Legal
Privacy policy
Ceiling Co. ("Ceiling", "we", "us") is a Wisconsin company. Ceiling is a platform that coaches, studios and course creators use to run their business: their website, their client app, programs, community, messages, live calls, bookings, payments and email.
This policy explains what we collect, why we collect it, who helps us process it and the choices you have. It covers ceiling.app, the Ceiling apps and every site and app a coach runs on Ceiling.
Our two roles
We hold two kinds of data, and our role is different for each.
- Coach account data. When a coach or business signs up, we collect data about that account, its team and its billing. For this data we are the controller. This policy applies in full.
- Client data. Each coach or business decides what it collects about its own clients and members and why. For that data the coach is the controller and Ceiling is a processor. We process it only to provide the service, on the coach's instructions and under our terms with them.
- Visitors. When you visit ceiling.app, we are the controller of the limited data described below.
If you are a client of a coach who uses Ceiling, the coach's own privacy notice explains how they use your data. Please send your requests to your coach first. We help them answer it. If you contact us, we pass your request to the coach.
What we collect
From coaches and their teams:
- Account data: name, business email, an optional phone number, sign-in codes, two-step verification settings and your role on the team.
- Business data: business name, your Ceiling address, branding, offers, prices, plan, team members and settings.
- Billing data: your plan, invoices and payment status. Card details go straight to Stripe. We never see or store full card numbers.
- Support data: what you tell us when you ask for help.
Client data that coaches or their clients enter:
- Profile and contact details, purchases, subscriptions and bookings.
- Programs, workouts, check-ins, habits, progress, notes and goals.
- Messages, posts, photos, voice notes and videos.
- Health and wellness details a coach chooses to collect, such as readiness, sleep, food logs and photos, cycle and symptom logs, or wearable data. These features are opt-in for the client.
Collected automatically:
- Device and log data: IP address, browser, device type, pages viewed, times and errors.
- Cookies and similar technologies, as described below.
From services you connect, only when you connect them: calendars, Instagram, wearables and Stripe. Each is described below.
How we use it
- To provide the service: sign-in, sites and apps, messages, calls, bookings, payments and email.
- To keep it secure: detect abuse, fraud and attacks, and protect accounts.
- To bill coaches for their plan and the platform fee.
- To support you and tell you about changes to the service or your account.
- To improve Ceiling using usage data that is aggregated or de-identified.
- To comply with the law and enforce our terms.
We do not sell personal data. We do not use client data for our own marketing. We do not use customer content to train AI models.
Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you, our legitimate interests in running and securing the service, your consent (for example, for optional cookies or connecting an account), and legal obligations.
Payments
Payments run on Stripe. Each coach has their own Stripe Connect account, and clients pay the coach directly through it. Ceiling pays its plan fees through Stripe too.
Card numbers are entered into Stripe's own fields and go straight to Stripe. Ceiling never stores card numbers. We receive limited details from Stripe, such as the card brand, last four digits, expiry month and payment status.
Stripe's use of data is described in the Stripe privacy policy.
Messages, voice, video and live calls
Voice notes and videos are stored and streamed by Mux. A written transcript of each recording is made so it can be searched and read. Transcripts stay with the messages after the recording itself is deleted.
By default, voice notes from clients are deleted after 30 days and videos and voice notes from the coach's team after 90 days. Each coach can change these periods to anywhere from 1 to 365 days, and can mark a recording to keep.
Live calls run on LiveKit. Audio and video pass through LiveKit in real time. Calls are not recorded unless the host turns on recording for that call. When they do, everyone is told before and during the call, and clients agree before they join. One-to-one sessions are never recorded. Recordings are private to the coach's team.
Email from Ceiling and from coaches on Ceiling is sent through Postmark. We keep delivery records, such as delivered, bounced or unsubscribed, so mail reaches the right people and unsubscribes are honored.
AI features
Some features use AI from Anthropic: drafting replies in a coach's voice, summing up check-ins, tagging content and similar tasks. Text is sent to Anthropic to do the task and the result comes back to Ceiling.
- We remove names, email addresses and phone numbers where we can before text is sent.
- A draft is never sent to a client until a person on the coach's team approves it.
- Anthropic does not use our customers' data to train its models, under our agreement with it. We do not either.
- Messages are checked for signs of crisis so the coach can be alerted and the client is shown crisis resources.
Calendar connections
Coaches can connect a Google or Microsoft calendar. With your permission we:
- Read the start and end times of events on the calendar you choose, so clients cannot book you when you are busy. We store only the busy times, not event titles or details.
- Read your list of calendars, so you can choose which one sessions go to.
- Write your Ceiling sessions to that calendar, with the session type, the client's name and a link to the session.
You can disconnect at any time. When you do, we delete the stored access token and busy times, and we revoke Google's token.
