Privacy
Policy
We collect what the app needs to work and nothing else. We do not sell data, do not run advertising, and do not track you across other sites. We never see your payment details, because no payment passes through KiteCrew.
1. Who is responsible
The controller is Salty Habbits di Marchi Matteo, VAT IT02850780418, Italy. Contact for any privacy matter: hello@kitecrew.app.
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis |
|---|---|---|
| E-mail and password (stored hashed) | To create and secure your account | Performance of a contract |
| Name, home spot, riding level, and anything else you choose to add to your profile | So other users know who they are dealing with | Performance of a contract |
| Profile photograph, if you upload one | To identify you to other users | Consent |
| Listings, photographs and reviews you publish | To operate the noticeboard | Performance of a contract |
| Messages you send through the app | To let you arrange trips, and to resolve reports of abuse | Performance of a contract; legitimate interest in safety |
| VAT number, for organisers | To check it against the EU VIES register before publishing | Legal obligation and legitimate interest in preventing fraud |
| Spot alerts and the e-mail you give for them | To tell you when a trip appears at that spot | Consent |
| Answers to in-app questions and messages sent without an account | To improve the service | Consent |
| Aggregate page views, with no cookies and no cross-site tracking | To see whether the app is used | Legitimate interest |
We do not collect payment card details, bank details or transaction data, because payments do not pass through KiteCrew.
3. Who else sees your data
- Other users. Your name, profile and public content are visible in the app. Your e-mail address is not shown to anyone. When you contact an organiser, they see what you write and whatever contact details you choose to give them — from that moment they are an independent controller of those data and may use them only for that trip.
- Supabase (Ireland, EU) — database, authentication and file storage.
- Netlify — hosting and server functions.
- Resend (Ireland, EU) — sending transactional e-mail.
- Cloudflare — aggregate, cookie-free page statistics.
- Open-Meteo — climate data. Requests for climate data are made from our servers, not from your device.
Each of these acts as a processor under a data processing agreement. Where data leaves the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses.
Type fonts are served from our own domain. No request is made to any third-party font, analytics or advertising network from your device.
4. How long we keep it
- Account and profile — until you delete your account.
- Messages — until you delete your account, or 24 months after the conversation ends, whichever is sooner.
- Listings and reviews — reviews are permanent and stay on the profile they describe, without your contact details, because removing them would make the review system worthless.
- Spot alerts — until you ask to be removed, or 24 months without use.
- Anonymous answers and feedback — kept indefinitely in aggregate form, with no link to you.
- Accounting records — where the law requires it, 10 years, in the minimum form the law demands.
5. Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or send it to another service. You may withdraw consent at any time, without affecting what was done before.
You can delete your account yourself from within the app, under your profile. That removes your profile, photograph, messages, alerts and reviews.
Write to hello@kitecrew.app for anything else. We reply within 30 days. If you are not satisfied, you may complain to your national supervisory authority — in Italy, the Garante per la protezione dei dati personali, garanteprivacy.it.
6. Cookies
We use no advertising or profiling cookies. The app stores a small amount of information on your device to keep you signed in, to remember which questions you have already answered, and to work offline. This is strictly necessary for the service you asked for, so no consent banner is required.
7. Security
Data are transmitted over encrypted connections and access is controlled at database level, so that each user can read only what they are entitled to read. Passwords are stored hashed and are never visible to us. No system is perfectly secure; if a breach occurs that is likely to put your rights at risk, we will tell you and the supervisory authority within the deadlines the law sets.
8. Children
The Platform is for people aged 18 and over. We do not knowingly collect data about minors. If you believe a minor has an account, write to us and we will close it.
9. Changes
We will publish any new version here with a new date, and notify registered users of material changes at least 15 days in advance.
This document is a draft prepared for review by a qualified lawyer before commercial launch.