Privacy Policy

The controller responsible for the processing of your personal data is KITECONNECT SL, NIF B71549216, with registered office at C/ Mirador de Guendulain, 13, Zariquiegui, 31190 Cizur (Navarra), Spain.

Registered with the Commercial Registry of Navarra, Section 8, Sheet NA 45031, Entry 1.

You can contact us about any privacy-related matter at admin@kiteconnect.es.

Depending on how you use KiteConnect, we may process:

• account data, such as email address and display name;
• residence or approximate geographical area chosen by you;
• data necessary for authentication and security;
• kites, drafts, titles, notes, photographs, illustrations, drawings, audio, handwritten texts and other content you add;
• symbolic recipient, emotional intention, language and flight area;
• favourites, connection requests, connections, blocks and conversations;
• reports, moderation decisions and associated evidence;
• subscription data, plan status and technical references necessary to link your account to the payment provider;
• support requests and communications related to the service;
• prompts or content voluntarily sent to the creative assistant;
• technical information essential for security, abuse prevention, auditing and operation of the service.

KiteConnect is designed for personal stories.

By its nature, a story may contain especially sensitive information about the person writing it or about third parties.

KiteConnect does not need or request data on health, beliefs, political opinions, racial or ethnic origin, sexual orientation, sex life or other especially protected categories in order to create an account or use the service's basic features.

We recommend not including especially sensitive categories of data about third parties unless a sufficient legitimate basis exists for doing so.

Where a specific processing activity involving special categories of data requires explicit consent or another additional safeguard under applicable law, KiteConnect will apply the corresponding mechanism before carrying out that processing.

Providing KiteConnect and managing your account: performance of the requested service and of the contractual relationship.

Saving, managing and displaying your kites in line with your decisions: performance of the requested service, without prejudice to any additional legal basis that may be required in respect of especially protected data.

Connections and conversations between users: performance of the requested service.

Security, abuse prevention and fraud prevention: legitimate interest and, where applicable, compliance with legal obligations.

Moderation, report management and protection of users and third parties: legitimate interest, performance and compliance with the Terms and legal obligations where applicable.

Subscriptions and billing: performance of the contract and tax and accounting legal obligations.

Operational communications relating to the service: performance of the service and of the contractual relationship.

We do not sell your personal data.

We do not use your stories for targeted advertising.

KiteConnect may offer a creative assistant based on artificial intelligence.

When the user voluntarily requests this feature, the content necessary to generate the response may be sent to the AI technology provider.

KiteConnect currently provides this feature through Lovable's artificial intelligence gateway, which routes the request to Google's Gemini model. If we change provider or model, we will update this policy.

AI is a creative and expressive aid: it does not replace the user's intention, voice or final decision.

KiteConnect does not accept connections automatically through AI.

KiteConnect does not apply significant sanctions solely through automated decisions.

Authorised members of our team (Guardians and Admins) may access content when necessary to:

• review kites submitted for review before publication;
• investigate reports received;
• manage abuse or security situations;
• respond to security incidents;
• comply with legal obligations.

Private conversations are not reviewed as a matter of course. They may only be consulted where justified by a report, a situation of abuse, security, the protection of rights, or a legal obligation.

Access and relevant decisions are restricted to authorised personnel and are recorded in an auditable manner.

To provide the service we work with the following providers:

• Supabase — database, authentication and file storage;
• Lovable — hosting and deployment of the application, as well as the artificial intelligence gateway used by the creative assistant;
• Resend — email sending;
• Stripe — payments and subscriptions.

Each provider acts in accordance with its corresponding role and the applicable contractual agreements, and only for the purposes described in this policy.

Some technology providers may process information outside the European Economic Area.

When this occurs, we will apply the transfer mechanisms provided for by data protection law that are valid in each case.

We apply different retention periods depending on the type of data:

• account data: for as long as the account remains active;
• kites and content: for as long as you keep them on the platform;
• connections and conversations: for as long as necessary to provide the service;
• billing data: for the periods legally required;
• reports, abuse evidence and security records: for as long as necessary for their handling or for defence against claims;
• technical and security logs: for limited and proportionate periods;
• backups: until their ordinary rotation.

For these reasons, deletion is not always instantaneous: deletion or anonymisation begins within reasonable technical timeframes and subject to applicable legal exceptions.

You may exercise the rights of access, rectification, erasure, restriction of processing, objection and portability where applicable, as well as withdraw your consent where processing is based on it.

Exercising these rights is free of charge and will never depend on a paid plan. You can write to us at admin@kiteconnect.es.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if you consider that the processing does not comply with applicable law.

We apply proportionate technical and organisational measures: role-based access control, an auditable log of sensitive decisions, and private storage of the files you upload.

Credentials are managed using secure authentication mechanisms and passwords are not stored in plain text.

No system can guarantee absolute security; we work to reduce risks and respond quickly to incidents.

KiteConnect currently uses only essential or functional technologies: the access session, a temporary verification item during registration, local recovery of drafts and certain interface preferences.

We do not use third-party analytics, advertising or cross-site tracking. Details are described in the Cookie Policy.

KiteConnect is directed exclusively at people over 18 years of age. Use of the service by minors is not permitted.

When we make material changes to this policy, we will communicate them in a reasonable manner and, where required by law, we will request fresh acceptance or consent before continuing.

For any question relating to privacy you can write to us at admin@kiteconnect.es.