Privacy Policy • Kelenz

1. Data Controller

The controller of the personal data collected via the Services is Kelenz, whose detailed legal information is set out in our Legal Notice. For any data-protection query or to exercise your rights, please contact contact@kelenz.com. No Data Protection Officer (DPO) has been designated, as the legal threshold is not met; requests are handled directly by the Kelenz team.

2. Data We Collect

Depending on your profile type (Athlete, Coach, Club or Fan) and your use of the Services, we collect the following data:

• Identity and profile: display name, first name, last name, email address, profile picture, biography, date of birth, gender, height, weight, handedness (athlete/coach), nationality, links to your Instagram and X accounts (optional)
• Location: city and country of residence with approximate coordinates (city-level latitude/longitude) when you fill in your location
• Sports data: sport, primary and secondary positions, jersey number, yearly statistics, achievements, career history (successive clubs and teams, years), open-to-recruitment flag
• Posted content: photos and videos with their technical metadata (dimensions, duration, crop), captions, achievements, team and match descriptions
• Direct messaging: 1:1 text and media messages (images, videos), as well as their associated technical metadata (timestamps, read/unread status)
• Social graph: follows, likes, club membership, teams you belong to, blocks, mutes and reports you have submitted
• Profile views: when a user visits a Club profile, their ID, display name, type, photo and the timestamp are recorded and shown back to the targeted Club (only for Clubs with a Pro or Premium subscription)
• Subscription data (Clubs only): plan (Free, Pro, Premium), status, billing period dates, Stripe customer ID, Stripe subscription ID. No card data is collected by Kelenz
• Verification documents (optional): supporting document submitted with a verification request. The document is reviewed then deleted immediately after processing, with no further retention
• Technical data: push notification token (Expo), application version, device type and preferred language for error diagnostics, anonymised error logs, sign-in logs (timestamp, IP address, user agent retained by Supabase Auth)

3. Legal Bases

Under Article 6 GDPR, we process your data on the following legal bases:

• Performance of the contract (Art. 6.1.b): account creation and management, feature provision, subscription and payment processing, support
• Consent (Art. 6.1.a): push notifications, verification document submission, publication of optional content (photo, biography, career)
• Legitimate interest (Art. 6.1.f): service security, fraud and abuse prevention, content moderation, service improvement, anonymised audience metrics
• Legal obligation (Art. 6.1.c): retention of certain data for accounting and tax purposes, response to lawful requests from competent authorities

4. Purposes

We use your data to:

• Create and manage your account, profile and settings, and authenticate your sign-ins
• Display your profile to other users and populate listings (athletes, coaches, clubs, teams, matches) based on your sport, location and activity
• Send you push notifications (new message, like, new follower, new post from someone you follow) according to your preferences
• Measure stability, performance and aggregate usage for service improvement, with no advertising profiling
• Process and store the media you post (avatars, photos, videos, message media) on secure cloud storage
• Manage Club subscriptions, issue and retain payment proofs as required by accounting and tax obligations
• Enable social features (follows, likes, messaging, club membership, teams, matches)
• Respond to support requests, notably via Crisp live chat for Clubs on Pro or Premium plans
• Make your profile publicly accessible on kelenz.com and allow search-engine indexing
• Process reports, enforce these Terms, prevent abusive use (spam, harassment, circumvention)

5. Storage and Security

Your data is hosted on Supabase (PostgreSQL database and authentication), your media on Cloudflare R2 (object storage) under a custom domain. Payments are routed and stored exclusively by Stripe in a PCI DSS compliant environment. JWT access tokens are kept locally on your device via secure storage (expo-secure-store on mobile, encrypted localStorage on web). We apply reasonable technical and organisational measures: end-to-end TLS encryption in transit, role-based access controls, logging of administrative operations, regular backups.

6. Retention Periods

Your data is kept for as long as your account is active. Upon account deletion (from the mobile app), all your personal data, posts, media, messages and social links are deleted immediately and irreversibly, subject to the following exceptions: (i) verification documents are deleted as soon as processed, regardless of account status; (ii) invoices and accounting data linked to a paid subscription are retained 10 years, under Article L. 123-22 of the French Commercial Code; (iii) technical authentication and security logs are kept for up to 12 months; (iv) anonymised error logs may be retained without time limit for service-stability purposes.

