Privacy Policy

At Stoic, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We are committed to protecting the confidentiality of your personal information and ensuring that your data is handled responsibly. Please read this policy carefully to understand our practices.

We use collected information to:

• Provide, maintain, and improve our services
• Generate Timeline insights for coaches (with client consent)
• Process payments and manage accounts
• Communicate with you about updates, features, and support
• Analyze usage patterns to enhance user experience
• Ensure platform security and prevent fraud
• Comply with legal obligations
• Train and improve our AI systems (using anonymized, aggregated data only)

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Strict role-based access with multi-factor authentication for staff
• Regular Audits: Third-party security assessments and penetration testing
• Secure Infrastructure: Hosted on SOC 2 Type II certified cloud providers
• Monitoring: 24/7 security monitoring and incident response

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to industry best practices.

Where applicable, Stoic maintains compliance with the Health Insurance Portability and Accountability Act (HIPAA). This includes:

• Business Associate Agreements (BAAs) with applicable partners
• Administrative, physical, and technical safeguards for protected health information
• Regular risk assessments and compliance audits
• Employee training on HIPAA requirements

Coaches operating as covered entities should contact us to execute a Business Associate Agreement.

We retain your data according to the following guidelines:

• Account Data: Retained while your account is active and for 30 days after deletion request
• AI Conversation Data: Retained for 2 years or until you delete it, whichever is sooner
• Timeline Data: Same as AI conversation data
• Payment Records: Retained for 7 years for legal and tax compliance
• Usage Analytics: Anonymized data may be retained indefinitely

We work with trusted third-party services to operate our platform:

• Cloud Hosting: For secure data storage and processing
• Payment Processing: To handle transactions securely
• Analytics: To understand platform usage (anonymized)
• Communication: For email and notifications
• AI Infrastructure: To power the AI Companion

All third-party providers are vetted for security and privacy practices. We maintain Data Processing Agreements where required.

We use cookies and similar technologies for:

• Essential Cookies: Required for platform functionality (authentication, security)
• Analytics Cookies: Help us understand usage patterns (can be disabled)
• Preference Cookies: Remember your settings and preferences

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect platform functionality.

Stoic is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

If you believe a child has provided us with personal information, please contact us at daria@cherniakk.com.

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules for internal transfers

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new policy on this page with an updated "Last updated" date
• Sending you an email notification for significant changes
• Displaying a notice within the platform

Continued use of the Service after changes constitutes acceptance of the updated policy.