Privacy Policy

Effective date: 27 June 2026

Last updated: 27 June 2026

This Privacy Policy explains how Stefano Pandolfi, an individual business registered with the Chamber of Commerce of Bergamo (Italy), VAT number IT04656150168, contact e-mail support@kitetribe.app ("KiteTribe", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data when you use KiteTribe, including our mobile application, website, services, features, and related tools.

KiteTribe is a platform for publishing and discovering listings related to kitesurfing, wing, watersports, and related equipment.

This Privacy Policy applies to users, visitors, advertisers, professional profiles, schools, shops, and other persons who interact with our Service. It should be read together with our Terms of Service.

1. Data controller

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws, the data controller is:

Stefano Pandolfi

Registered as an individual business with the Chamber of Commerce of Bergamo (Italy)

E-mail: support@kitetribe.app

Website: https://kitetribe.app

If we appoint a Data Protection Officer or EU privacy representative in the future, their contact details will be added to this Privacy Policy.

2. Personal data we collect

We collect different types of data depending on how you use KiteTribe.

2.1 Account data

When you create or use an account, we may collect:

name;
nickname;
e-mail address;
authentication provider;
user ID;
profile photo;
language;
country;
approximate location;
account creation date;
last login date;
account status (see Section 3.2);
user type, such as private user, school, shop, or professional operator;
verification status and badges;
preferences and settings.

2.2 Authentication data

If you sign in with Apple, Google, or another authentication provider, we may receive data such as:

unique authentication identifier;
e-mail address;
name, where provided;
profile information, where provided;
authentication tokens or technical credentials necessary to manage login.

The data shared with us depends on your settings and the provider's policies.

2.3 Listing data

When you create, edit, publish, or interact with a listing, we may collect:

listing type, such as Sell or Wanted;
title;
description;
category;
subcategory;
brand;
model;
year;
size;
discipline;
price or budget;
condition;
checklist answers;
accessories included;
delivery or collection preferences;
approximate location;
photos;
publication date;
update date;
listing status;
views;
favorites;
contact events;
reports;
moderation history;
the language the listing was originally written in.

2.4 Photos and media

When you upload photos, we may collect and process:

the image file;
compressed versions;
thumbnails;
upload date;
storage path;
technical metadata necessary to display and manage the image.

Photos are compressed and resized on your device before being uploaded. As part of this process, we remove GPS coordinates and other non-essential metadata embedded in the photo file before it is stored or displayed to other users.

2.5 Contact information

Depending on your choices, you may add or make available:

phone number;
WhatsApp contact;
e-mail contact;
website or social link;
business contact details.

If you choose to make these details available in connection with a listing or professional profile, other users may use them to contact you.

2.6 Contact interaction data

When a user clicks contact options, we may collect event data such as:

click on phone button;
click on WhatsApp button;
click on e-mail button;
listing involved;
time of interaction;
general usage context.

We do not record the content of phone calls, WhatsApp messages, or e-mail conversations that occur outside KiteTribe.

2.7 Location data

We may process approximate location data, such as:

city;
municipality;
region;
country;
approximate coordinates;
search area;
distance radius.

We do not intend to display your exact home address publicly. Before a listing's location is shown to other users, we reduce its precision (for example, by showing the centre of a town rather than an exact address).

If you allow device location access, we may use it to show nearby listings, calculate distance, or improve map search. You can disable device location access in your device settings.

2.8 Usage and technical data

When you use the Service, we may collect:

device type;
operating system;
app version;
browser type;
IP address;
language;
country or approximate area;
pages or screens viewed;
search queries;
filters used;
listing views;
favorites;
app events;
crash logs;
diagnostics;
performance data;
security logs, including device-integrity signals used to protect our systems from abuse (see Section 19).

2.9 Advertising and campaign data

If we display advertising or sponsored content, we may collect:

ad impressions;
ad clicks;
campaign ID;
category context;
approximate location context;
language;
device or app context;
time of interaction;
advertising identifier, where you have given consent through Apple's App Tracking Transparency prompt.

We may use this data to measure campaign performance, prevent fraud, and improve advertising relevance.

If we introduce third-party advertising networks or tracking technologies beyond those described in Section 10, we will update this Privacy Policy and, where required, request consent.

2.10 Communications with us

If you contact us for support, legal requests, moderation, reporting, or business inquiries, we may collect:

your name;
e-mail address;
message content;
attachments;
account information;
support history;
technical details relevant to your request.

2.11 Blocking data

If you block another user, we store which user you have blocked so that we can hide their listings and contact details from your account. This information is used only to apply your own preference; it is not shared with the blocked user or with other users, and it does not affect what other users see. You can view and remove blocks at any time from your account settings.

3. How we use personal data

We use personal data for the following purposes:

3.1 To provide the Service

We use data to:

create and manage accounts;
authenticate users;
publish and display listings;
manage photos;
show search results;
show listings on maps;
allow users to contact each other;
manage favorites;
provide notifications;
operate the website and app;
provide customer support.

