K
Kaylo
Public infoApril 18, 2026

Kaylo Privacy Policy

Kaylo uses these public privacy notes for store review, support handoff, and direct user reference. They describe the current product behavior without requiring a tenant login.

Effective date

April 18, 2026

Stable URL

/en/privacy

UNIFIED PRIVACY POLICY — Kaylo.cc

Last Revised: October 10, 2026

Welcome to Kaylo! We respect your privacy and are committed to protecting the personal information of our sports academies, coaches, adult athletes, parents, and particularly minor youth participants.

This Unified Privacy Policy explains how FOP YUSHCHENKO OLEKSANDR SERHIIOVYCH (Tax ID / RNTRC: 3431104630, State Register Entry: 23.08.2019, 2 480 000 0000 232410, registered legal address: Apt. 74, 7 Dzherelna St., Kharkiv, 61183, Ukraine) ("Kaylo", "we", "us") collects, uses, processes, and safeguards information through our platform, websites (kaylo.cc, app.kaylo.cc), mobile applications (cc.kaylo.app), Telegram Mini Apps, and related services (collectively, the "Platform").

1. DELINEATION OF LEGAL ROLES (CONTROLLER VS. PROCESSOR)

Data protection laws, including the European Union General Data Protection Regulation ("GDPR"), the UK Data Protection Act, the US state privacy laws, and the Law of Ukraine "On Protection of Personal Data", distinguish between the entities that determine how data is used (Data Controllers) and those that provide technical services (Data Processors).

1.1. When Kaylo Acts as a Data Processor:

For the majority of athlete records, student rosters, training attendance, physical testing data, and team communications, the Sports Academy or Tournament Organizer is the Data Controller (Володілець персональних даних).

  • The Academy decides which players to enroll, what performance metrics to measure, and whether to log injury details.
  • Kaylo acts strictly as the Data Processor (Розпорядник персональних даних), hosting, storing, and securing this information in accordance with the Academy’s configuration instructions and our B2B SaaS Agreement.

1.2. When Kaylo Acts as a Data Controller:

Kaylo acts as an independent Data Controller for:

  • Account registration and login credentials for direct users of our mobile apps;
  • Direct communications with users regarding customer support ([email protected]);
  • Public website visitor telemetry and cookie preferences collected on kaylo.cc;
  • Operation of the AI Avatar Studio and generation of synthetic trading card graphics;
  • Maintenance of security logs, anti-fraud telemetry, and system reliability metrics.

2. CATEGORIES OF DATA WE PROCESS

We process the following categories of information:

2.1. User Profile & Account Data: Full name, email address, phone number, role (parent, player, coach, referee, admin), encrypted password, and branch affiliation.

2.2. Minor Participant Data: Date of birth, age category (e.g., U6–U17), jersey number, assigned sports position, and link to parent/guardian profile.

2.3. Sports & Performance Data: Attendance logs, drill completions, physical benchmark scores (speed, agility, stamina), match statistics (goals, assists, cards), and earned Kaylo Coins.

2.4. Health, Wellness & Injury Data: The Platform may allow an Academy to record wellness check-ins, sleep, soreness, fatigue, injury details, pain ratings, recovery milestones, or return-to-play status. These records may be health data or another specially protected category under applicable law. The Academy, when it determines the purpose and means of this processing, must identify an applicable Article 6 GDPR legal basis and, where GDPR applies, a condition under Article 9 before collecting such information. Kaylo does not choose the Academy’s legal basis for Academy-controlled records.

2.5. Photographs, Video & AI Avatar Data:

  • Uploaded profile photos, matchday celebration clips, video homework drill submissions, and tournament footage.
  • Selfies uploaded to the AI Avatar Studio to generate stylized 3D sports trading cards.

2.6. Financial & Ledger Records: Membership purchase status, event registration history, and internal wallet balances. Note: Full credit card numbers and CVV codes are processed directly by certified payment gateways (Monobank, Stripe, WayForPay, LiqPay) and are never stored on Kaylo servers.

