Kovach Consulting Group, LLC
Effective: July 28, 2026
Kovach Consulting Group, LLC ("KCG," "we," "our") respects your privacy. This policy explains what information we collect, how we use it, and your rights regarding that information.
Information We Collect
Information you provide directly: When you engage our services, we collect your name, email address, phone number, organizational role and context, payment information (processed securely through Stripe — we do not store card numbers), and information you share during coaching sessions including goals, challenges, and organizational details.
Information collected automatically: If you allow analytics, Google Analytics (a Google LLC service, loaded through Google Tag Manager) collects approximate location, browser and device type, pages visited, and access times on our behalf. We use this data in aggregate to understand how the site is used. Google processes it under its own privacy policy; our configuration keeps advertising features off. If you decline analytics, this collection does not happen. Server infrastructure also records standard access logs to keep the site running and secure.
How We Use Your Information
We use your information to deliver coaching and advisory services, process payments and manage billing, communicate with you about scheduling, session preparation, and engagement updates, improve our services and develop new offerings, and comply with legal obligations.
Information Sharing
We do not sell, rent, or trade your personal information. We share it only with service providers acting on our behalf: Stripe (payments), Formspree (contact form delivery), Calendly (scheduling), Google (site analytics, and only if you allow them), Resend (transactional email), Supabase (portal sign-in), and Meta (only if you load the Facebook feed on the Services page). Beyond that, only as required by law or to protect our legal rights.
Coaching session content is confidential. We do not share what you discuss in sessions with anyone, except where disclosure is legally required.
Group Coaching Participants
If you participate in a group cohort, other cohort members will see your name and hear information you choose to share during group sessions. All cohort members are bound by confidentiality agreements. KCG does not share your contact information with other participants.
Portal Users (app.kovachconsultants.com)
If you are a KCG client with a portal account, additional information is collected to deliver coaching services. This section describes what is stored, where it lives, and what you can do with it.
What is stored
- Account information: name, email, phone number, company, and coaching focus.
- Authentication: a one-way cryptographic hash of your password (never the password itself). If you enable two-factor authentication, a time-based one-time-password (TOTP) secret. Session tokens are stored temporarily and expire automatically.
- Coaching content: goals, milestones, progress notes, session notes, direct messages with your coach, course progress and quiz scores, community thread messages, and anything you create with in-portal tools (values worksheets, mind maps, bullet journals, sketches, working notes).
- Payment records: Stripe processes payments on behalf of KCG. The portal stores a record of each transaction (amount, date, status, invoice reference). Card details are not stored in the portal — Stripe holds those directly.
Where it lives
Portal data is stored on Cloudflare infrastructure (Cloudflare D1 database, Cloudflare KV, Cloudflare Pages, Cloudflare Workers). It is encrypted in transit and at rest. User sign-in is handled by Supabase, which provides authentication only and does not store your coaching content. Transactional email is sent via Resend. No portal data is sold, shared with third parties, or used for advertising. The portal does not use tracking cookies, behavioral analytics, or advertising networks.
Who can see your data
Your coach (Jess Kovach) has access to the coaching content associated with your account — session notes, goals, progress, messages, and coursework — to support the coaching relationship. In community threads, other participants can see only what you post in the thread itself; privacy settings in your account control what other community members can see about your profile. No one outside KCG has access to your data unless legally required.
Your rights as a portal user
- Export your data. Goals, journal entries, and worksheets can be exported to PDF from within the portal at any time.
- Request a full copy of all data associated with your account by emailing privacy@kovachconsultants.com.
- Request deletion of your account and all associated data via Account Settings or by emailing privacy@kovachconsultants.com.
Portal data retention
Portal data is retained while your account is active. If your account is closed or your coaching engagement ends, data is kept only as long as needed for legitimate purposes (for example, financial records required by law) or at your request. You can ask for earlier deletion at any time.
Data Retention
We retain your personal information for as long as your engagement is active and for a reasonable period afterward to fulfill legal, accounting, and reporting obligations. Coaching session notes are retained for two years after your engagement ends, then permanently deleted. You may request earlier deletion by contacting us.
