Privacy Policy

1. Who we are

Kava is operated by Sysper Inc., 1807 N Highland Ave, Arlington Heights, IL 60004, USA. For any privacy question or request, email support@kavacoach.com.

2. Our role and your coach's role

For account data (your login, profile, billing) and for running and securing the platform, Kava decides how data is used and is the data controller.

Coaches are independent professionals. For the information a coach collects about their clients through Kava (questionnaire answers, session notes, coaching plans, AI summaries), the coach is the controller and Kava processes that information on the coach's behalf, following their instructions and this policy. If you are a client, your coach is responsible for having a lawful basis to collect your information, and you can ask your coach directly about it.

3. Data we collect

Account data: name, email address, password (stored only as a secure hash by our authentication provider), whether you are a coach or a client, and optionally your phone number, profile photo, time zone and language.

Coach profile: what a coach chooses to publish, such as a bio, specialties, hourly rate and photo. A coach decides whether their profile is public.

Coaching data: links between coaches and clients, invitations (including the invited person's email address), session availability and bookings, questionnaire questions and answers, notes coaches write about clients, coaching plans, workshops and enrollments, and requests clients send to coaches.

AI summaries: if a client consents, a summary and suggested coaching plan generated from their questionnaire answers (see How we use AI).

Billing data (coaches): your plan, subscription status and identifiers from our payment provider, Stripe. Card details are entered on Stripe's pages and never reach or are stored by Kava.

Technical data: sign-in session data, and server logs (such as IP address, browser type and requested pages) that our hosting provider keeps briefly for security and troubleshooting. When something breaks, we record an error report: technical details of the error, the page, your browser and your user ID. We remove email addresses, form contents and sign-in data from these reports. When you sign up, sign in or ask for a password reset, a bot check (Cloudflare Turnstile) looks at technical signals from your browser, such as your IP address and browser characteristics, to tell people from automated programs. It does not track you across sites. We do not use analytics, advertising or tracking tools.

Questionnaire answers and notes can reveal sensitive information, such as health or wellbeing. Please share only what you are comfortable sharing with your coach. Coaching is not healthcare, and Kava is not designed to store medical records.

4. How we use data and our legal bases

• To provide Kava (accounts, scheduling, questionnaires, notes, workshops, emails such as booking confirmations): necessary to perform our contract with you.
• To take payments and keep financial records (coaches): contract, and our legal obligations for tax and accounting records.
• AI summaries of questionnaire answers: only with the client's explicit consent, which can be withdrawn at any time.
• To keep Kava secure and prevent abuse (for example, rate limits, usage limits on AI features, fraud checks and logs): our legitimate interest in protecting our users and the service.
• To tell you about important changes to the service or these terms: contract and legitimate interest. We do not send marketing emails without your consent.

We do not sell personal data, do not share it for targeted advertising, and do not use it to build advertising profiles.

5. How we use AI

Coaches on the Pro plan can receive an AI-generated summary and suggested coaching plan based on a client's onboarding questionnaire. This happens only if the client ticks the optional consent box when submitting the questionnaire. If the client does not consent, the answers are still shared with their coach but are never sent to an AI provider.

When a client consents, we send the questionnaire questions and answers, and the coach's stated coaching preferences, to Anthropic, PBC (United States), which provides the AI model. The result is stored in Kava and is visible only to that coach. Under Anthropic's commercial terms, data sent through its API is not used to train its models and is kept only for a limited period for safety and abuse monitoring.

AI summaries can be wrong or incomplete. They are a starting point for the coach, not a professional, medical or psychological assessment, and no decision with legal or similarly significant effects is made about anyone automatically.

A client can withdraw consent at any time by asking their coach to reopen the questionnaire and submitting it again without ticking the box, or by contacting us. Withdrawing consent does not affect processing that took place before.

6. Who we share data with

Within Kava, information is shared only as the service requires: a coach sees their own clients' information; a client sees their coach's public profile and their own bookings and answers. A client cannot see the notes or AI summaries their coach keeps.

We use these service providers (processors), which may only use the data to provide their service to us:

• Supabase (database, authentication and file storage; United States)
• Vercel (application hosting; United States and global edge network)
• Stripe (payments and invoicing; United States)
• Resend (transactional email delivery; United States)
• Sentry (error reports, to find and fix problems; United States)
• Cloudflare (bot check on sign-up and sign-in forms; United States and global network)
• Anthropic (AI summaries, only with client consent; United States)

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition, in which case this policy continues to apply.

7. International transfers

Kava's data is stored in the United States. If you use Kava from the EU, the UK or Turkey, your data is transferred to the US. We rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-US Data Privacy Framework where a provider is certified, and, for transfers from Turkey, the standard contracts required under Article 9 of KVKK.

8. How long we keep data

• Your account and coaching data: until you delete your account. Deletion is immediate and permanent.
• Backups: deleted data can remain in encrypted database backups for up to 7 days, after which it is overwritten.
• Server logs: kept for a short period, no longer than 30 days.
• Error reports: kept for up to 90 days.
• Payment records: Stripe keeps invoices and payment records for as long as tax and accounting law requires, even after your account is deleted.
• AI usage records: we keep the number of AI requests and their cost for budgeting; when an account is deleted, these records no longer identify anyone.

9. Security

Data is encrypted in transit (HTTPS) and at rest. Access is restricted so each user can reach only their own data, and passwords are stored only as hashes. Sensitive actions, such as deleting your account, require your password. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent at any time.

You can exercise most of these yourself in Kava: edit your profile in Settings, download all your data in Settings → Account → Download my data, and delete your account in Settings → Account → Delete account. For anything else, email support@kavacoach.com. We reply within 30 days and may ask you to confirm your identity.

Clients: for information your coach holds about you (such as notes), you can ask your coach directly; we will also help. Deleting your Kava account deletes that information too.

EU and UK: you can complain to your local data protection authority (in the UK, the Information Commissioner's Office).

Turkey: you have the rights in Article 11 of KVKK, including to learn whether your data is processed, request correction or deletion, and object to outcomes of solely automated analysis. You can complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

United States: residents of states with privacy laws (such as California) have the right to know, delete and correct their data, and we will not discriminate against you for using these rights. We do not sell or share personal data as those laws define it.

11. Cookies

Kava uses only cookies that are needed for it to work: to keep you signed in and to remember your language. We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent.

12. Children

Kava is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change. If the changes are significant, we will tell you by email or in Kava before they take effect. The date at the top shows when it was last updated.

14. Contact

Sysper Inc., 1807 N Highland Ave, Arlington Heights, IL 60004, USA. Email: support@kavacoach.com.