01Who we are, and which hat we are wearing
Mara Performance Ltd is a company registered in England and Wales under number 17476869, with its registered office at Flat 6, 102 Newent Close, London SE15 6ED. We operate Mara, an AI performance coaching platform.
Which data protection role we hold depends on how you reached Mara, and the split is deliberate rather than convenient:
| Situation | Our role |
|---|---|
| You bought Mara yourself | Controller. We decide what is processed and why, and this notice is the whole story. |
| Your employer bought Mara and enrolled you | Processor for the data your employer instructs us on: that you have an account, that you are using it, and the aggregate cohort reporting they receive. Your employer is the controller for that, and their own privacy notice applies to it. |
| The content of your coaching sessions, in either case | Controller. Your employer cannot see this data, cannot ask us for it, and cannot instruct us on it. An organisation cannot be the controller of something it has no access to and no say over, so we hold that role and answer to you for it. |
| Our own billing, accounting and business records | Controller. |
The people who bought Mara for you see whether you turned up and how the group is moving. They never see what you said, what you scored, or what you worked on. That is a property of how the system is built and of the contract we sign with them, not a setting somebody could change on a bad day.
For anything in this notice, write to privacy@thesessionlab.com. We have not appointed a statutory Data Protection Officer, as we are not required to; privacy questions reach a named person on our side and are answered by them.
02What we collect
You give us
- Account details. Your name, email address and password. Passwords are held by our authentication provider and are never visible to us.
- Profile details. Job title, organisation, first language, the situations you find hard, and your diagnostic answers. These exist so that Mara coaches you rather than coaching in general.
- What you say in a session. The text of your coaching and practice conversations, and anything you write in a journal or reflection field.
The platform generates
- Delivery signals. Pace, pitch, range, pause, energy, fluency, posture, gaze and stillness, measured from your camera and microphone inside your own browser. The raw video and audio are not uploaded to be analysed. The numbers that come out of that measurement are.
- Scores, summaries and coaching feedback produced from a session.
- Progress records: which rooms you have used, when, and how far through a programme you are.
We receive from others
- Billing details from Stripe: the fact of a payment, the plan, and your contact details. Card numbers are handled entirely by Stripe and never reach us.
- Enrolment details from an employer who has bought seats: usually your name, work email and team.
- Email engagement from our email provider: whether a message was delivered, opened or clicked, so we stop sending to people who have stopped reading.
Automatically
- Technical and log data: IP address, browser and device type, and timestamps of requests, used to run and secure the service.
- One cookie. See the Cookies page. We run no analytics and no advertising tracking of any kind.
03What we do not collect
- Your raw camera and microphone streams are not uploaded for analysis. The measurement happens on your device. Unless you deliberately save a take, no video or audio of you leaves your browser.
- Off the Record is not recorded, not transcribed, and not kept on our servers. Shredding a conversation removes it, with no archive and no recovery. Nothing from Off the Record feeds a score, a dashboard, an email, a report, or Mara's memory of you. To be exact, because this is the claim worth being exact about: the words you type are held in memory only for as long as the conversation is open, and they pass to our model provider so a reply can be generated. They are never written to our database, and a saved Off the Record conversation lives only on your own device.
- Card numbers. Stripe holds those. We never see them.
- Special category data, on purpose. We do not ask for information about your health, beliefs, ethnicity, sexuality or union membership, and Mara is instructed not to draw it out of you. See section 05.
- We do not sell personal data, and we never will. We do not share it for anybody else's marketing, and no provider we use is permitted to train models on it.
04Why we process it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Run your account and deliver the coaching you signed up for | Contract (Article 6(1)(b)), or our legitimate interests in performing a contract with your employer where they enrolled you |
| Generate coaching responses, scores and summaries from your session | Contract (Article 6(1)(b)) — this is the service |
| Save a practice recording to your library | Consent (Article 6(1)(a)), given by choosing to keep the take. Withdrawn by deleting it. |
| Capture a real meeting through Meeting Observer | Consent (Article 6(1)(a)) from you, and see section 06 on everybody else in the room |
| Send you programme and member emails | Legitimate interests (Article 6(1)(f)) where you are a member, or consent where you are not. Unsubscribe in any message. |
| Aggregate, minimum-cohort reporting to an organisation that bought seats | Legitimate interests (Article 6(1)(f)) of that organisation in knowing whether the programme is working, balanced by the rule that no individual is identifiable in it |
| Keep the service secure, investigate abuse, keep audit records | Legitimate interests (Article 6(1)(f)) |
| Improve Mara's coaching quality | Legitimate interests (Article 6(1)(f)), using aggregated and de-identified material. Never by handing your sessions to anybody to train a model on. |
| Keep accounting and tax records | Legal obligation (Article 6(1)(c)) |
Where we rely on legitimate interests we have weighed them against your rights and concluded they do not override yours. You can ask us for that assessment, and you can object under section 09.
05Health, special category data, and why the delivery signals are not biometrics
Two things need saying plainly, because a coaching product that reads a camera invites the wrong assumption about both.
