Privacy Policy

3GOaTs ("3GOaTs," "we," "us") is an AI-powered goal-coaching service operated by Velkor Projects Ltd., based in British Columbia, Canada. This Privacy Policy explains what personal information we collect, why we collect it, how it is used and shared, how we protect it, and the choices and rights you have. It applies to the 3GOaTs website and application at 3goats.ai.

We have written this policy to be read by a human, not just a lawyer. If anything here is unclear, contact us at hello@3goats.ai.

1. The short version

We collect what you give us (your account details, your goals, the things you tell your coach, and the "pack" of skills, resources, and people you choose to record) and a small amount of technical and usage data.
We use it for one purpose: to provide and improve your coaching experience inside 3GOaTs.
Only you can see your own content in your personal world. If you join a team or organisation, the work you do in that world is visible to its members, and the organisation — not you — owns its Regions. Your personal world stays private and is never visible to an employer.
We do not sell your personal information, and outside the shared worlds you join we do not share your content with other users.
To generate coaching replies, your messages are processed by our AI provider (Anthropic) under terms that do not permit using your data to train AI models.
You can access and change your information, ask us for a copy, or ask us to delete it.
We are a Canadian company; your data is currently stored in the United States (see Section 7).

The detail follows.

2. Who we are and how to reach us

The data controller is Velkor Projects Ltd. (British Columbia, Canada). For any privacy question or request, contact: privacy@3goats.ai. We are the point of contact for access, correction, and deletion requests. For anything else, hello@3goats.ai reaches us.

3. Eligibility / age

3GOaTs is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we flag the account and may suspend or remove it and delete the associated data. If you believe a minor has provided us information, contact hello@3goats.ai.

4. What we collect

We collect the following categories of personal information:

a) Information you provide directly

Account: email address, display name, time zone.
Coaching profile: your working/communication style indicators (e.g., a DISC-style position), your stated values, your chosen Regions and related preferences, and the coach you select.
Your "Pack" (capital): skills, resources, and people you choose to record to support your goals. The "people" you add may include information about third parties (for example, a mentor's name, role, or your notes). Only add information about other people that you are comfortable recording; it is visible only to you.
Goals and activity: the goals, objectives, tasks, and "needs" you create, including any free-text you write.
Coaching conversations: the messages you exchange with your AI coach.
Optional profile details: social profile links you choose to supply (we do not scrape or pull data from those links).

b) Information created as you use the service

Progress and engagement data (e.g., streaks, completion, onboarding status).
Notification preferences and send history.
Safety signals and crisis records. Our system reviews coaching conversations for signs of distress or crisis. Where it detects them, we record the signal, its assessed level, and the surrounding conversation, and — for higher-severity signals — we notify our safety team so a person can review it. This is described in full in our Safety page.
Usage and cost-metering related to AI calls (e.g., token counts and estimated cost), used to operate and protect the service.

c) Technical information

Standard data your browser/device sends (e.g., IP-derived region, device/browser type) and data needed to authenticate you and keep the service secure and reliable.

Free-text caution: Some fields (your goals, your "needs," and your coaching conversations) are open text. You may choose to write sensitive information there. We do not ask you to, and we recommend sharing only what helps your coaching.

What we do NOT collect: We do not collect government identifiers (e.g., SIN/SSN), full date of birth, payment card numbers as profile data, medical records, or dedicated fields for religion, health conditions, or sexual orientation. (Note: payment processing, when introduced, will be handled by a third-party payment processor and covered by an updated version of this policy.) We do not have dedicated health fields; however, safety signals and crisis records described above may relate to your wellbeing, and we treat them with the same care as sensitive information.

5. Why we use your information (purposes), and our lawful bases

We use your information to:

Create and maintain your account and authenticate you.
Provide the core service: generate personalized coaching, track your goals and progress, and render your Pack.
Detect signs of distress or crisis in coaching conversations, surface crisis resources, and have our safety team review higher-severity signals — so that a person in difficulty is directed to real help. This is separate from the abuse monitoring described below, which protects the service rather than the user.
Send notifications you have enabled (nudges, check-ins, summaries).
Operate, secure, debug, and improve the service, including cost and abuse monitoring.
Comply with legal obligations.

Where GDPR applies, our lawful bases are: performance of a contract (providing the service you signed up for), your consent (for optional data and notifications, which you can withdraw), our legitimate interests (securing and improving the service, in a way that does not override your rights), and legal obligation. For safety signals and crisis review, our lawful basis is our legitimate interest in protecting the vital interests and wellbeing of our users, and — where the information concerns health — Article 9(2)(c) where a vital interest is engaged. Under PIPEDA, we rely on your consent, which may be express or implied by your use of the service for the purposes described here.

