Privacy & GDPR Policy

L.I.F.E Platform — L.I.F.ECoach121.com Limited

Effective Date: 26 December 2025 · Last Updated: 10 April 2026

This policy explains how L.I.F.ECoach121.com Limited (“we”, “us”, “the Company”) collects, uses, stores, and protects personal data when you use the L.I.F.E Platform, the L.I.F.E AI Enhancer VS Code extension, or any related API. It complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU 2016/679), and the Data Protection Act 2018.

1. Data Controller

Organisation	L.I.F.ECoach121.com Limited
Director / DPO	Sergio Paya Borrull
Email	Life.coachsergi@gmail.com
Website	lifecoach-121.com
Jurisdiction	England & Wales, United Kingdom

2. What Data We Collect

Category	Examples	Lawful Basis
Account data	Email address, display name, Microsoft Entra ID identifier	Contract performance (Art. 6(1)(b))
Usage telemetry	Suggestion acceptance/rejection events, session timestamps, VS Code extension version, anonymised machine ID	Legitimate interest – service improvement (Art. 6(1)(f))
Coding-session signals	Code snippets submitted to `/api/optimize`, language, context tags	Contract performance (Art. 6(1)(b))
Neural / EEG-style signals	Processed signal arrays submitted to `/api/signals/process/eeg`	Explicit consent (Art. 6(1)(a)); special-category consent (Art. 9(2)(a))
Onboarding profile	Role, quiz answers, learning targets, assigned plan	Contract performance (Art. 6(1)(b))

3. How We Use Your Data

Provide the service: real-time adaptive optimisation, scoring (UCI/UKCI), curriculum personalisation.
Improve the platform: aggregated, anonymised telemetry informs engine tuning and feature development.
Security & fraud prevention: rate limiting, API key verification, anomaly detection.

We do not use your data for advertising, profiling for third-party marketing, or automated decision-making with legal effects.

4. Data Storage & Transfers

Data is stored in Azure Container Apps and Azure Cosmos DB in the UK South region.
Authentication is handled via Microsoft Entra ID; we do not store passwords.
Ephemeral processing data (e.g. EEG signals) is held in-memory only and discarded after the response is returned, unless you explicitly enable cloud persistence.
No personal data is transferred outside the UK/EEA unless required by Azure infrastructure with appropriate safeguards (Standard Contractual Clauses).

5. Data Retention

Data type	Retention period
Account data	Until you delete your account or request erasure
Usage telemetry	90 days (rolling window), then aggregated/anonymised
Coding-session data	Duration of session only (not persisted by default)
EEG / neural signals	Duration of processing call only (not persisted by default)
Onboarding plan	Until you delete your account or request erasure

6. Your Rights Under GDPR

Under UK GDPR and EU GDPR you have the right to:

Access — obtain a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure (“right to be forgotten”) — request deletion of your data.
Restrict processing — ask us to limit how we use your data.
Data portability — receive your data in a structured, machine-readable format.
Object — object to processing based on legitimate interest.
Withdraw consent — where processing relies on consent (e.g. EEG data), withdraw it at any time without affecting prior processing.

To exercise any right, email Life.coachsergi@gmail.com. We will respond within 30 days.

7. Third Parties & Sub-processors

Sub-processor	Purpose	Location
Microsoft Azure	Cloud hosting, Cosmos DB, Application Insights, Entra ID	UK South / EEA

No personal data is shared with any other third parties. Aggregated, anonymised metrics may be used for product improvement.

8. Cookies

The L.I.F.E Platform API does not set browser cookies. The VS Code extension communicates via REST API calls and does not use cookies.

9. Security

All data in transit is encrypted via TLS 1.2+.
Data at rest in Azure Cosmos DB and Azure Storage is encrypted at rest (AES-256).
API endpoints are protected by rate limiting (Flask-Limiter) and API key verification.
CORS is restricted to authorised origins in production.

10. Complaints

If you are not satisfied with our response you may lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

11. Changes to This Policy

Updates will be posted to this page with a revised “Last Updated” date and noted in the VS Code extension changelog.