Privacy Policy

Kivee (“we”, “us”) is a sports academy management platform operated from Spain. That means the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD) apply as our baseline standard — and we apply that same standard to all users worldwide.

Kivee plays two different roles depending on whose data it is:

• Data controller — for the information of academy owners, staff and website visitors (your account, billing and technical data), Kivee decides how and why the data is processed.
• Data processor — for the information of students, guardians and enrollees, the academy is the controller: it decides what data to collect and why, and Kivee processes it on the academy's behalf and under its instructions.

If you are a student or guardian and want to exercise rights over data an academy holds about you, the fastest path is contacting the academy directly. We support academies in fulfilling every request, and you can always reach us at the address below.

We collect only what is needed to run academies on Kivee:

• Account information: name, email address and authentication credentials of academy owners and staff (passwords are handled by our authentication provider and are never visible to us)
• Academy data: student and guardian profiles entered by the academy — name, date of birth, gender, nationality, identity document type and number, contact details, photos, groups, attendance, plans and payment records
• Enrollment submissions: the information a student or guardian submits through a public enrollment form (see the next section)
• Billing information: your academy's subscription plan and payment status; card details are collected and stored by our payment processor (Stripe), never by Kivee
• Technical data: device type, operating system, browser and app interactions, used to keep the service secure and working

Academies can invite students to register themselves through a public enrollment form — no account required. When you submit that form, we collect exactly what you see on it: name, date of birth, gender, nationality, identity document, contact details, guardian details for minors, an optional photo, and your choice of location.

• Your submission is stored as a pending registration that only the academy's staff can see, until the academy accepts or rejects it. Rejected registrations and their photos are deleted immediately.
• We record your consent: the checkbox you tick, when you ticked it, and which version of the consent text you agreed to.
• To prevent abuse of public forms we use Cloudflare Turnstile (an anti-bot check) and store a one-way hash of your IP address — never the address itself — for rate limiting.
• Enrollment invitation links sent by email are personal, single-use and expire after 7 days.

Under the GDPR, every use of personal data needs a legal basis. Ours are:

• To provide the service (performance of a contract): running your academy — students, groups, schedules, payments — and sending transactional emails such as invitations, receipts and reminders
• To keep the service safe (legitimate interest): preventing abuse of public forms, rate limiting, fraud prevention and diagnosing technical issues
• To improve the product (legitimate interest): understanding, in aggregate, which features are used
• With your consent: processing enrollment form submissions, including the photo you choose to upload
• To comply with the law (legal obligation): keeping billing records for tax and accounting purposes

We do not use your data for advertising, we do not sell it, and we do not build profiles for third parties.

Many students in sports academies are minors. Kivee never requires students to create accounts, and we only process a minor's data when it is provided by the academy or submitted through an enrollment form with the confirmation of a parent or legal guardian.

Each academy, as data controller, is responsible for having the right to collect its students' information — including parental or guardian consent where local law requires it. If you believe a minor's data was submitted without proper authorization, contact us and we will work with the academy to remove it.

We never sell personal data. We share it only with the subprocessors required to operate Kivee:

• Google Firebase / Google Cloud — application hosting, database, file storage and authentication
• Stripe — subscription billing for academies
• Resend — transactional email delivery
• Cloudflare — Turnstile anti-bot verification on public enrollment forms

All subprocessors are bound by data processing agreements, may only use the data to provide their service to us, and meet GDPR requirements. We may also disclose data where required by law, or to protect the rights and safety of our users.

Some of our subprocessors process data in the United States and other countries outside the European Economic Area. Whenever data leaves the EEA, the transfer is protected by a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or by Standard Contractual Clauses.

We keep personal data only for as long as it serves the purpose it was collected for:

• Academy and student data: for as long as the academy's account is active. When an account is closed, data is deleted within 30 days.
• Billing and financial records: kept for up to 6 years after the transaction, as required by Spanish commercial and tax law.
• Enrollment registrations: pending until the academy accepts or rejects them; rejected submissions and their photos are deleted immediately, and unused invitations expire after 7 days.
• Consent records: kept for as long as the related data, as proof that consent was given.

All data is encrypted in transit and at rest. Access is isolated per academy and enforced at the database level — an academy's staff can only ever reach that academy's data. Information submitted through public enrollment forms is validated server-side before it is stored and is never publicly readable or writable.

No system is 100% secure. If we ever detect a breach affecting your personal data, we will notify you and the relevant supervisory authority as the GDPR requires (within 72 hours).

Wherever you are, you can:

• Access and export your data in a portable format
• Correct or update inaccurate information
• Delete your account and associated data (“right to be forgotten”)
• Restrict or object to specific processing
• Withdraw consent at any time, for processing based on consent (such as enrollment submissions)

To exercise any of these rights, contact us at the address below — we respond within 30 days at most, and usually within 7 business days. If you are in the EU/EEA you can also lodge a complaint with your supervisory authority (in Spain, the AEPD at aepd.es). Residents of other regions — including countries with habeas data laws in Latin America and California residents under the CCPA/CPRA — enjoy the same rights listed above: we apply the GDPR standard globally.

If your data was entered by an academy (you are a student or a guardian), the academy is the data controller: we will forward your request to the academy and help it respond.

Kivee uses only essential cookies and local storage: keeping you signed in and remembering your preferences. We do not use advertising or cross-site tracking cookies. The public enrollment page loads Cloudflare Turnstile, which may set a cookie strictly to distinguish humans from bots — it is not used for tracking.

We may update this policy as Kivee evolves or as the law changes. When we make material changes, we will update the date at the top of this page and notify academy owners by email. Every enrollment form submission records the version of the consent text that was accepted.