7. Processors and Data Sharing

We never sell your data. It is shared only with the technical processors necessary to operate the platform, acting strictly on our instructions and in compliance with GDPR:

• Supabase (database hosting, authentication, edge functions) — Supabase Inc., United States (EU standard contractual clauses)
• Cloudflare R2 (media file storage) — Cloudflare Inc., United States (EU standard contractual clauses)
• Stripe (payment processing and Club subscription management) — Stripe Payments Europe Ltd., Ireland
• Expo (push notification delivery) — Expo, United States (EU standard contractual clauses)
• Google (Sign in with Google authentication, optional) — Google Ireland Limited, Ireland
• Apple (Sign in with Apple authentication, optional, mobile) — Apple Distribution International Ltd., Ireland
• Crisp (support chat for Pro/Premium Clubs) — Crisp IM SAS, France
• Vercel (website hosting and anonymised performance metrics) — Vercel Inc., United States (EU standard contractual clauses)

8. International Transfers

Some of our processors are established outside the European Union (notably in the United States). These transfers are governed by the EU Standard Contractual Clauses adopted by the European Commission, or by equivalent mechanisms (Data Privacy Framework when the processor is certified). We ensure these processors offer a level of protection equivalent to that required by GDPR.

9. Cookies and Trackers

Detailed information about the cookies and trackers used on kelenz.com is set out in our Cookies Policy. In short: no advertising cookies; the only cookies set relate to strict service operation (language preference, sign-in session) or to anonymised performance metrics (Vercel Analytics and Speed Insights, without third-party identifiers). The mobile app does not use cookies.

10. Public Profile Visibility

Athlete, Coach, Club and Fan profiles are public by default on kelenz.com and indexed by search engines. The information displayed (name, photo, sport, city, biography, statistics, career, team, club) is visible to any visitor. This visibility is inherent to Kelenz operating as a sports social network. To remove your profile, delete your account from within the app: your profile is immediately removed from the site and progressively deindexed by search engines.

11. Profile-View Tracking (Pro/Premium Clubs)

When you visit a Club profile, your ID, display name, profile type, photo and the visit timestamp are recorded. This information is shown back to the relevant Club if it holds a Pro or Premium subscription, to help it identify its prospects and reach out. For Free Clubs, only an aggregated counter is retained. This processing relies on the Club's legitimate interest in knowing its prospects; you may object by writing to contact@kelenz.com.

12. Minors

Kelenz is open to users aged 13 and above. For users residing in France aged 13 to 15, the prior consent of the holder(s) of parental authority is required under Article 8 GDPR and Article 7-1 of the French Data Protection Act. If you become aware that a minor under 13 has created an account without authorisation, report it to contact@kelenz.com: the account will be deleted and its data erased as soon as possible.

13. Your Rights

Under GDPR and the French Data Protection Act, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy
• Right to rectification: have inaccurate or incomplete data corrected (editable directly from your profile)
• Right to erasure ("right to be forgotten"): request deletion of your account and all your data, exercisable directly via the "Delete my account" feature in the app
• Right to data portability: receive your data in a structured, commonly used, machine-readable format, on request to contact@kelenz.com
• Right to object: object to the processing of your data, in particular profile-view tracking
• Right to restriction: request the temporary suspension of disputed processing
• Right to lodge a complaint with the CNIL (French data-protection authority, www.cnil.fr) if you believe your rights are not respected

14. Security and Breach Notification

We commit to implementing appropriate technical and organisational measures to safeguard your data. In the event of a breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay and, in accordance with Article 33 GDPR, notify the CNIL within 72 hours.

15. Changes to This Policy

We may update this policy to reflect service or legal-framework changes. The effective date at the top of this page is updated with each revision. Material changes are notified in the app or by email.

16. Contact

For any question regarding this policy or to exercise your rights, you can contact us:

Email: contact@kelenz.com