Last updated: 22 September 2026
This Privacy Notice explains how Total Change Global Limited collects, uses, stores and protects personal information when you use the Total Change website and Total Change AI Coach.
1. Who is responsible for your data
Total Change Global Limited is the data controller.
Company number: 13282947
Registered office: Oak View, Broughall, Whitchurch, United Kingdom, SY13 4AF
Privacy contact: privacy@total-change.com
2. Information we collect
Depending on how you use Total Change, we may process:
- account information, including your name, email address, language, locale and time zone;
- Scorecard ratings and reflections;
- coaching conversations, coaching summaries and context you choose to confirm;
- 90-Day Change Cycles, goals, plans, commitments, actions and reviews;
- journal entries and the privacy setting you choose for each entry;
- preferences, notification settings and consent records;
- technical and service information used to operate and protect the service, including pseudonymous usage identifiers, model and token usage, timestamps, error logs and security events;
- safety-state metadata used by the coaching safety system, such as state, rule and reason codes. Safety audit records do not duplicate the text of your coaching message;
- information you provide if you contact us for support, make an enquiry, or purchase a product or service through the website.
3. Sensitive and special-category information
You may choose to discuss health, wellbeing, personal circumstances or other sensitive matters during coaching. Total Change does not require you to provide more sensitive information than is necessary for the coaching you choose to undertake.
Where Total Change processes special-category personal data for AI coaching and safety responses, we rely on your explicit consent. This consent is requested separately from your general account settings and is recorded with a policy version and timestamp.
You can withdraw that consent at any time. If you withdraw it, Total Change stops future AI coaching that relies on that consent and permanently removes your current coaching journey from the active database. This includes your Scorecards, coaching conversations and summaries, 90-Day Cycle, plans, reviews, journal content, AI-usage records and safety metadata. Your login account, basic profile and preferences, and the consent audit record remain. You may later give explicit consent again and begin a new coaching journey.
4. How we use your information
We use personal information to:
- create and manage your account;
- provide the Total Change AI Coach and personalised coaching experience;
- remember context you have explicitly confirmed or chosen to make available;
- operate Scorecards, planning, reviews, journalling and progress features;
- provide deterministic safety responses when immediate-risk language is detected;
- protect the service from abuse, excessive usage, fraud and security threats;
- monitor reliability, errors and AI usage;
- provide account export and deletion controls;
- respond to support enquiries and administer purchases or services where applicable;
- meet legal, regulatory and accounting obligations.
5. Our lawful bases
Under UK GDPR, and equivalent requirements where applicable, we use the following lawful bases depending on the activity:
- Contract or steps at your request, for providing your account, coaching service and products or services you request.
- Legitimate interests, for service security, abuse prevention, reliability, troubleshooting and protecting Total Change and its users, where those interests are not overridden by your rights.
- Legal obligation, where we must keep or disclose information to comply with law.
- Consent, where the law requires consent for a particular activity.
- Explicit consent under the applicable special-category condition for sensitive personal information you choose to provide for AI coaching and safety responses.
6. AI processing
Total Change uses OpenAI technology to generate ordinary coaching responses, coaching summaries and planning assistance. Relevant coaching context is sent only when needed for the requested AI function.
Total Change configures OpenAI API requests with store: false. This means Total Change does not ask OpenAI to store response objects for later retrieval. Limited provider-side security or abuse-monitoring information may still be handled under the provider’s applicable service terms and privacy commitments.
Urgent safety responses are deterministic and bypass ordinary AI generation. Total Change is not an emergency or crisis service.
7. Journal privacy and coaching context
Your journal privacy setting controls how a journal entry may be used:
- Private: intended to remain outside ordinary AI reflection and coaching context.
- Reflection: may be used when you explicitly request an AI reflection.
- Coach-connected: may be made available to coaching context, but is not automatically turned into confirmed coaching memory.
Confirmed coaching summaries are visible to you. You can correct them and remove or restore them from future Coach Me context.
8. Service providers and hosting
We use specialist providers to operate Total Change. These currently include:
- Supabase for authentication and the application database. The production database is hosted in the European Union.
- Railway for the production API. The production API is hosted in Amsterdam, Netherlands.
- Vercel for web application hosting and runtime services.
- OpenAI for AI-generated coaching and planning functions.
These providers act under their own contractual and data-protection terms. We do not sell your personal information to advertisers.
9. International transfers
Some service providers may process information outside the United Kingdom or European Economic Area. Where a restricted international transfer occurs, we use the transfer mechanism required by applicable data-protection law, such as an adequacy decision or approved contractual safeguards where applicable.
Beta 1 geographic scope: the initial external beta is invite-only and is intended for participants ordinarily resident in the United Kingdom, United States or Canada. Total Change does not intentionally offer or market Beta 1 to people in the European Economic Area. We will review the applicable territorial and representative requirements before any future intentional EEA launch.
10. How long we keep information
While your account remains active, Total Change keeps the application content needed to provide your coaching journey unless you delete it through an available control or withdraw the explicit consent on which sensitive coaching processing relies.
If you delete your account, the active authentication account and associated application records are permanently removed from the active Total Change database.
Limited technical logs may remain for a short period for operations, security and troubleshooting. Under the current beta infrastructure, Supabase API and database logs may be retained for up to 1 day, Vercel runtime logs for up to 1 day on the current plan, and Railway logs for up to 7 days on the current plan. These logs are not used to recreate a deleted coaching account.
The Production database uses Supabase Pro scheduled daily backups. Under the current plan, up to the last 7 days of daily database backups are available for restore. Database backups cover the database itself but do not include file objects stored through the Supabase Storage API.
11. Your controls
Within Total Change you can:
- download a copy of the account and application data associated with you;
- correct confirmed coaching context;
- remove or restore confirmed coaching summaries from future Coach Me context;
- choose journal privacy settings;
- withdraw or re-grant explicit sensitive-data consent;
- permanently delete your account.
12. Your data-protection rights
Depending on where you live and the law that applies, you may have rights to access, correct, erase, restrict or object to processing, receive a portable copy of certain data, and withdraw consent where processing is based on consent. Withdrawing consent does not make processing that occurred before withdrawal unlawful.
To exercise a privacy right, contact privacy@total-change.com.
If you are in the United Kingdom, you may also complain to the Information Commissioner’s Office. If you are in the EEA, you may have the right to complain to your local supervisory authority.
13. Cookies
Total Change uses cookies and similar technologies that are necessary for authentication, security, account sessions and core website functionality. If we introduce non-essential analytics, advertising or similar cookies that require consent, we will ask for that consent before using them where required by law.
14. Security
We use access controls, separate Stage and Production environments, server-side secret storage, database row-level security, controlled service credentials and operational monitoring to protect Total Change data. No online service can guarantee absolute security.
15. Changes to this notice
We may update this Privacy Notice when the service, providers, legal requirements or retention arrangements change. The date at the top of this page shows the current version.
16. Contact us
For privacy questions or requests, contact:
Total Change Global Limited
Oak View, Broughall, Whitchurch, United Kingdom, SY13 4AF
privacy@total-change.com