Special category data
We do not seek information about your health, and Mara is designed to coach performance rather than to treat anything. Mara is not therapy, is not a clinical service, and does not diagnose.
People under pressure sometimes volunteer things anyway — a panic response, a medication, a diagnosis. Where you choose to put that into a coaching session, we process it on the basis of your explicit consent (Article 9(2)(a)), given by choosing to share it, and we use it only to coach you in that session. It is never surfaced to your employer, never used in reporting, and you can withdraw that consent and have it deleted at any time by writing to privacy@thesessionlab.com. If you would rather it never touched our systems at all, use Off the Record, which is not retained.
The delivery signals are not biometric data
Mara measures how you are delivering: pace, pitch, pause, energy, posture, gaze, stillness. Under UK and EU GDPR, data derived from a face or a voice becomes special category biometric data only when it is processed for the purpose of uniquely identifying a person. Mara does not do that. There is no facial recognition, no voiceprint, no identity matching, and no attempt to recognise you from your face or voice. The signals exist to coach the person already logged in, and they are measured on that person's own device.
06Recording, and the people who did not sign up
Saving a practice take records only you, in your own browser, at your choice.
Meeting Observer is different, and there are two ways to use it. They do different things with other people's voices, so we describe them separately rather than averaging them into a comfortable sentence.
The browser extension
- It does make a recording of the meeting, including other participants. That recording is written to your own computer's Downloads folder and is never uploaded to us. There is no route on our servers that accepts a meeting recording. We receive the filename, nothing more.
- What we analyse is your speech only, transcribed by your browser's built-in speech recognition from your microphone. Note that this is not done on your device: Chrome sends that audio to Google to turn it into text. It is your voice, not the room's, but Google is in that path and we would rather you knew.
The live source in your browser
- If you choose to share your meeting window with sound so that Mara can hear the other person, that shared audio, including other participants' voices, is sent to OpenAI to be turned into text. It leaves your device and it reaches a third party.
- The text is used to build your report and the transcript is discarded rather than stored, but the report itself can quote what was said.
- Do not use this surface unless everyone in the meeting has agreed to it.
What you owe the other people in the room, either way
- Tell everyone present that the meeting is being captured and analysed, and what for.
- Get their agreement, and give anybody who objects a way to say no that costs them nothing.
- Follow your own organisation's rules and the law where each participant is sitting. Several jurisdictions require the consent of every party to a recorded conversation.
- Remember that the extension writes a recording to your own machine. Your employer's recording and retention policy applies to that file even though we never see it.
You are the person who owes those participants that duty; we cannot discharge it for you, and we will not pretend otherwise. Mara produces coaching about your contribution only: other participants are never scored, never profiled and never reported on.
07Who else touches your data
We use a small number of providers to run the service. Each receives only what it needs, each is under a written contract that forbids using our customers' data to train its models, and the dated, authoritative version of this list lives in the Data Processing Agreement.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Amazon Web Services | Runs the Claude models that generate Mara's coaching responses and session analysis, on AWS Bedrock. AWS does not retain prompts or completions and does not use them to train models | Session text | European Union |
| OpenAI | Converts speech to text, including meeting audio where you share a live source in Meeting Observer | Audio, then text | United States |
| Your browser's built in speech recognition, used to transcribe your own voice in Meeting Observer | Your speech audio | United States | |
| Supabase | Database, authentication and file storage | Account and session data | United Kingdom (London), vendor in the United States |
| Render | Application hosting | Requests in transit and in memory | European Union (Frankfurt) |
| Stripe | Subscriptions and payments | Billing and contact details | Ireland and United States |
| Brevo | Transactional and programme email | Name and email | France |
| Zoom | Meeting capture for Meeting Observer, only if you turn it on | Meeting audio | United States |
Anthropic PBC develops the Claude models Mara uses. While inference runs on AWS Bedrock, Anthropic is not a sub processor and receives no session data.
We will also disclose personal data where the law requires it, to our professional advisers under duties of confidence, and to a buyer if the business is ever sold — in which case you would be told before anything moved.
We publish changes to this list before they take effect, and organisation customers get thirty days' written notice and a right to object under the DPA.
08Where your data goes
Your database records and files are held in the United Kingdom, in the London region, by Supabase. The application itself runs in the European Union, in the Frankfurt region, on Render. Mara's coaching is generated on AWS Bedrock, inside the European Union. Bedrock serves each request from an EU region, which may be Frankfurt or another one, so what we commit to is the European Union rather than a single city.
Some of the providers above are outside the UK and the EEA. Those transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the Addendum and the Clauses as applicable, together with a transfer risk assessment. Audio reaching OpenAI for transcription is a transfer of that kind. Coaching text is not: it is generated inside the European Union and does not leave the European Economic Area.
Where the model runs is a deployment setting, and it changes the answer above. The live position, since 1 September 2026, is AWS Bedrock in the European Union, and it applies to every deployment rather than only to those that ask for it. We state what is switched on and we will not describe a configuration we have not switched on. Organisation customers who need that in writing get it as a binding term in their Data Processing Agreement rather than a sentence on a website.
