Skip to content
The CBJ Way, Core Energy Coaching

Legal

Privacy Policy

This Privacy Policy explains what personal data we collect when you use this website, why we collect it, how we use and protect it, and the choices and rights you have. We’ve written it to be accurate to what the site actually does today, and we’ll update it as the site grows.

Last updated: June 2026

Who we are

This website is operated by Courtney-Brooke Johnson Coaching (“we,” “us,” or “our”), an executive-coaching practice serving leaders in fashion, beauty, and entertainment. For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Courtney-Brooke Johnson Coaching is the data controller for the personal data described in this policy.

If you have any questions about this policy or how we handle your data, you can reach us through the contact form. A dedicated privacy@ email address will be published with the production domain.

What we collect

We only collect data that you provide or that the site needs to function and stay secure:

  • Contact form.When you reach out, we collect your first name, last name, email address, your role & company, and the message you send us.
  • The free Energy Audit.When you take the Energy Audit, we store your answers and a computed “band” result. There is no account and we do not ask for your name, so on its own the audit does not identify you, but as an abuse-prevention measure we attach an ip_hash to the submission (see below), which we treat as personal data.
  • Email sign-ups.If you ask for occasional notes by email, using the form in the footer or the one shown with your Energy Audit result, we store your email address and which of those two places you signed up from. When you sign up from your audit result we also store the “band” you scored, so that the notes we send you are the ones we offered. You can also opt in with a checkbox on the contact form, which is off unless you tick it; in that case we record your choice and when you made it, against your contact record.
  • Abuse-prevention signals. When you submit the contact form, the Energy Audit, oran email sign-up, we store a salted HMAC hash of your IP address (“ip_hash”); the contact form additionally stores your browser’s user-agent string. We treat the ip_hash as personal data. We use it only for abuse prevention and rate-limiting, never to track you across the web.

How we use it

We use the data above to:

  • respond to your inquiries and follow up about coaching engagements;
  • compute and show you your Energy Audit result, and understand, in aggregate, how the audit is used;
  • protect the site from spam, abuse, and automated attacks (rate-limiting and bot-protection); and
  • meet our legal, accounting, and security obligations.

We do not sell or share your personal data, and we do not use it for behavioural advertising.

Legal bases

Where the GDPR applies, we rely on the following legal bases for processing your personal data:

  • Consent: for any newsletter subscription you opt into, and for the optional, consent-gated analytics you accept.
  • Legitimate interests: to respond to your contact-form messages, to understand how the Energy Audit is used in aggregate, and to keep the site secure (including the abuse- prevention ip_hash). We balance these interests against your rights.
  • Legal obligation: where we must retain or disclose data to comply with applicable law.

Cookies & analytics

This site uses three analytics tools, and they behave differently:

  • Google Analytics 4, to understand how people find and move through the site. It does set cookies (for example _ga), which it uses to recognise a returning browser and count a visit as one visit rather than several. We have not enabled Google Signals, advertising features, or ad personalisation, so your activity here is not added to an advertising profile.
  • Vercel Analytics and Vercel Speed Insights, for aggregate traffic and page performance. These are cookieless and do not build cross-site profiles.

All three are off by default and load only after you accept them in the cookie banner. Nothing is sent before you choose: if you decline, or simply never answer, the Google Analytics script is never requested at all. You can change your choice at any time using “Cookie preferences” in the footer; declining afterwards stops any further collection. We use no behavioural-advertising trackers.

Who we share it with

We use a small number of trusted service providers (processors and sub-processors) to run the site. Each processes data on our behalf, under contract, and only as needed to provide their service:

  • Vercel: hosting and content delivery (CDN).
  • Google Analytics: website analytics (only if you accept them in the cookie banner).
  • Neon: database.
  • Mailgun: transactional email (when enabled).
  • Kit / ConvertKit: newsletter delivery (only if you opt in).
  • Cal.com: scheduling (when enabled).
  • Cloudflare: DNS and Turnstile bot-protection (when enabled).

We may also disclose data where required by law, or to protect our rights, safety, and the integrity of the site.

How long we keep it

We keep personal data only as long as we need it for the purposes described above:

  • Abuse-prevention signals (the ip_hash, and the user-agent stored with contact submissions) are cleared after 90 days, by an automated daily job.
  • Unconverted leads (contact-form inquiries that do not become coaching clients) are deleted after 24 months.
  • Energy Audit answers are anonymous; once their ip_hash is cleared (90 days) the remaining answer data no longer identifies you and is retained in aggregate to understand how the audit is used.
  • Email sign-ups are kept until you unsubscribe, because they exist on your consent and deleting them on a timer would remove the record of that consent. Their ip_hash is cleared after 90 days on the same schedule as everything else above. Ask us to remove you at any time and we will.

Where we have ongoing client or legal obligations, we keep the relevant records for as long as those obligations require.

Your rights

Depending on where you live, you have rights over your personal data.

Under the GDPR (EU / UK)

You have the right to access your data, rectify inaccurate data, request erasure, request portability of data you provided, restrict processing, and object to processing based on legitimate interests. You may also withdraw consent at any time and lodge a complaint with your local supervisory authority.

Under the CCPA / CPRA (California)

You have the right to know what personal information we collect, to delete it, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal data.

To exercise any of these rights, contact us through the contact form. We will respond within the timeframe required by applicable law.

International transfers

We are based in the United States, and some of our service providers process data in the United States and other countries. Where personal data is transferred out of the EU or UK, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses and the UK Addendum) so that your data remains protected.

Children

This site and our services are directed to professionals and are not directed to children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time to reflect changes to the site, our service providers, or the law. When we do, we will revise the “Last updated” date above. Material changes (such as introducing analytics) will be reflected here before they take effect.

Contact

For any privacy request or question, reach us through the contact form. A dedicated privacy@ email address will be published with the production domain. This policy is governed by the laws of the State of New York, USA.