2.7. Device & Telemetry Data: IP address, device model, operating system version, browser type, app crash logs, and consent preferences managed through Ketch CMP.

2.8. Communications & Feature Inputs: Messages, comments, support requests, files or media submitted through the Platform, and information entered into optional AI features (including prompts and generated responses). Academy-managed communications and participant records are processed on the Academy's instructions where it controls those records. The age-range choice on the referral signup screen is used only to route the user; Kaylo does not request or retain a date of birth through that screen.

2.9. Mobile App & Notification Data: App language and settings, push-notification tokens and delivery preferences, and app diagnostics needed to operate and secure the mobile app.

3. HEALTH, INJURY & SENSITIVE DATA

3.1. Academies decide whether to use the Platform’s wellness and injury features and which staff can access the records. Kaylo provides the technical service and processes Academy-controlled records on the Academy’s documented instructions. We do not use Academy-controlled health records for advertising.

3.2. The GDPR treats health data as a special category. Article 9 sets conditions for processing special-category data; Article 35 requires a data protection impact assessment for processing likely to result in high risk; and Article 36 provides for prior consultation with a supervisory authority in specified circumstances where high residual risk remains. These provisions do not create a general notification requirement merely because health data is processed. The responsible controller must assess which duties apply to its processing and jurisdiction.

3.3. Access to Academy records is governed by the Academy’s configuration and applicable role permissions. The Academy is responsible for assigning access only to people who need it for their duties.

4. AI AVATAR STUDIO & PHOTOGRAPHS

4.1. The AI Avatar Studio uses a source photo to generate stylized avatar artwork. Kaylo does not use face recognition to identify users or create biometric templates for unique identification. The source photo may be processed by service providers needed to generate the artwork. Retention and deletion timing depend on the services and providers involved and on applicable security, backup, and legal-retention processes; we do not promise a fixed deletion period here.

4.2. Source photos and generated avatars are not intended for sale to data brokers or use as advertising creative by Kaylo.

5. CHILDREN’S DATA

The Platform is used by sports organizations whose participants may be minors. Age and parental-consent rules depend on the applicable law and the particular service. Under GDPR Article 8, a Member State age threshold of 13–16 applies only to a child’s own consent for a directly offered information-society service; it is not a general minimum age for every form of processing. COPPA may apply to covered US services collecting personal information from children under 13. Where a law requires parent or guardian authorization or verifiable consent, the responsible controller must obtain it before the relevant collection or use.

A parent or guardian may ask to access, correct, object to, restrict, or delete a child’s information where those rights apply. If an Academy controls the records, contact the Academy first or contact Kaylo so we can route the request as appropriate. Requests may be subject to legal exceptions and applicable retention obligations. See the rights section below.

6. PUBLIC PLAYER CARDS & TOURNAMENT SHOWCASE

6.1. Public Showcase Privacy Controls:

  • The Platform includes public tournament viewer modules and digital player showcase cards (PublicPlayerCard).
  • To safeguard child privacy on public web pages, Kaylo implements strict PII redaction (redact-pii.ts):
    • Last names are automatically masked or truncated to initial letters on public rosters;
    • Direct contact details (parent phone numbers, player email addresses) are strictly excluded from public tournament displays;
    • Showcases display only athletic metrics, jersey numbers, and chosen avatar artwork.
  • Parents or academies may toggle player card visibility to private at any time through account settings.

7. USER-GENERATED CONTENT & VIDEO REELS

7.1. Media Uploads: Videos uploaded for video homework drills, matchday highlights, or reels are stored in isolated cloud buckets. 7.2. Visibility Settings: Videos submitted for homework are visible only to assigned coaching staff. Videos published to public reels feeds must have parental authorization and are subject to immediate takedown upon receipt of a safety or copyright report at [email protected] or [email protected].