3.2 To manage listings and marketplace safety

We use data to:

prevent spam;
detect suspicious activity;
review reports;
moderate content;
suspend or remove listings;
apply account-level measures proportionate to the conduct involved — from a lighter, reversible restriction (for example, temporarily preventing new listings) to a temporary suspension pending review, up to a permanent block for serious or repeated violations, as described in our Terms of Service;
support the blocking tool that lets users hide another user's listings and contact details from their own account;
enforce our Terms of Service;
protect users and the integrity of the Service.

3.3 To personalize and improve the Service

We may use data to:

remember language and preferences;
improve search and filters;
improve category structure;
understand demand and supply;
analyze which features are used;
improve app performance;
fix bugs;
develop new features.

3.4 To provide notifications

We may send:

account notifications;
listing notifications;
moderation notifications;
saved search alerts;
administrative messages;
security messages;
service updates;
promotional communications, where allowed.

You can manage certain notification preferences in the app or device settings.

3.5 To show advertising and sponsored content

We may use data to:

display sponsored content;
manage direct advertising campaigns;
measure impressions and clicks;
provide aggregated campaign statistics;
show ads based on language, country, area, category, or app context;
prevent advertising fraud.

We do not sell your personal data.

3.6 To comply with legal obligations

We may use data to:

comply with applicable laws;
respond to lawful requests;
protect our legal rights;
maintain required records;
cooperate with authorities where required;
handle disputes or claims.

4. Legal bases for processing

If the GDPR applies, we rely on the following legal bases.

4.1 Performance of a contract

We process data where necessary to provide the Service under our Terms of Service, including:

account management;
authentication;
listings;
contact tools;
saved preferences;
support.

4.2 Legitimate interests

We process data based on our legitimate interests where appropriate, including:

platform security;
fraud prevention;
spam prevention;
moderation;
service improvement;
analytics;
direct advertising measurement;
business operations;
protection of legal rights.

We balance these interests against user rights and expectations.

4.3 Consent

We rely on consent where required, including for:

certain cookies;
optional marketing communications;
device location access;
push notifications;
advertising identifiers processed following your response to Apple's App Tracking Transparency prompt;
certain advertising or tracking technologies, if introduced.

You may withdraw consent at any time where processing is based on consent.

4.4 Legal obligation

We process data when necessary to comply with legal obligations.

4.5 Legal claims

We may process data where necessary to establish, exercise, or defend legal claims.

5. Publicly visible information

Some information may be visible to other users or visitors, including:

listing title;
listing description;
listing photos;
category;
brand;
model;
year;
size;
price or budget;
approximate location;
publication date;
user name or nickname;
profile photo;
user type;
badges;
professional profile information;
selected contact options.

Do not publish information that you do not want to be visible to others.

6. Contact details and user safety

If you choose to publish or make available phone, WhatsApp, e-mail, or other contact details, other users may contact you outside KiteTribe.

We recommend that you avoid sharing:

home address publicly;
identity documents;
payment card data;
bank credentials;
passwords;
private codes;
sensitive personal information.

KiteTribe does not control communications that occur outside the Service. If another user contacts you inappropriately, you can report them and, independently, block them directly from the app (see Section 2.11).

7. Photos and metadata

Photos may contain metadata, including GPS location or device information.

As described in Section 2.4, we remove or reduce this metadata as part of our upload pipeline, before storing or displaying photos.

However, users should avoid uploading images that reveal sensitive information, such as:

home address;
license plates;
documents;
faces of third parties without consent;
minors;
private spaces;
serial numbers they do not want to share.

8. Cookies and similar technologies

Our website may use cookies or similar technologies to:

keep the website working;
remember preferences;
measure usage;
improve performance;
manage security;
support advertising or sponsored content.

Where required, we will ask for consent before using non-essential cookies or similar technologies.

You can manage cookies through your browser settings and, where available, through our cookie preferences tool.

9. Analytics and diagnostics

We may use analytics and diagnostics tools to understand how the Service is used, fix errors, improve performance, and develop features.

Analytics data may include:

screens viewed;
actions taken;
app version;
device type;
crash logs;
performance events;
general location such as country or region;
technical identifiers.

Where possible, analytics are used in aggregated or pseudonymous form.

10. Third-party service providers

We may use third-party service providers to operate the Service. These providers process personal data only as necessary to provide their services to us and according to applicable agreements. We do not sell personal data to any of these providers.

Providers we currently use include:

Firebase Authentication, Cloud Firestore, Cloud Storage, and Cloud Messaging (Google Ireland Ltd. / Google LLC) — account authentication, database, file storage, and push notifications;
Sign in with Apple (Apple Inc.) — authentication;
Google Sign-In (Google LLC) — authentication;
Google Mobile Ads (AdMob) and Google's User Messaging Platform (Google LLC) — advertising and consent management, subject to your response to Apple's App Tracking Transparency prompt;
Apple Maps / MapKit (Apple Inc.) — displaying listings on a map (we do not use Google Maps for this purpose);
Open-Meteo — weather and wind forecast data shown for a searched location; only the approximate coordinates needed to fetch a forecast are sent, not your account identity.

