Privacy Policy

1. Who this policy covers

It covers visitors to www.maxuniversity.org and coachmax.maxuniversity.org, people who contact us, administrators who set up an organization, and instructors and learners who use CoachMax through an organization.

When an organization (for example, a school) uses CoachMax, that organization decides what learner information is collected and why. For that information we act as a service provider (or "processor") on the organization's behalf, under our agreement with them, including our Data Processing Agreement. Learners should direct requests about their records to their organization first.

2. Information we collect

• Account information: name, email address, role, organization, and password (stored only by our authentication provider in hashed form).
• Learner work: submissions such as text, documents, links, and videos, and the assessments, scores, feedback, and instructor comments created from them, plus questions learners ask CoachMax about their feedback and the answers.
• Coaching content: if your program turns it on, an improved version of your own submission that CoachMax writes for you after feedback ("Your answer, at 100"), kept with your submission and visible to you and your organization's staff.
• Learner profile: if you're a learner, what you choose to share about your business, idea, studies, or career, what you have so far, and your goals. It's used only to make your feedback fit you (it never changes a score) and is visible to you and your organization's staff.
• Curriculum content: programs, assignments, rubrics, and materials an organization uploads or syncs from its learning management system (LMS).
• Billing information: billing contact, plan, the agreed monthly amount, and invoices. Once online payment is available, card details will be collected and stored by our payment processor, not by us.
• Usage and device information: pages viewed, actions taken, IP address, browser type, and timestamps, used to run, secure, and improve the service.
• Communications: messages you send us (including problem reports from the Report a problem button, with the page you were on, your browser and screen size, and any screenshot you add) and email delivery information.

3. How we use information

• To provide CoachMax: create accounts, assess submissions against the organization's rubric, deliver feedback, notify instructors, and produce reports.
• To secure the service: authenticate users, prevent abuse, keep audit logs, and investigate incidents. To spot attacks (such as password guessing), CoachMax records failed sign-ins, invalid API keys, and refused requests with the internet address they came from and, for sign-ins, a one-way hash of the email (never the email itself or any password). These records are deleted after 30 days.
• To keep the service running: when something goes wrong, CoachMax records technical details in an operational log for our staff, such as the page or feature involved (without the address's query string), the error message, the organization's name, and submission or assignment references. It never records learners' names or emails on purpose. Only CoachMax staff can see this log, and we keep it to diagnose and prevent problems. Staff receive email alerts about new issues, and CoachMax automatically retries some failed tasks (such as a grading interrupted by an AI outage) and records what it did.
• To bill organizations and send receipts.
• To send service emails, such as feedback-ready and review notifications, and reminders when a learner has been away with work waiting (learners can turn these off on their Account page).
• To send announcements from CoachMax by email and in the app: service notices (outages, scheduled maintenance, security changes, and updates to these policies) go to everyone they affect; news about CoachMax features can be turned off by anyone on their Account page. We do not send advertising or third-party marketing email to learners.
• To improve and support the service, using aggregated or de-identified data where possible.
• To comply with law and enforce our Terms.

4. AI processing

CoachMax uses third-party AI models to read submissions and draft assessments against the organization's rubric. We send only what is needed to produce the assessment.

We do not use learner submissions or organization content to train AI models, and for live programs we use AI providers whose commercial terms do not allow them to train on that data. The only exception is opt-in: for test programs, or for drafting course setup, that an organization agrees to in writing, CoachMax may use a free AI tier whose provider may use that content to improve its products. For live learner work, we use a free tier only for a feature where Max University turns one on (for example, to keep costs down); while any feature does, our Trust Center (coachmax.maxuniversity.org/trust) names it and explains that the provider may use that content to improve its products.

AI assessments can be wrong. Organizations can require instructor review, and instructors can edit, override, or hold any assessment.

5. How we share information

We do not sell personal information and we do not share it for targeted advertising. We share information only:

• With the organization that provides your account (your school, program, or employer).
• With CoachMax staff only as needed: staff see an organization's data only during a support session the organization approves, and each session is logged.
• With service providers that help us run CoachMax (subprocessors), under contracts that limit their use of the data. A current list is in our Data Processing Agreement.
• With integrations an organization chooses to connect, such as its LMS.
• If required by law, or to protect the rights, safety, and security of users or the public.
• As part of a merger or acquisition, with notice and continued protection of your information.

6. Google Calendar (Coordinator Max booking)

If you host meetings in Coordinator Max and choose to connect your Google Calendar, we ask Google for:

We never read the titles, notes or guests of your other events. Your Google access is stored encrypted and used only by our servers for these purposes. You can disconnect at any time in Coordinator Max (My booking link and hours → Disconnect) or in your Google Account settings, and we then delete the stored access. An admin of your organization can also connect a Google Calendar for you to get your booking page ready; you see it on the same page and can disconnect it or connect your own at any time.

Limited Use: Max University's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We don't use Google data for advertising, don't sell it, don't use it to train AI models, and our team doesn't read it except with your permission, for security, or to comply with the law.

• Your free/busy times, only to hide times you're already busy from people booking you.
• Permission to add, update and cancel the meetings booked with you, so they appear on your calendar with a Google Meet link and your guests get the invite.
• Your Google email address, to show which account is connected.

7. Students and FERPA

When we receive education records from a school, we act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), under the school's direct control. We use those records only to provide the service to the school, and we do not re-disclose them except as the school directs or the law allows.

8. Age requirement

CoachMax is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. Organizations must not enroll learners under 18.

9. Retention and deletion

We keep personal information for as long as the organization's account is active or as needed to provide the service. Organization admins can remove learners at any time, and can permanently delete a learner's data in their organization (submissions, files, feedback, and profile; and the learner's CoachMax account if they belong to no other organization). Deleted data can't be recovered; an audit record that a deletion happened is kept, without the learner's content. After an organization's account ends, we delete or return its data within 30 days unless the law requires us to keep it longer. Backups are overwritten on a rolling schedule.

10. Security

We protect information with encryption in transit and at rest, organization-level data separation, role-based access, two-factor sign-in (required for administrators and available to every user), private file storage with expiring links, audit logging, and regular backups. No system is perfectly secure; if a breach affects your personal information, we will notify the affected organization and individuals as required by law, including North Carolina law.

11. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. If your account comes from an organization, contact that organization first; we will help them respond. You can also email privacy@maxuniversity.org. We will not discriminate against you for exercising your rights. We verify requests before acting on them.

12. Cookies

We use essential cookies to keep you signed in and secure. We don't use analytics or advertising cookies today; if we add privacy-friendly analytics, we will ask for your consent first. See our Cookie Notice for details.

13. Changes

We will post changes here and update the effective date. If changes are material, we will notify organization administrators by email before they take effect.

14. Contact

The Boost Pad Inc. (Max University), 2400 Greenland Ave., Charlotte, NC 28208, USA. Email: privacy@maxuniversity.org.