information. We will delete your account and all associated data — including conversation content, practice records, and usage analytics — in a single cascading operation. Some information may be retained for legal compliance (e.g., consent records for 3 years, audit logs for 7 years).
Right to portability
You have the right to receive a copy of your personal information in a portable, machine-readable format. Request a JSON export from your account settings.
Right to opt out of sale or sharing
You have the right to opt out of the sale or sharing of your personal information. We do not sell personal information. To the extent any data sharing with service providers could be construed as a “sale” or “sharing” under the CCPA, you may submit an opt-out request below.
Right to correct
You have the right to correct inaccurate personal information. Update your name, role, and team size at any time from your account profile settings.
Right to non-discrimination
Exercising your privacy rights will not result in you receiving a different level of service, being denied access, or being charged a different price. Opting out of sale or sharing has no effect on your coaching experience.
How to exercise your rights
Most rights are self-serve from your account settings (data export, profile correction, account deletion). For formal Data Subject Access Requests or other privacy inquiries, contact us at privacy@pausetools.ai. We will respond within 45 days as required by the CCPA.
Contact
PauseTools (pausetools.ai)
Privacy inquiries: privacy@pausetools.ai
General support: support@pausetools.ai
California residents: opt out of the sale or sharing of personal information: