Kiteschool.co — Privacy Policy
Kiteschool.co is operated by PDL2.0 Holding Company, established in the Netherlands. We are the controller of the personal data described here. Contact us at [insert privacy email] or [insert registered address]. KvK: [insert number].
This policy explains what we process when you browse Kiteschool, sign in as a rider, create a teacher profile, manage a school, send an invitation, give 🔥 or buy a paid school listing or Featured placement. Kiteschool helps people discover providers; it does not book or process payments for lessons.
TL;DR (too long; didn’t read)
We keep this as clear as we can:
- We collect what we need to run accounts, school and teacher profiles, 🔥 voting, invitations, paid listings and Featured placements.
- School and teacher profiles are public by design. Names, photos, locations, contact links, affiliations, 🔥 totals and Featured labels may be visible to anyone and indexed by search engines.
- Your account email, individual voting record, manager-verification details and billing records are not intended to be public.
- If someone invites you to claim a school or confirm a teacher affiliation, we may receive your contact details from that person. An invitation does not subscribe you to marketing.
- We use PostHog for cookieless site analytics at launch, with no visitor identification or session replay. We use storage needed for sign-in and site operation; we do not use advertising or marketing cookies.
- Stripe processes payments. We receive the transaction and billing details needed to activate services and maintain records, not your full card number.
- We use providers including Supabase, PostHog, MailerSend, DigitalOcean and Cloudflare to operate Kiteschool. We do not sell your personal data.
- Service messages and marketing are separate. Creating an account, giving 🔥 or receiving an invitation does not subscribe you to promotional email.
- You can ask us to access, correct or delete your data, subject to records we must keep for legal or legitimate reasons. Dutch financial records are generally retained for seven years.
- Kiteschool is operated by PDL2.0 Holding Company in the Netherlands.
That’s the short version. The details follow.
Data we use and why
| Activity | Personal data | Purpose and GDPR basis |
|---|---|---|
| Visit the site | IP address, browser/device data, requested pages, security and server logs; necessary cookies | Deliver and protect the site; legitimate interests in a reliable and secure service. Non-essential analytics or marketing cookies require consent where law requires it. |
| Create or access an account | Email, name or chosen display name, authentication provider identifier and login events | Create and secure your account; performance of our agreement with you and legitimate interests in preventing abuse. Authentication providers may separately process information under their own policies. |
| Publish a teacher or school profile | Profile name, description, role, location, disciplines, gear, images, public contact details, social links and affiliations; manager identity and verification records | Publish and manage the profile and verify claims; performance of our agreement and legitimate interests in accurate listings and preventing impersonation. |
| Invite or verify a school or teacher | Invitee email or contact details, sender, invitation status, affiliation and correspondence | Deliver invitations, resolve claims and manage relationships; legitimate interests of us and the inviting user. The invited person can contact us to object or correct details. |
| Give 🔥 or use leaderboards | Account identifier, school/teacher voted for, vote timestamp, validation signals and location scope of the profile | Record one authentic 🔥 per profile, calculate rankings and detect manipulation; performance of our agreement and legitimate interests in platform integrity. Your name is not displayed as a voter unless we introduce that feature with separate notice. |
| Pay for a school listing or Featured | Billing contact, business name, order, price, tax, subscription/payment status, Stripe customer and transaction identifiers; limited payment metadata | Take payment, activate paid services, handle support and meet tax/accounting duties; contract and legal obligation. Stripe handles payment card details. |
| Contact us | Message, contact details and related correspondence | Respond to requests, disputes and rights claims; contract, legal obligation or legitimate interests as appropriate. |
| Receive service messages or marketing | Email/phone or WhatsApp contact details, delivery and preference records | Send account, invitation, billing and security messages needed for the service; contract or legitimate interests. Send promotional messages only with consent or another lawful basis where permitted; you can opt out of marketing at any time. |
We do not ask for health data or other special-category data. Please do not include it in profiles or support messages. Public profiles may show a teacher’s name, image, bio, school affiliation, location, disciplines, social and contact links, 🔥 total and position; school profiles may show the school name, logo, description, location, equipment, teachers, contact links, 🔥 total and paid Featured label. Public fields, photos, contact details and links can be viewed, indexed and copied by others. Account email, private manager verification, individual voting records and billing records are not intended to be public. Choose carefully what you publish; some third-party copies may remain after you remove content from Kiteschool.
Where information comes from and who receives it
Most information comes from you. A school manager or teacher may suggest an affiliation or send an invitation; someone may supply a manager’s contact details to invite an unlisted school, which does not subscribe that person to marketing; payment confirmation comes from Stripe; authentication information may come from the sign-in provider you choose. We may use publicly available business information to help create or correct an unclaimed school listing. If an unclaimed listing names an identifiable person, that person may ask us to correct or remove it.
We share information with providers needed to run the service: Supabase for authentication, database and media storage; Stripe for checkout and billing; MailerSend for service email and, if enabled, WhatsApp delivery; DigitalOcean for application hosting; and Cloudflare for network and site services. We share only the data needed for each purpose. We do not sell personal data. We may share relevant records with professional advisers or in a business transfer where lawful and necessary. Schools and teachers receive information you send them through external contact channels under their own privacy practices; visiting an external site or WhatsApp may disclose data directly to that third party. We may disclose information when legally required or to address fraud, rights claims or safety incidents.
Some providers may process data outside the European Economic Area. Where GDPR transfer rules apply, we rely on an applicable adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, with supplementary measures where necessary. Contact us for information on the safeguards relevant to your data.
Cookies and analytics
At launch, we intend to use only storage necessary for the site and account functions, such as sign-in. We do not use advertising or marketing cookies. We use PostHog for limited site analytics in its cookieless mode. In that configuration, PostHog does not place cookies or use local or session storage to remember visitors across visits. We do not use PostHog to identify visitors or record session replays in this launch configuration. PostHog may still receive page-view and event information and briefly process an IP address and browser information to calculate privacy-conscious audience measurements. We do not send email addresses or profile details to PostHog for this purpose.
Retention and security
We keep account and profile data while the account or listing is active, then delete or anonymise it within 30 days after closure unless a dispute, abuse investigation or legal duty requires longer retention. Authentication and security logs are kept only for the time needed to investigate security and misuse. Invitations that are not accepted are removed after 30 days. A limited suppression record may be kept when necessary to honour an opt-out or prevent repeated unwanted invitations. We keep financial and invoice records for the Dutch statutory period, generally seven years. Backup copies may persist briefly after live deletion and are removed on their normal rotation. We apply access controls and reasonable technical and organisational security measures.
Your choices and rights
You can request access, correction, deletion, restriction, portability where applicable, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing. You may edit public profile information or ask us to remove an affiliation; deletion may be limited by legal record-keeping or a live dispute. Send requests to [email protected]. We may need to verify your identity and will answer within the period required by GDPR, ordinarily one month.
You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another competent supervisory authority. We do not make solely automated decisions that have legal or similarly significant effects on you. Organic 🔥 ordering and Featured placement affect visibility, as explained in the Terms, but do not decide access to a lesson.
Children and changes
Accounts and 🔥 are intended for people aged 16 or older. We do not knowingly offer accounts to younger children. If you believe a younger child has supplied personal data, contact us. We may update this policy when our practices change and will show the updated date; we will give additional notice where law requires it.
Last updated: 24 September 2026.