This Privacy Policy explains what personal data Combat Ready OÜ (“Combat Ready”, “we”, “us”) processes when you use the Combat Ready training environment, why we process it, and the rights you have. The lead-qualification chat on our marketing site is a separate service with its own privacy notice.
Who we are
The data controller is Combat Ready OÜ, registry code 16348509, Öö tn 2-4, 50103 Tartu, Estonia. For any privacy question or request, contact us at app@combatready.eu.
What data we collect and why
| Category | Examples | Purpose | Legal basis (GDPR Art 6) |
|---|---|---|---|
| Account data | name, email address, Google/Clerk sign-in identifier | create and secure your account, sign you in | Contract (Art 6(1)(b)) |
| Conversation content | your messages to the trainer, the situations you describe, debriefs and drafts | deliver the training service and keep your sessions continuous | Contract (Art 6(1)(b)) |
| Technical & location | IP address and the country/city derived from it, basic device/browser data | set your language, prevent abuse, keep the service secure | Legitimate interest (Art 6(1)(f)) |
| Contact & enquiry data | name, email, organization, role, what you need | respond to your enquiry and follow up | Consent / legitimate interest (Art 6(1)(a)/(f)) |
| Support tickets | subject, description, the messages you exchange with us, the in-app page the ticket was opened from | answer your support requests and track their resolution | Contract (Art 6(1)(b)) |
| Service emails | your email address; a record of which service emails we sent you, when, and whether they were delivered (not their content) | tell you when something happens with your own activity — for example that your support request has a reply or that you have been given access. These emails carry a notice and a link, never the content itself, and you can switch them off one by one under Notifications in your account (except the few that protect you, such as a warning that your access is about to end) | Contract (Art 6(1)(b)) |
| News and offers | your email address; the moment you switched these emails on | write to you when sales open, a new course arrives or something new is waiting for you — only if you have switched this on under Notifications in your account; off by default, and you can switch it off again at any time | Consent (Art 6(1)(a)) |
| Billing & payment data | billing name and address, email, a business VAT number, the type and last four digits of your payment method, invoices and payment history — entered and held on Stripe’s pages | take payments, issue invoices, calculate VAT, manage your subscription | Contract (Art 6(1)(b)); legal obligation — accounting (Art 6(1)(c)) |
| Usage analytics | page views and product events (via PostHog, cookieless) | understand and improve the product | Legitimate interest (Art 6(1)(f)) |
| Calendar (only if you connect your Google Calendar) | the times your primary calendar is busy; and, if you also allow it on Google’s consent screen, its events — title, start and end, whether all-day or recurring, the number of attendees (not who they are), whether you declined and whether you marked the event private (a private event’s title is not kept), and its description with links, dial-in numbers and passcodes removed (a private event’s description is not kept) — never places, attachments or attendees’ names or addresses; plus the Google account address you connected, an encrypted refresh token (the long-lived key that lets us keep reading your calendar until you disconnect), when it was last read and whether Google has stopped accepting it; and, with the same permission, which of your Board’s lines with a time we wrote into your calendar (the line, its time and the event’s id there) | show on your Board’s day and week what is already booked, and what it is; in the Plan setup, show where your time went over the last 30 days and suggest your roles and initiatives from it; put your Board’s lines with a time into your primary calendar as events (the line’s text, its time and a link back to the Board), and move or delete them when you move or delete the line | Consent (Art 6(1)(a)); you can disconnect at any time |
Please don’t enter other people’s data. We ask you not to enter information that identifies other individuals, or special-category data (health, political opinions, religion, and the like). When a situation involves someone else, describe them generally (“a team member”) rather than by name. Combat Ready is a tool for your own development, not a place to keep records about third parties.
How we use your data
- Provide the AI-assisted training service and keep your sessions continuous.
- Maintain your account, authenticate you, and keep the service secure.
- Respond to enquiries and provide support.
- Take payments, issue invoices and manage your subscription.
- Understand product usage in aggregate and improve the service.
- Meet our legal and accounting obligations.