8. COOKIES, ANALYTICS, ADVERTISING & SERVICE PROVIDERS

We use Ketch on eligible marketing pages to display and store privacy choices. Its interface offers Essential Services, Analytics, and Targeted Advertising categories. The Privacy Settings link reopens those choices.

The platform uses Appwrite for accounts, application services, and files; Cloudflare R2/Kaylo CDN for public media; OpenAI and Google Gemini for AI Support, avatar generation, and audio transcription when the selected feature routes a request to that provider; Firebase for native push notifications and crash diagnostics; Mapbox and Google Maps for maps and geocoding; Open-Meteo for requested weather forecasts; Telegram's Web App script on the Telegram app route; and YouTube for embedded videos. Transfer-history flags and training sound assets are requested from flagcdn.com and Mixkit. Google Fonts are obtained at build time and served as application assets at runtime.

Payments are processed by the provider configured by the relevant Academy when a user starts a payment. The code supports Stripe, Monobank, LiqPay, and WayForPay; the enabled provider depends on that Academy's configuration. The payment provider receives the information needed to complete and reconcile the transaction.

Google Tag Manager container GTM-T99BJNLQ is loaded on eligible web marketing pages. The tags published inside that external container are not visible in the application source and have not been verified for this notice; we therefore do not identify Google Analytics, Meta Pixel, or other container tags as confirmed services here. The container loader is currently invoked before the application's local consent check. We are verifying its published tags and consent behavior. Do not rely on the presence of the Ketch choice interface alone as proof that every tag is blocked until consent.

9. INTERNATIONAL DATA TRANSFERS

Kaylo is established in Ukraine, and service providers may process data in other countries. The location depends on the service and its configuration. Where the GDPR applies and a transfer is subject to its international-transfer rules, an available mechanism under Chapter V of the GDPR will be used where required. Contact [email protected] to request information about the countries, recipients, and safeguards applicable to your data.

10. DATA RETENTION & DELETION

We keep personal data for as long as needed to provide the requested feature, maintain security, resolve disputes, and meet legal obligations. The period depends on the data type, contractual relationship, and applicable law. When an account closes or we receive a valid deletion request, we delete or stop using data where applicable unless a legal obligation or other lawful exception requires retention. Backups may contain data until the provider’s ordinary backup cycle removes it. No single deletion period applies to every data type.

11. YOUR PRIVACY RIGHTS

Depending on applicable law, you may have the right to request access, correction, deletion, restriction, or portability; object to processing; withdraw consent; and complain to a supervisory authority. Some US state laws also provide rights to opt out of targeted advertising or certain sharing of personal information. The Academy handles requests about records it controls; Kaylo will assist or route the request as appropriate.

Where the GDPR applies, we generally respond within one month. If necessary because of the complexity or number of requests, the period may be extended by up to two additional months; we will tell you about the extension and the reasons. We may ask for reasonable information to verify identity and authority. Rights may be subject to legal exceptions and retention obligations.

Where Ukraine’s Law No. 2297-VI applies, you may also exercise the rights set out in that law, including asking about the source, location, and purpose of processing and submitting a complaint to the Ukrainian Parliament Commissioner for Human Rights or a court, as applicable.

12. UPDATES & CONTACT INFORMATION

We may update this Privacy Policy when our practices change and will display the revision date above.

For privacy questions and requests concerning data Kaylo controls, contact our Privacy Contact (this is not a statement that a statutory Data Protection Officer has been appointed):

  • Data Controller: Sole Proprietorship (FOP) YUSHCHENKO OLEKSANDR SERHIIOVYCH
  • Tax ID / RNTRC (РНОКПП): 3431104630
  • State Register Entry Date & Number: 23.08.2019, 2 480 000 0000 232410
  • Registered Legal Address: Apt. 74, 7 Dzherelna St., Kharkiv, 61183, Ukraine
  • Privacy Contact: [email protected]
  • General Support: [email protected]
  • DMCA Copyright Agent: [email protected]
Back to Kaylo homeOpen support page