Privacy Policy

Coachbot, operated by Replicants.ai · Last updated: 5 August 2026

This Privacy Policy explains how Replicants.ai ("Replicants", "we", "us") collects, uses, stores, and shares information when you use Coachbot and its associated services at coach.replicants.ai (the "Service"). It includes specific disclosures about our use of Google user data, as required by the Google API Services User Data Policy.

1. Who we are

Coachbot is a business software platform that helps businesses engage their customers and run marketing, including the optional ability to create and manage advertising campaigns on connected advertising accounts (such as Google Ads) on the business's behalf, and the optional ability to connect a calendar (such as Google Calendar) so that clients can book sessions.

2. Information we collect

Account information

When you create an account we collect information such as your name, email address, business details, and authentication credentials. We also collect content you create in the Service and operational data (log data, device/browser information, and usage events) needed to run and secure the platform.

Google account data (advertising features)

If you choose to connect a Google Ads account, we ask your permission through Google's OAuth consent screen for the following scope:

https://www.googleapis.com/auth/adwords — manage your Google Ads campaigns.

With your authorization, and only for the Google Ads account you explicitly select, we access:

The list of Google Ads accounts your Google login can access, so you can choose which one to connect;
Account details (name, currency) for the account you select;
Campaigns, ad groups, conversion actions, and performance metrics, in order to create, read, and manage advertising on your behalf;
The ability to create conversion-tracking configuration and campaigns (always created paused, so nothing spends until you activate it).

We receive an OAuth refresh token from Google that lets the Service perform these actions on your behalf until you disconnect. We do not receive your Google password.

Google account data (calendar features)

If you choose to connect a Google Calendar so that your clients can book sessions with you, we ask your permission through Google's OAuth consent screen for the following scopes:

https://www.googleapis.com/auth/calendar.freebusy — read only whether you are busy or free at a given time.

https://www.googleapis.com/auth/calendar.calendarlist.readonly — read the list of your calendars, so you can choose which one we check.

https://www.googleapis.com/auth/calendar.app.created — create and manage events in a calendar that this application creates.

With your authorization, and only for the calendar you explicitly select, we access:

Free/busy times only — the times you are already committed, so a client cannot book a session on top of an existing appointment. We do not read the titles, descriptions, locations, attendees, or any other content of your existing events;
The names of your calendars, so you can choose which one we check;
Events in a separate calendar that this application creates, so that sessions booked through the Service appear in your diary and are removed if a session is cancelled.

The calendar.app.created scope is deliberately the narrowest write permission Google offers: it allows us to create and manage events only in a calendar our own application created. We cannot read, modify, or delete any of your existing calendars or their events.

As with advertising, we receive an OAuth refresh token that lets the Service perform these actions until you disconnect, and we do not receive your Google password. Refresh tokens are encrypted at rest.

3. How we use information

To provide, operate, and improve the Service you requested;
To create and manage advertising campaigns, conversion tracking, and reporting on the connected advertising account you selected;
To show your clients when you are available, and to place booked sessions into a calendar this application creates;
To authenticate you, secure the platform, prevent abuse, and provide support;
To communicate with you about the Service.

We do not use Google user data for advertising to you, and we do not sell Google user data.

Limited Use disclosure (Google API Services User Data Policy)

Coachbot's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google Ads API scopes is used solely to provide and improve the advertising features you request, and data obtained through Google Calendar API scopes is used solely to provide the scheduling and booking features you request; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising; and no humans read this data except where required for security, to comply with applicable law, with your explicit consent, or in aggregated/anonymized form for internal operations.

4. How we share information

We share information only as needed to run the Service:

With Google's APIs, to perform the advertising and calendar operations you authorized;
With service providers (sub-processors) such as cloud hosting and infrastructure vendors that process data on our behalf under contract;
To comply with law or protect the rights, safety, and security of our users and the Service;
In a business transfer, such as a merger or acquisition, subject to this policy.

We do not sell your personal information or your Google user data.

5. Storage, security, and retention

Data is transmitted over encrypted connections (TLS). OAuth refresh tokens are stored encrypted at rest using AES-256-GCM. Access to production systems is restricted and audit-logged. We retain information for as long as your account is active or as needed to provide the Service, and thereafter as required for legitimate business or legal purposes.

6. Your choices and how to revoke access

You can disconnect a connected Google Ads account at any time from within the Service (Settings → Ad accounts → Disconnect), and a connected calendar at any time from your course's 1:1 settings (Disconnect calendar). Disconnecting revokes our access and deletes the stored token. You may also revoke access directly at myaccount.google.com/permissions. To request deletion of your account data, contact us at the address below.

7. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

8. International users

We may process and store information in countries other than your own. Where required, we rely on appropriate safeguards for cross-border transfers.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.

10. Contact us

Questions about this policy or your data? Email support@replicants.ai.