We do not use your personal information for advertising, and we do not sell it.

6. How AI coaching works (important)

3GOaTs generates coaching using AI models provided by Anthropic via its commercial API. When you interact with a coach, the relevant content (such as your message and the context needed to respond) is sent to Anthropic to generate a reply.

Anthropic's commercial API terms provide that data submitted through the API is not used to train Anthropic's models.
Anthropic may retain API data for a limited period for trust-and-safety purposes and then deletes it; Anthropic acts as our sub-processor for this processing.
Your coaching content is processed to produce your response — it is not used to build advertising profiles, and it is not shared with other users.

This processing is necessary to provide the coaching service. If you do not want your content processed this way, do not submit it to the coach.

7. Where your data is stored (international transfer)

Our database is hosted on Supabase, currently in a United States region (Oregon). Our application hosting (Vercel) and email delivery (Resend) providers, and our AI provider (Anthropic), may also process data in the United States. If you are located in the EU/EEA/UK, this means your personal information is transferred to and stored in the United States. Where required, such transfers rely on appropriate safeguards (such as standard contractual clauses with our providers). We will update this section if we add regional data storage.

8. Who we share it with

We do not sell your personal information. Outside the shared worlds you join — where your work in that world is visible to its members, as described in Section 1 — we do not share your content with other users. We share data only with service providers ("sub-processors") who help us run 3GOaTs, under contracts that limit their use of the data to providing services to us:

Supabase — database, authentication, and storage.
Anthropic — AI coaching generation (see Section 6).
Vercel — application hosting and related analytics/operations.
Resend — transactional email (notifications you enable).

We may also disclose information if required by law (e.g., valid legal process), to protect safety or our rights, or in connection with a business transfer (e.g., merger or acquisition), in which case we will notify you and this policy will continue to apply or be superseded by one at least as protective.

9. How we protect your information

Your content is protected by database-level access controls (row-level security) so that your records are accessible to your authenticated account and to the members of any shared world you have joined, at the depth that world grants — no other user can access your data.
Access by our team is limited to what is necessary to operate, support, and secure the service (for example, administrative and server processes that run the application, and support access at your request or where required by law). We do not browse your private content for any other purpose.
We use reputable infrastructure providers and industry-standard transport encryption.

No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

10. How long we keep it

We keep your personal information for as long as your account is active and as needed to provide the service. If you delete specific content, it is removed from your active records. If you close your account or request deletion, we delete or de-identify your personal information within a reasonable period, except where we must retain certain data to comply with legal obligations, resolve disputes, or enforce our agreements. Our AI provider's limited trust-and-safety retention is described in Section 6.

11. Your rights and choices

Depending on where you live (PIPEDA, GDPR, and CCPA/CPRA provide overlapping rights), you have the right to:

Access the personal information we hold about you and learn how it is used.
Correct inaccurate or incomplete information (you can edit much of this directly in the app).
Delete your personal information ("right to erasure").
Obtain a copy / portability of information you provided, in a usable format.
Withdraw consent to optional processing (e.g., turn off notifications) at any time.
Object to or restrict certain processing (GDPR).
For California residents: the rights to know, delete, correct, and to not be discriminated against for exercising your rights. We do not sell or "share" personal information as those terms are defined under California law.

To exercise any right, email privacy@3goats.ai. We will verify your request (to protect your account) and respond within the timeframe required by applicable law (generally 30 days under PIPEDA/GDPR; 45 days under CCPA, extendable). You will not be charged for reasonable requests, and exercising your rights will not degrade your service. If you are in the EU/EEA/UK you may also lodge a complaint with your local data protection authority; in Canada, with the Office of the Privacy Commissioner.

12. Cookies and analytics

We use cookies and similar technologies that are strictly necessary to run the service (such as keeping you signed in) and a limited amount of analytics to understand and improve usage. Where required (e.g., for EU users), we ask for your consent before setting non-essential cookies, and you can change your choice at any time.

13. Children

See Section 3 — the service is for adults 18+, and we do not knowingly collect data from minors.

14. Changes to this policy

We may update this policy as the service evolves or the law changes. We will post the new version here with an updated "Last updated" date and, for material changes, provide a more prominent notice. Continued use after an update means you accept the revised policy.

15. Contact

Velkor Projects Ltd. — privacy contact: privacy@3goats.ai. General contact: hello@3goats.ai.