Ceiling's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we use Google user data only to provide the calendar features you turned on. We do not use it for advertising. We do not sell it or transfer it to others, except as needed to provide those features, for security, to comply with the law, or as part of a merger or sale with notice to you. No person at Ceiling reads it unless you ask us to, it is needed for security or the law requires it. We do not use it to train AI models.
Instagram connection
A coach can connect their own Instagram account through Meta so Ceiling's AI can learn how they write and speak. When connected, we read the coach's own captions and their engagement numbers, the coach's own replies to comments and direct messages, and transcripts of their reels. We never read the other side of a direct message conversation. Instagram handles are replaced before anything is stored.
A connected coach can also publish posts to their own account from Ceiling (images, carousels and reels they upload, with their caption, now or at a time they choose) and set comment to DM rules. When someone comments a keyword the coach chose on the coach's post, Ceiling sends that person one private reply from the coach's account with the coach's message and link. To do that we receive the comment through Meta's webhooks, check it for the keyword, and keep only the comment's id, the commenter's Instagram id and username, the keyword that matched, when it was sent and whether the link was opened. The comment's text is never stored. If the person later signs up on the coach's site after opening the link, the coach sees that the DM led to the sign-up.
The access token is stored encrypted. The coach can disconnect at any time. Removing Ceiling in Instagram's settings stops publishing and replies at once. A data deletion request sent through Instagram deletes the connection, the token, the comment to DM records and the data read from Instagram; the request page shows a confirmation code and its status.
Wearables
When a coach turns on wearables and a client connects a device, we receive data from that device through Junction, a wearables service. This can include activity, workouts, sleep, heart rate and recovery measures. Nothing is collected until the client connects a device, and the client can disconnect at any time. The data is shared with that client's coach.
Meta Pixel and Conversions API
The Meta Pixel and Conversions API are off unless a coach turns them on for their own site. When on, they send page views and purchase events to Meta. They never run on health pages, quizzes, applications or pages with a private link or code, and they follow the consent rules above. The coach is responsible for that use and for its disclosure to their visitors.
How long we keep data
- Coach account and business data: while the account is active.
- After a coach cancels, the account is paused for 90 days so they can download everything or restart. We then delete the business's data. A coach can ask us to delete it sooner, and we do so within 30 days.
- When a client deletes their account, we delete their data 30 days after the request. They can cancel the request before then.
- Media follows the periods in the messages section above.
- Billing and tax records are kept as long as the law requires. They are unlinked from deleted clients.
- Copies in backups are removed as the backups expire.
Client export and deletion
Clients can manage their own data from the privacy page in their coach's app:
- Export: a ZIP of their data, photos and links to their recordings, ready within 24 hours. The download link works for 7 days.
- Delete: they choose whether their posts are removed or kept without their name. Their live subscriptions stop renewing right away, and their data is deleted after 30 days.
Leaving Ceiling
A coach who leaves can use Download everything to take their business with them: clients, programs, content, messages and media. Clients' subscriptions stop renewing at the end of their paid period, and they are told before. Nobody is charged after the coach has gone.
Security
We encrypt data in transit and our providers encrypt it at rest. Access tokens for connected services are kept in an encrypted vault. Each business's data is walled off from every other business's in the database. Staff access is limited, needs two-step verification and is logged.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
Children
Ceiling is not meant for children under 13, or under 16 in the EU, EEA and UK. We do not knowingly collect their data, and coaches may not add them as clients. If you believe a child has given us data, write to privacy@ceiling.app and we will delete it.
International transfers
Ceiling is based in the United States and our providers process data in the United States and other countries. When we transfer personal data out of the EU, EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK addendum or another lawful mechanism.
Your rights in US states
Depending on where you live, including California, Colorado, Connecticut, Virginia, Washington and other states, you may have the right to:
- Know what personal data we collect and how we use and share it.
- Access, correct, delete or get a copy of your data.
- Opt out of the sale or sharing of your data and of targeted advertising. We do not sell personal data.
- Limit the use of sensitive data. We use it only to provide the service.
- Appeal our decision on a request.
- Use these rights without being treated differently.
Health data clients share is processed for their coach and used only to provide the service. You can use an authorized agent to make a request for you.
Your rights under the GDPR
If you are in the EU, EEA, UK or Switzerland, you have the right to access, correct or delete your data, to restrict or object to our use of it, to get a copy in a portable form and to withdraw consent at any time. You can also complain to your local data protection authority.
Making a request
Coaches and visitors can write to privacy@ceiling.app. Clients can use the privacy page in their coach's app, or ask their coach. We verify who you are before acting and answer within the time the law sets, usually 30 or 45 days.
Changes to this policy
We will post any change here and update the date at the top. If a change is significant, we will tell coaches by email or in the app before it takes effect.
Contact
Ceiling Co., a Wisconsin company. Privacy questions: privacy@ceiling.app. Other legal questions: legal@ceiling.app.