Join the waitlist

Trust

GDPR and your data

You have the right to see, take, correct and delete your personal data. This page explains how to do each in Ceiling, the terms we follow when we process data for coaches, and who helps us process it.

It sits alongside our privacy policy. Questions go to privacy@ceiling.app.

Who is responsible

A coach or business on Ceiling decides what it collects about its clients and why. For client data the coach is the controller and Ceiling is the processor. For a coach's own account and billing data, and for visitors to ceiling.app, Ceiling is the controller.

If you are a client, your coach answers your requests. You can also do most things yourself, as described below.

See and take your data

  • Clients: open Profile, then Privacy, in your coach's app and choose Prepare my download. You get a ZIP of your answers, logs, messages, posts and photos in JSON and CSV, with links to your recordings. It is ready within 24 hours and the link works for 7 days.
  • Coaches: open Settings, then Exports. Download everything puts your whole business in one file: clients, offers, programs, content, messages and more. Single CSV exports of programs, training history, check-ins and members are on the same page.

Correct your data

  • Clients: open Profile to change your name, contact details, time zone and the answers you gave your coach.
  • Coaches: change your business details in Settings. Your clients can correct their own details, and you can correct the client records you keep.

If something is wrong and you cannot change it yourself, write to privacy@ceiling.app.

Delete your data

  • Clients: open Profile, then Privacy, and choose Close my account. You choose whether your posts are removed or kept without your name. Subscriptions stop renewing at the end of the current period, and your data is deleted 30 days after you ask. You can keep your account any time before then.
  • Coaches: cancel your account on the Plan page. When the paid period ends, your app pauses for 90 days so you can download everything or restart, and then your business's data is deleted. To delete sooner, choose Delete my data now while paused, and we delete it within 30 days.

We keep payment and tax records for as long as the law requires, unlinked from deleted clients. Copies in backups are removed as the backups expire.

Your other rights

You can also restrict or object to how we use your data, and withdraw consent at any time, for example by disconnecting a connected service or declining optional cookies. Write to privacy@ceiling.app for anything you cannot do in the product. We verify who you are before acting and answer within one month. You can complain to your local data protection authority.

Data processing terms for coaches

When Ceiling processes client data for a coach, we act as the coach's processor under Article 28 of the GDPR. Our terms of service and these commitments form the data processing agreement between us:

  • We process client data only to provide Ceiling and on the coach's documented instructions, which are the coach's settings and use of the product.
  • People at Ceiling who can reach client data are bound to keep it confidential.
  • We protect client data with the measures on our security page.
  • We use the subprocessors listed below, under written terms that protect the data at least as well. We will tell coaches before adding or replacing one, so they can object.
  • We help coaches answer their clients' requests, largely through the export and deletion tools above.
  • We tell coaches without undue delay if a breach affects their clients' data.
  • When a coach leaves, they can download everything, and we then delete their business's data as described above.
  • We give coaches the information they need to show we meet these terms.

To sign a separate data processing agreement, write to privacy@ceiling.app.

Subprocessors

These services process personal data for Ceiling:

  • Supabase. Database, sign in and file storage.
  • Vercel. Hosting for every site and app.
  • Stripe. Payments and payouts.
  • Postmark. Email delivery.
  • Mux. Storing and streaming voice notes and videos, and their transcripts.
  • LiveKit. Live calls.
  • Anthropic. AI features.

These only receive data when a coach connects them:

  • Google. Calendar connection.
  • Microsoft. Calendar connection.
  • Meta. Instagram connection, and the Meta Pixel when a coach turns it on.

International transfers

Ceiling is based in the United States, and our subprocessors process data in the United States and other countries. When personal data leaves the EU, EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK addendum, or another lawful mechanism.

Contact

Ceiling Co., a Wisconsin company. Privacy and data protection: privacy@ceiling.app.