The list of providers may change over time as the Service evolves; where a change meaningfully affects how your data is processed, we will update this Privacy Policy.

11. International transfers

Some service providers may process data outside your country or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we will use appropriate safeguards where required, such as:

adequacy decisions;
Standard Contractual Clauses;
contractual safeguards;
technical and organizational measures.

12. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

Retention periods may vary depending on the type of data.

12.1 Account data

Account data is generally retained while your account is active.

After account deletion, our account-deletion process removes your account, listings, favorites, saved searches, and notifications (see Section 13). Some data may nonetheless be retained where necessary for legal, security, moderation, fraud prevention, accounting, or legitimate business purposes.

12.2 Listings

Active listings are retained while published.

Expired, removed, sold, found, or deleted listings may be retained for a limited period for moderation, safety, legal, anti-fraud, analytics, or backup purposes.

12.3 Photos

Photos linked to active listings are retained while the listing remains active.

Photos are deleted from storage when the corresponding listing or account is deleted, subject to technical backup periods and legitimate retention needs.

12.4 Logs and security data

Security logs, technical logs, and moderation records may be retained for a period necessary to protect the Service, investigate abuse, and comply with legal obligations.

12.5 Support communications

Support and legal communications may be retained as necessary to handle the request and protect our legal rights.

13. Account deletion

You may request deletion of your account directly from the app (Settings → Delete Account), from the website, or by contacting us at support@kitetribe.app.

Account deletion is processed immediately and is irreversible: it removes your Firebase Authentication account together with your listings, listing photos, favorites, saved searches, and notifications. Reports you have filed against other users are anonymized rather than deleted, so that moderation history involving other users remains intact.

We may still retain certain information after deletion where necessary for:

legal obligations;
security;
fraud prevention;
moderation history;
dispute resolution;
accounting;
legitimate business purposes;
backup systems.

Deleting your account may not automatically delete copies of information that other users have already seen, saved, exported, or received outside KiteTribe.

14. Your privacy rights

Depending on your location and applicable law, you may have the right to:

access your personal data;
receive a copy of your personal data;
correct inaccurate data;
delete your data;
restrict processing;
object to processing;
withdraw consent;
request data portability;
object to direct marketing;
lodge a complaint with a data protection authority.

If you are in the European Economic Area, you may contact your local data protection authority. In Italy, the competent authority is the Garante per la protezione dei dati personali.

To exercise your rights, contact us at:

support@kitetribe.app

We may need to verify your identity before responding.

15. Marketing communications

We may send marketing communications only where allowed by law or where you have consented.

You can unsubscribe from marketing communications at any time using the link in the message or by changing your preferences.

Service-related messages, security notices, account notices, and transactional communications are not considered marketing and may still be sent where necessary.

16. Push notifications

If you enable push notifications, we may send notifications about:

your account;
your listings;
saved searches;
favorites;
moderation;
service updates;
relevant platform activity.

You can disable push notifications in your device settings.

17. Advertising choices

KiteTribe may display advertising or sponsored content.

In the initial version, advertising is managed directly by KiteTribe through Google Mobile Ads (AdMob) and based mainly on contextual information such as category, language, country, approximate area, or screen context, together with your response to Apple's App Tracking Transparency prompt and, where applicable, the consent choices you make through Google's User Messaging Platform.

If we introduce further personalized advertising, additional third-party advertising networks, cross-app tracking, or similar technologies, we will update this Privacy Policy and request consent where required.

18. Children

KiteTribe is not intended for users under 18 years old.

We do not knowingly collect personal data from minors under 18.

If we learn that a minor has created an account or provided personal data, we may delete the account and related data.

If you believe that a minor has provided us with personal data, contact us at support@kitetribe.app.

19. Security

We use reasonable technical and organizational measures to protect personal data, including measures such as:

authentication;
access controls;
database rules;
storage rules;
device-integrity attestation (Apple App Attest, via Firebase App Check) to help ensure that requests to our backend come from our genuine app rather than from scripts or tampered clients;
encryption in transit where supported;
monitoring;
backups;
moderation tools;
administrative permissions.

No system is completely secure. Users are responsible for keeping their login credentials safe and for using caution when communicating or transacting with other users.

20. Data shared by users with other users

When you contact another user or choose to share personal information with another user, that user may process your data independently.

KiteTribe is not responsible for how another user uses information you voluntarily share outside the Service.

Be cautious before sharing:

phone number;
address;
payment details;
documents;
personal information;
location;
sensitive information.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we may notify you through the app, by e-mail, or by other reasonable means.

The updated Privacy Policy will apply from the effective date indicated.

22. Governing language

This Privacy Policy is made available in multiple languages for convenience. In the event of any inconsistency or conflict between versions, the English version shall prevail, unless applicable local law requires otherwise for consumers.

23. Contact

For privacy questions or requests, contact us at:

Stefano Pandolfi

Registered as an individual business with the Chamber of Commerce of Bergamo (Italy)

E-mail: support@kitetribe.app

Website: https://kitetribe.app