This Privacy Policy explains what personal data Kynetiq collects, why we collect it, and what rights you have. It applies globally and is written to comply with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and equivalent privacy laws in other jurisdictions.
1. Who we are
Kynetiq operates the coaching marketplace at kynetiq.app. Kynetiq is currently operated as an unincorporated trading name pending incorporation; this section will be updated to reflect the registered entity (including registered office and company number) on incorporation. You can contact us at support@kynetiq.app for any privacy matter, including data subject requests.
2. Data we collect
- Account data: name, email, hashed password, phone number, date of birth, postcode.
- Coach profile: photo, bio, headline, coaching category, qualifications, certificates, location, pricing, availability.
- Booking data: sessions booked, classes attended, prices, cancellation reasons, reviews.
- Payment data: handled by Stripe; we store only non-sensitive metadata such as card brand, last four digits, and Stripe customer / connected-account identifiers. We do not store full card numbers.
- Communications: messages you send to support and any feedback you submit.
- Device and usage: IP address, browser type, device type, pages viewed, approximate location derived from postcode, basic analytics, and error reports.
3. Why we use it (legal bases)
- Contract: to operate the marketplace, take bookings, process payments and refunds, and provide customer support.
- Legitimate interests: to verify coach identity and qualifications, prevent fraud and abuse, secure the Platform, and improve our products.
- Legal obligation: to retain tax, accounting, and dispute records, and to respond to lawful requests from authorities.
- Consent: for marketing emails (where required) and for any optional analytics or cookies that require consent in your jurisdiction. You can withdraw consent at any time.
4. Sharing
We share personal data only with the categories of recipient below, under appropriate contractual safeguards:
- Stripe - payment processing, payouts, fraud prevention.
- Supabase - database and authentication hosting.
- Google - optional sign-in and Maps services.
- Email and analytics providers - to deliver transactional emails and detect product issues.
- Authorities - where required by law or to protect vital interests.
- Acquirers - in connection with a merger, financing, or sale of assets, under equivalent privacy obligations.
We do not sell personal data and we do not "share" it for cross-context behavioural advertising, as those terms are defined under US state privacy laws including CCPA/CPRA.
5. International transfers
Kynetiq is a global service. Personal data may be processed in countries outside your own, including the United Kingdom, the European Economic Area, and the United States. Where we transfer personal data from the UK or EEA to a country without an adequacy decision, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with supplementary measures as appropriate.
6. Retention
Booking, payment, and tax records are retained for up to 6 years to meet accounting and tax obligations. Other account data is deleted or anonymised within 30 days of account deletion, except where longer retention is required by law. Backup copies are overwritten on our provider's standard rotation schedule.
7. Your rights
Depending on where you live, you have the right to:
- access, correct, port, or delete your personal data;
- restrict or object to certain processing;
- withdraw consent at any time;
- opt out of "sale" or "sharing" of personal data (we do neither, but the right exists);
- not be subject to discrimination for exercising any of these rights;
- lodge a complaint with a supervisory authority - in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your local Data Protection Authority; in California, the California Privacy Protection Agency.
You can exercise most rights directly from Settings, or by emailing support@kynetiq.app. We will respond within 30 days (45 days for CCPA requests).
8. Children
The Platform is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
9. Security
We use industry-standard safeguards including encryption in transit, access controls, audit logs, and Row-Level Security in our database. No system is perfectly secure; we encourage you to use a strong, unique password and to report any suspected compromise.
10. Cookies
See our Cookie Notice for details.
11. Changes
We will notify you of material changes by email and on the Platform at least 14 days before they take effect.