Analytics event data is retained in Google Analytics for a limited window set in our account, then deleted automatically; only aggregate reports persist. The cookie lifetimes listed under Cookies apply on your device.
Data Security
We use industry-standard security measures to protect your information, including encrypted connections (HTTPS), secure payment processing through Stripe (PCI-compliant), and access controls limiting who can view client data. No method of transmission or storage is 100% secure. We cannot guarantee absolute security but take reasonable steps to protect your data.
Use of AI in Our Work
We use AI-assisted tools to help with research, synthesis, and drafting in our advisory and classification work. AI assists; it does not make the decision. The professional judgment and the final review are human, and a named person is accountable for any recommendation we deliver. Before any client material is used with an AI tool, it is redacted, and only the redacted result is used. Redaction is field- and flag-based, removing designated fields and flagged values rather than scanning free text. It runs entirely in your browser: the document is never uploaded to our servers, and it is not stored, logged, or transmitted. You can verify this in your browser's developer tools, under Network. We do not permit our AI providers to train their models on your data, and we do not put raw client identifiers into general-purpose AI tools.
Questions and Recourse
If a recommendation or decision in our work affects you and you want to know whether and how AI was involved, you can ask. Email support@kovachconsultants.com, and we will provide a plain-language explanation and a way to correct or contest it. We respond within 30 days.
Your Rights
You may request access to the personal information we hold about you, correction of inaccurate information, deletion of your personal information (subject to legal retention requirements), or a copy of your data in a portable format. To exercise any of these rights, email support@kovachconsultants.com. We will respond within 30 days.
You can change or withdraw your cookie choices at any time at Cookie settings.
KCG is a small practice, below the thresholds of the California Consumer Privacy Act and similar state privacy laws. The rights above are not offered because a statute requires them. They are offered to everyone because that is how this practice works.
Cookies
The site sets nothing optional until you choose. A banner asks on your first visit, and you can change your answer at any time at Cookie settings.
- Necessary — always on. A first-party cookie (
kcg_consent, one year) stores your cookie choice. A theme preference lives in your browser's local storage. The embedded Calendly scheduler sets its own short-lived security cookies (bot and fraud protection). - Analytics — off until you allow it. Allowing analytics turns on Google Analytics, which sets
_gacookies (up to two years). Turning analytics off removes those cookies from your browser. - Marketing — off until you turn it on. It loads the Facebook page feed on the Services page. Meta sets its own cookies inside that feed; we cannot remove those from here, but they load only if you enable the feed.
No analytics data is sent to Google unless you allow analytics. We honor the Global Privacy Control browser signal as a decline: if your browser sends it, the banner does not appear, previously stored permissions are not applied, and everything optional stays off unless you deliberately turn a category on at Cookie settings. We do not respond to the older Do Not Track header. Once you enable a category, its third party (Google, or Meta) may collect information across sites under its own policy.
Third-Party Services
Our services integrate with third-party platforms: Stripe (payments), Calendly (scheduling), Formspree (contact form), Google (Tag Manager and Analytics, consent-gated), Meta (embedded Facebook feed, loads only when you enable it), Supabase (portal authentication), Resend (transactional email), and video conferencing tools. Each has its own privacy policy. We encourage you to review them.
Visitors in the EEA and UK
Our legal bases for processing are: your consent, for analytics and marketing cookies (withdrawable at any time at Cookie settings); performance of a contract, for delivering client services; legitimate interests, for running and securing the site; and legal obligation, for tax and financial records. Analytics data is processed by Google LLC in the United States under the EU-U.S. Data Privacy Framework and its UK Extension. You may lodge a complaint with your local data protection authority.
Children's Privacy
Our services are designed for adults in professional settings. We do not knowingly collect information from anyone under 18. If we learn we have collected information from a minor, we will delete it promptly.
Changes to This Policy
We may update this policy as our practices or legal requirements change. Updates take effect when posted. We will notify active clients of material changes by email.
Contact
For privacy-related questions or to exercise your data rights, email support@kovachconsultants.com.