The XSS Rat · Coaching
Privacy policy
Last updated 24 October 2026 · Privacy policy · Terms of service
1. Who we are
This privacy policy covers the coaching application at https://coach.ratctf.com ("Coach", "the app"). The data controller is The XSS Rat (Wesley Thijs) (KBO/BCE 0795300624), Joseph Smeetslaan 21, 3630 maasmechelen, established in Belgium. Contact: info@thexssrat.com.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Student identity and contact details (name, e-mail, phone, preferred channel and handle, time zone) | Delivering the coaching you bought: scheduling, reminders, sharing materials | Performance of a contract (art. 6(1)(b) GDPR) |
| Intake and coaching records (background, goals, lesson notes, skill ratings, uploaded reports, recording links, certificates) | Running and documenting the coaching programme and issuing certificates of completion | Performance of a contract; legitimate interest in keeping a coaching record (art. 6(1)(f)) |
| Prospecting-form answers and quiz score | Assessing fit and level before a first session | Steps prior to entering into a contract (art. 6(1)(b)) |
| Coach account data (name, e-mail, Google account identifier, certificates listed by the coach) | Authentication and showing students who coaches them | Legitimate interest; performance of a contract |
| Technical logs (IP address, timestamps, mail delivery status) | Security, abuse prevention, troubleshooting | Legitimate interest (art. 6(1)(f)) |
3. Google user data
Coaches may sign in with Google. With their explicit consent the app then uses Google APIs to: read and create events on the coach's own calendar (to book and sync coaching calls and create Google Meet links), send e-mail from the coach's own address (reminders and notifications to that coach's students), and read a shared Google Drive folder of course materials and the coaching spreadsheets the coach chooses to import.
Coach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features above, is never sold, never used for advertising, and never used to train AI models. OAuth refresh tokens are stored encrypted (AES-256-GCM) and can be revoked at any time in the app (Settings → disconnect) or at myaccount.google.com/permissions.
4. AI assistance
If a Claude (Anthropic) API key is configured, the app sends the minimum necessary context — a student's first name, lesson title and package summary, lesson history and skill ratings — to Anthropic's API to draft reminder e-mails and course recommendations. No uploaded reports, recordings or quiz answers are sent. Anthropic processes this data as our processor under its commercial terms and does not use API data to train models.
5. Recipients and transfers
Hosting: Akamai/Linode (Kubernetes cluster, EU region Frankfurt) with Cloudflare in front for TLS and DDoS protection. E-mail: Google (Gmail API) or the SMTP provider configured by the controller. AI: Anthropic (USA) under the EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable. Google LLC processes Google-account data under its own terms. We do not sell personal data and do not share it with anyone else, except where the law requires.
6. Security
All personal data fields and every uploaded file are encrypted at rest with AES-256-GCM using a key held outside the database; transport is TLS only; access is limited to allow-listed coach accounts; session cookies are HttpOnly, Secure and SameSite. Certificates are verifiable publicly by ID only; the holder's name is shown publicly only if the student opts in.
7. Retention
Coaching records are kept for the duration of the coaching relationship and 5 years after the last session (Belgian limitation period for contractual claims; accounting records 7 years where invoices are involved). Prospecting answers from people who do not become students are deleted after 12 months. Technical logs are kept for 90 days. You can ask for earlier deletion at any time.
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time (without affecting prior processing). Write to info@thexssrat.com; we answer within one month. You can also lodge a complaint with the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be, contact@apd-gba.be.
9. Cookies
The app sets one strictly necessary session cookie ("coach") to keep you signed in. No analytics or advertising cookies are used.
10. Minors
Coaching is intended for adults. Where a minor is coached, we process their data only with the consent of a parent or guardian (art. 8 GDPR; 13 years under Belgian law for information-society services, and in any case with guardian involvement for a paid coaching contract).
11. Changes
We may update this policy; the date at the top changes when we do. Material changes are announced to active students by e-mail.