How we protect your data

• Row level security on every tenant table. Pipeline entries and notes, history, tasks, deals, deal files, contacts, outreach, Studio runs and jobs, call preps, voice profiles, UI preferences. The read rule is: the row’s owner, an org owner or admin, or a coach assigned to that student. The write rule is: the owner only.
• Coach assignments are empty. The table exists, nothing fills it, and there is no screen to fill it. So in practice a row is readable by its owner and ATP staff, nobody else.
• The app filters on your id as well. Even though the database enforces the rule, every personal read in the app also asks for your rows by your id, so an admin using the app sees their own book, not the org’s.
• Roles cannot be self assigned. Your role lives on your membership; a trigger mirrors it to your profile, and profile updates from the browser are limited to the display name. A student cannot make themselves an admin.

• The deal-files bucket is private. There are no public links.
• Storage rules allow select, insert and delete only where the first folder in the path equals the caller’s own user id. Org admins are not exempt: they can see the metadata row (name, type, size, note) but cannot fetch the bytes.
• Uploads go from the browser directly to storage with the student’s own session. Our app server never handles the file.
• Download links are signed and expire after 1 hour.
• Accepted types: PDF, PNG, JPG, CSV, XLSX, DOCX. Size cap 25 MB. The bucket enforces this on upload.
• Encrypted at rest (AES-256) and in transit (TLS) by Supabase.
• No code path sends file contents to an AI model or to any outside service.

• You never give us an API key. Every lookup runs on our own vendor accounts.
• Our own vendor keys (OpenRouter, SerpAPI, Firecrawl, DataForSEO, Keepa, fal.ai, Hunter, Prospeo, Apollo) live on the server only and never reach the browser.
• Gmail, if you connect it, uses a short lived access token that stays in your browser session. We store no refresh token, so we hold no long lived way into your mailbox.
• The service role key, which bypasses row level security, is used only by server side code and background jobs. It is never sent to the browser. This key can technically reach every row and every file; that is true of every Supabase app, and we say it plainly rather than pretend otherwise.

Owners and admins can read student rows through the same row level security rules, for support. Two admin only screens exist: Jobs (per AI run: brand, tool, status, cost) and Spend (cost totals per student). Neither shows notes, contacts or files. The legacy coach dashboard is switched off.

• Download every row you own as one Excel file (account menu, Privacy & data).
• Delete your account yourself, with a 7 day window to change your mind.
• Disconnect Gmail at any time.

The plain language version, including the “who can see what” table, is on the privacy page. Report a concern to success@abuvthepar.com.