Privacy Policy

This policy explains what we collect, why we collect it, who we share it with, and the control you have over it. It applies to the 137 website, web app, and mobile apps.

137 is an app operated by Human First Design, an eenmanszaak registered in the Netherlands under KVK number 42177056. The operator is the data controller responsible for the information described here. For privacy questions or requests, contact hello@get137.com.

Specifically, the following content is transmitted to our AI providers as part of generating your program: your stated goal and role, your work context and situation, the names, roles, and seniority of the colleagues and stakeholders you add, your weekly check-ins and reflections, your logged wins and outcomes, the messages and attachments you send in coach chat, and the situation you submit when trying the product before creating an account.

Our AI providers are:

• Anthropic and OpenAI: generate and structure plans, bold moves, daily reps, and coaching responses. The provider used can vary by feature and configuration.
• OpenAI: also transcribes voice input when you use the microphone.
• Google (Gemini), through Lovable's AI gateway: checks generated reps for quality and suitability before they reach you.

These providers process your content to return a response to us. Their commercial/API terms and the settings applicable to the service govern their processing and retention. AI processing does not mean that no copy is retained: providers may keep records for security, abuse prevention, or legal obligations. You can read more in the Anthropic, OpenAI, and Lovable privacy information, or contact us about the processing applicable to your data. We do not sell your data or use your workplace content for advertising.

Please use judgement about what you enter. Avoid entering information you are contractually or legally barred from sharing with third parties, such as trade secrets, material non-public information, or your employer's confidential documents.

Information you give us

• Account details: your email address and, if you set one, a password. Passwords are hashed and never visible to us.
• Program context: your goal, role, function or domain, timezone, current situation, and the working context you describe during onboarding.
• Information about other people: the names, roles, seniority, relationship to you, and availability of colleagues and stakeholders you add. See the dedicated section below.
• Program activity: your completed reps, shipped bold moves, logged wins and outcomes, weekly reflections, daily check-ins, and streaks.
• Coach conversations: the messages you exchange with the AI coach and any attachments you add to them.
• Voice input: when you use the microphone, the audio is sent for transcription and converted to text. We retain the resulting text in your program or conversation, rather than storing a recording in your account. Temporary recordings can remain in your device's app storage, and the transcription provider's retention rules also apply.
• Waitlist and invite requests: the email address and any note you submit when requesting access.
• Purchase and access records: account and store customer identifiers, product and transaction identifiers, purchase dates, subscription status, refunds, and the access granted to your account. We do not receive your full payment card details.

Information collected automatically

• Authentication and session data: needed to keep you signed in securely.
• Technical logs: request timestamps, error diagnostics, and AI generation logs used to debug and improve reliability.
• Push notification tokens: only if you enable notifications in the mobile app.

We use browser and device storage to keep you signed in, preserve drafts and onboarding progress, remember preferences, and support features such as pending messages and purchase recovery. Our hosting and service providers may also process visit and diagnostic information to operate and measure the service. This is separate from the workplace content you enter for your strategy.

137 works by helping you act on real relationships, so you will enter details about colleagues, managers, and other stakeholders. This typically includes their first name, their role or seniority, their relationship to you, and whether they are currently available or away.

We ask you to keep this to what is necessary for coaching. Do not enter sensitive personal information about your colleagues, such as health details. Use a role or alias instead of a real name wherever possible, and avoid unnecessary identifying details. You remain responsible for the information about others that you choose to enter. People whose information is entered can contact us directly at hello@get137.com to ask about their data or exercise their rights. We may need enough information to verify and locate the relevant records while protecting other people's privacy.

• To provide the product: generating your program, reps, and coaching, and tracking your progress. Legal basis: performance of our contract with you.
• To operate your account: authentication, purchase records, and access management. Legal basis: performance of our contract with you.
• To handle access requests and support: responding to your request for an invitation, account help, or a refund. Legal basis: steps taken at your request before a contract, performance of our contract where applicable, and our legitimate interest in responding to enquiries and resolving disputes.
• To send essential service messages: account, purchase, security, and material service notices. Legal basis: performance of our contract or legal obligations, as applicable. Optional reminders support our legitimate interest in providing the service you requested; device push notifications also require your device permission, which you can turn off in settings.
• To send promotional messages: only where permitted by applicable marketing rules, including consent where required. You can opt out by contacting us or using the unsubscribe option provided with the message.
• To keep the service secure and reliable: abuse prevention, rate limiting, and debugging. Legal basis: our legitimate interest.
• To comply with the law: tax, accounting, and responding to lawful requests. Legal basis: legal obligation.

We use the following services to operate 137. Some providers act on our instructions; others, including app stores, also process information for their own purposes under their privacy notices.

• Supabase: database, authentication, file storage, and server functions.
• Anthropic, OpenAI, and Google: AI generation, extraction, transcription, and scoring, as described above. Some AI requests pass through Lovable's AI gateway.
• Brevo: transactional and product emails.
• Lovable and Inngest: gateway services and background-job coordination for plan generation and email delivery. Job requests can include account identifiers and the request data needed to run the task.
• RevenueCat: purchase validation, subscription management, and access recovery using account identifiers and store purchase information.
• Expo, Apple, and Google: push-notification delivery when you enable notifications, including the device token and notification content.
• Apple and Google: payment processing and receipt validation for purchases made through their app stores. They handle your payment details directly; we never see your full card number.

These services can involve processing outside the European Economic Area. International transfers are subject to applicable data protection requirements, which may require an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism. Contact us at hello@get137.com for information about the providers and safeguards applicable to your data.

We may also disclose information if required by law, or in connection with a merger or acquisition, in which case we will notify you before your data becomes subject to a different privacy policy.

We retain account and program data to provide your active service and the history you choose to keep after paid access ends. Account deletion removes your sign-in, associated product records, and private uploads from the active product systems. It does not cancel a store subscription or automatically erase every separate support, access-request, diagnostic, or provider record. You can request deletion of other personal data at hello@get137.com.

Separate records are retained according to their purpose: resolving a support request or generation failure, investigating security incidents, handling purchases and refunds, preventing duplicate access or fraud, and meeting tax, accounting, or legal requirements. The relevant issue, applicable legal period, and any unresolved claim determine how long those records are needed. Provider logs and backups may have separate retention periods. We assess deletion requests under the rights and response deadlines below and explain any lawful reason for retaining information.

Depending on where you live, you have some or all of the following rights over your personal data: to access it, to correct it, to delete it, to restrict or object to how we use it, to receive a portable copy, and to withdraw consent where we relied on it.

You can edit most of your program context and stakeholder information directly in the app under Profile and Settings. For anything else, email hello@get137.com. We respond without undue delay and normally within one month. Where the law permits an extension for a complex request, we explain the reason and timing within that first month. You may lodge a complaint with your local data protection authority, including the Autoriteit Persoonsgegevens in the Netherlands.

We use encrypted connections, provider-managed storage protections, and access controls designed to prevent users from accessing other users' private records. Authorised operators and service providers may access information where needed for support, security, and operation of the service. No system is perfectly secure. If a personal data breach occurs, we assess the risk and notify the relevant authority and affected individuals where required by law, within the applicable deadlines.

137 is a professional tool intended for people in work. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the product evolves. When we make a material change we will update the date at the top of this page and, where the change significantly affects your rights, notify you by email.

Privacy questions, data requests, and complaints: hello@get137.com.