09How long we keep it
| What | How long, in reality |
|---|---|
| Coaching and Practise session records | Stamped with a ninety-day expiry when written. After that date Mara no longer returns the record, and a scheduled sweep deletes it. You can delete anything sooner by asking. |
| Meeting Observer recordings | We do not hold any. The extension writes the recording to your own computer and there is no route on our servers that accepts one. Deleting it is yours to do. |
| Historical usage events | Kept for product analytics, but stripped of the identifiers and the scores after ninety days, so what remains cannot be traced back to a person. |
| Working transcripts | Held for the session and to produce the summary and the scores. What we are trying to keep is the point of learning, not the conversation. |
| Off the Record | Not kept on our servers at all. Shredding is immediate and permanent. |
| Saved recordings | Kept until you delete them. Access is through expiring signed links. Delete removes the file from storage. |
| Account and profile | While your account is open. Deleted or anonymised within thirty days of closure, offboarding or a valid erasure request. |
| Billing and accounting records | Six years after the end of the relevant accounting period, because HMRC requires it. |
| Security and audit logs | Twelve months. |
| Marketing contacts | Until you unsubscribe, then a suppression record so we do not contact you again. |
10Your rights
Under the UK GDPR you can ask us to:
- Give you a copy of your personal data, and a portable export of it.
- Correct anything that is wrong.
- Erase it, where we have no overriding reason to keep it.
- Restrict or object to processing, including any processing we base on legitimate interests, and any direct marketing — that last one is absolute, and we stop.
- Withdraw consent at any time, without affecting what was lawful before.
Some of these you can do yourself and immediately: delete any recording from your library, shred any Off the Record conversation, unsubscribe from any email. For the rest, write to privacy@thesessionlab.com. We answer within one month, free of charge. We may need to confirm who you are first.
If your employer enrolled you, direct requests about your enrolment and engagement data to them as controller; send anything about your coaching content to us. If you ask the wrong one of us, we will point you at the right one rather than leaving you to work it out.
If we get it wrong, complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you came to us first, but that is your right, not our permission.
11How Mara uses AI, and the limits on it
Mara is built on large language models. Three limits matter, and we hold ourselves to all three.
- No decision with a legal or similarly significant effect is made about you by a machine. Mara's scores and feedback are coaching, delivered to you. They are not used to decide anything about your job, your pay or your standing, and we do not make them capable of it. Article 22 of the UK GDPR is not engaged, and we do not want it to be.
- Mara is not an employment decision tool. Our contracts with organisations prohibit using Mara's output to make, inform or support performance management, promotion, discipline or dismissal decisions about an individual, and the platform gives an employer no individual-level output that could be used that way.
- Nothing you put into Mara trains anybody's model. Every provider is contracted against it.
Mara can be wrong. It is a coach, not an oracle, and it is not a substitute for professional medical, psychological, legal or financial advice.
12How we protect it, described accurately
Overstating security is worse than having less of it, so this section says what is actually in place and stops there. Organisation customers get the full technical and organisational measures schedule in the DPA.
- In transit: TLS throughout, with HTTP Strict Transport Security enforced, a Content Security Policy, content-type protection and a strict referrer policy.
- At rest: encryption at the database and storage layer, managed by our database provider. A narrow category of safety-flagged content carries an additional application layer of AES-256-GCM encryption.
- Access: every request is authenticated against a signed session token. The session cookie is HttpOnly, Secure and SameSite, so page scripts can never read it. Administrative functions are restricted to defined administrator roles and service credentials stay server side. Administrative actions on member records are written to an audit log.
- Separation: organisations are isolated from one another, and aggregate reporting is suppressed below a minimum cohort size so that no individual can be inferred from it.
- Backups: automated daily backups by our managed database provider, encrypted and held in the same regional boundary as the primary data.
What we do not yet have. Single sign-on through your own identity provider, SCIM provisioning and multi-factor authentication are not built. They are on the roadmap and we will not claim them before they exist. We hold no SOC 2 or ISO 27001 certification. We are glad to complete your security questionnaire and to say no to the questions where the answer is no.
If you believe you have found a vulnerability, write to security@thesessionlab.com. We will not take legal action against anyone who reports one in good faith, gives us a reasonable chance to fix it, and does not access or alter data that is not theirs.
If a breach puts your rights at risk we will tell the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk to you is high.
13Children
Mara is built for working adults and is not offered to anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will delete it.
14Changes to this notice
We version this notice and date it. Where a change materially affects you we will tell you by email or in the product before it takes effect, rather than editing the page and hoping.
| Version | Date | Change |
|---|---|---|
| 1.0 | 18 August 2026 | First issue under Mara Performance Ltd. Replaces the earlier notice published under a trading name, and corrects the sub-processor, residency, retention and security descriptions to match the platform as built. |
Questions: privacy@thesessionlab.com. Anything else: hello@thesessionlab.com.