Data administrator
Konrad Cieślukowski is the data controller for personal data described in this policy.
Contact: contac@kickdriven.com
What data is collected
Account data: email address, display name, password hash, and email verification status.
Session data: opaque session tokens (HttpOnly cookies), IP address and browser user-agent stored with active sessions.
Product usage: your selected clubs/countries, generated insight history, subscription tier and Stripe customer identifiers.
Payment: billing email and subscription metadata processed by Stripe; we do not store full card numbers.
Support: email and message content if you use the feedback form.
Technical data: server logs (request metadata; auth cookies are redacted) and basic error reports via Sentry for reliability. Sentry performance tracing runs only if you accept analytics cookies.
Browser storage: we use local storage to remember UI preferences, language and theme choices, anonymous usage gates, and your cookie consent choice.
Why we process data and legal bases
Provide the service (account, insights, authentication): performance of a contract (GDPR Art. 6(1)(b)).
Transactional email (verification, password reset, billing receipts): contract and legitimate interest in secure account operation.
Marketing / product update emails (subscribe flow only, with your opt-in checkbox): consent (GDPR Art. 6(1)(a)); you may withdraw at any time.
Analytics and performance tracing (Sentry, only after you click "Accept all" on the cookie banner): consent (GDPR Art. 6(1)(a)).
Security, abuse prevention, server logs, and basic error monitoring: legitimate interest (GDPR Art. 6(1)(f)), balanced against your rights.
Third-party service providers
We use third-party providers: Stripe for payments and subscriptions, Resend for transactional email, a third-party AI model provider for AI-generated match insights, Sentry for basic error monitoring and optional analytics, and Cloudflare for hosting, CDN, and worker infrastructure.
Depending on the service, these providers may act as our processors or as independent controllers. We only share the data needed for each service and use appropriate contractual safeguards where required.
International transfers
Some providers (including our AI model provider, Stripe, Resend, Sentry, and Cloudflare) may process data in the United States or other countries outside the EEA. Where required, we rely on Standard Contractual Clauses, adequacy decisions, or equivalent safeguards. Details are available on request.
Cookies and similar technologies
Strictly necessary: session cookies (kickdriven.*) to keep you signed in — no consent required.
Reliability: basic Sentry error monitoring can run without performance tracing.
Optional analytics: Sentry performance tracing — only loaded after you accept analytics cookies via our banner.
Browser storage: we use local storage to remember UI state, preferences, anonymous gates, and your cookie consent choice; see the cookie banner for your choices.
Retention
Account data: kept while your account is active and for a reasonable period afterward for legal and billing obligations.
Sessions: up to 30 days of inactivity, then expired.
Insight history: retained while your account exists unless you request deletion.
Server logs: typically rolling retention (e.g. 30–90 days) unless longer retention is required for security investigations.
Your rights
Under GDPR you may request: access, rectification, erasure, restriction, portability, and objection to certain processing. Where processing is based on consent, you may withdraw consent without affecting prior lawful processing.
To exercise rights, email contact@kickdriven.com. We respond within one month where GDPR requires.
You may lodge a complaint with your local supervisory authority. In the EU, this is the authority in your country of residence or place of work.
Children
KickDriven is intended for users aged 18 and over. We do not knowingly collect data from minors.
Changes
We may update this policy. The "Last updated" date at the top reflects the latest version. Material changes will be communicated where required by law.