Last updated: 2026-05-01 · Version 1.0

Privacy Policy

Placeholder content for MVP. Final Privacy Policy text is authored by Able's legal counsel and pasted in via the manual version-bump process documented in spec/design/legal.md §17. This v1.0 file is the scaffold the Builder ships so the page renders, the version metadata is wired, and the cookie-consent + data-rights flows can be linked. Operators MUST replace this placeholder before exposing Able to the public.

1. Who we are

Able is a multi-tenant platform that helps practitioners deliver learning, coaching, wellness, mental-health, and similar programs. This Privacy Policy describes how we collect, use, store, and share personal information.

2. Information we collect

Account information — name, email, profile photo, organisation memberships, role.
Practitioner content — programs, components, notes, capability mappings authored within the Service.
Participant records — names, contact details, and program assignments uploaded by practitioners.
Usage data — pages viewed, actions taken, IP address, browser metadata. Used to operate the Service and improve usability.
Cookies — see §5 below.

3. How we use information

To operate, maintain, and improve the Service.
To communicate with you about your account, security notices, or changes to legal terms.
To process payments through Stripe.
To send transactional email via Resend.
To enforce our Terms of Service and applicable law.

4. How we share information

We do not sell personal information. We share data with sub-processors strictly to operate the Service:

Supabase — primary data store and authentication.
Stripe — payment processing.
Resend — transactional email delivery.
Cal.com — calendar and scheduling integration (where enabled by an organisation).
PostHog — product analytics (subject to your cookie consent).

A current list of sub-processors is available on request.

5. Cookies

Able uses cookies in three categories:

Essential — required for authentication, session management, and tenant context. Cannot be disabled.
Analytics — PostHog; helps us understand how the Service is used. EU/UK visitors must opt in; other visitors may opt out.
Marketing — currently inactive; placeholder for future use.

You can update your preferences at any time via the cookie banner.

6. Your rights

Subject to applicable law, you may:

Export your data via the self-service flow at /settings/data-export.
Request deletion of your account and personal data via /settings/account/delete. A 30-day grace period applies.
Update your information at any time from your account settings.

For data-protection inquiries, contact privacy@helloable.co.

7. International transfers

Able stores data in Supabase regions chosen for proximity to its operators. Where data crosses borders, we rely on standard contractual clauses or equivalent transfer mechanisms.

8. Retention

We retain personal information for as long as your account is active and as needed to provide the Service. After account deletion, residual records (financial, audit) are retained in anonymised form where required by law.

9. Children's privacy

The Service is not directed at children under 13. If you believe a child has provided us with personal information, contact privacy@helloable.co and we will delete it.

10. Changes to this policy

We may update this Policy from time to time. Material changes will be highlighted in the Service.

11. Contact

privacy@helloable.co · support@helloable.co