We do not use your conversations to advertise to you, and we do not sell your personal data.
Sharing and sub-processors
We share personal data only with a small set of trusted service providers (processors) that help us run the service, each under a data processing agreement and only as far as they need it. These fall into a few categories: cloud hosting and database, authentication, product analytics, email delivery, and payments.
One is worth naming directly: the trainer’s responses are generated by Anthropic (the Claude API), so your conversation content is sent to Anthropic for processing, including in the United States under EU Standard Contractual Clauses. Your input is not used to train Anthropic’s models.
Payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland, together with other Stripe group companies). When you buy a plan you enter your billing details and payment method on Stripe’s own checkout page: Stripe takes the payment, keeps your payment method on file for the recurring charges, calculates VAT, checks a business VAT number and issues the invoice. Your card details never reach us — our own systems keep only a reference to your Stripe customer, subscription and invoices, the periods and amounts you have paid, and the record that you ticked the consent box at checkout. For fraud prevention and its own legal obligations Stripe processes some of this data as an independent controller; see Stripe’s privacy policy at stripe.com/privacy.
We do not sell personal data or share it for third-party advertising. A current list of our sub-processors is available on request at app@combatready.eu.
International transfers
Some processing — the AI responses generated by Anthropic, and parts of Stripe’s payment processing — takes place outside the European Economic Area, including in the United States. For those transfers we rely on the European Commission’s Standard Contractual Clauses together with additional safeguards; Stripe’s own transfer safeguards are described in its privacy policy.
How long we keep it
| Data | Retention |
|---|---|
| Account and conversation data | until you delete your account |
| Contact & enquiry data | until you withdraw your consent or ask us to delete it |
| Invoices and payment records | 7 years from the end of the financial year they belong to (Estonian Accounting Act), also after your account is deleted |
| Analytics | kept in aggregated / de-identified form |
| Calendar | busy times are not stored — read live for the two weeks on screen; events up to 13 months back, deleted at once when you disconnect; the connection itself (account address and encrypted token) until you disconnect or your account is deleted; the events we wrote into your calendar are yours and stay there after you disconnect — delete them in Google Calendar if you want them gone |
If you connect Google Calendar, Combat Ready’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you go through the Plan setup, the titles, times, number of attendees and descriptions of your last 30 days’ events are sent to Anthropic (the Claude API) so that it can suggest your roles and initiatives for you to correct; it is used for nothing else, not to train AI models. Nothing read from your calendar is sent to the AI coach, used for advertising or shared with anyone else. We write into your calendar only your own Board’s lines with a time, and change or delete only the events we wrote.
Cookies
We use only strictly necessary cookies, so we don’t show a cookie-consent banner:
cr.locale— remembers your language choice.- Clerk session cookies — keep you signed in.
cr_join_slug— carries a shared-link invitation through to sign-up.
Our product analytics (PostHog) run in cookieless mode. We do not use advertising or third-party tracking cookies.
The checkout and the subscription portal are pages hosted by Stripe on its own domain; there Stripe sets its own cookies for security and fraud prevention, under Stripe’s cookie policy.
Your rights
Under the GDPR (Art 15–22) you have the right to:
- access the personal data we hold about you;
- have it corrected or completed;
- have it erased (“the right to be forgotten”);
- restrict or object to certain processing;
- receive your data in a portable form; and
- withdraw consent at any time, where processing relies on consent.
To exercise any of these, email app@combatready.eu. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
Data security
Access to the service is authenticated. Credentials and access tokens are stored securely and never sold. We limit access to personal data to what is needed to run and support the service. Payment details are entered only on Stripe’s PCI DSS-certified pages and are never stored on our servers.
Children
Combat Ready is intended for professional use by adults and is not directed at children under 18.
Changes to this policy
When we update this policy we post the new version on this page and change the “last updated” date. We will communicate significant changes as appropriate.
Contact
Questions or requests? Email app@combatready.eu, or write to Combat Ready OÜ, Öö tn 2-4, 50103 Tartu, Estonia.