KICKUP Note Privacy Notice

1. Controller

The controller of personal data is NOVA STRATEGY COMPANY LIMITED (Rm 184, 18F Thai CC Tower, 43 S. Sathorn Rd., Yannawa, Sathorn, Bangkok 10120, Thailand). Contact: info@nv-st.com

2. Data we collect

To provide Note we handle: the login email and password (stored only in hashed form), the contract holder's country of residence and date of birth, the guardian's name and consent record when registering as a guardian, the player's display name, grade and age band, records, goals, published reports visible to the player, comments and reactions, enquiries, the device time zone, and the operation history needed to run the service.

With separate notice and consent, AI processes questions, records and published reports selected by the player, text selected for organization, and AI answers. Data of players under 13 is excluded from AI processing.

If paid features are purchased, we handle the purchase identifiers and status received from the store (App Store, Google Play, Stripe). Card numbers are not stored in Note's own database.

3. Purposes

Registration and sign-in, confirming registration conditions and consent, the person's own records and reflection, coach sharing chosen by the contract holder, providing paid features and verifying purchases, responding to enquiries, handling incidents, misuse and safety, and meeting legal obligations.

Explanations and consent for using Note, sharing with coaches and using AI are obtained separately. Consent given to KICKUP Online is not reused for Note.

4. Minor players

Records of minor players are handled within the scope consented to by the guardian who registered as contract holder. We use 18 for residents of Japan and 20 for residents of Thailand as the age of majority and follow the guardian-consent requirements of Thailand's Personal Data Protection Act (PDPA).

A guardian can withdraw consent at any time and request access to, correction of or deletion of the player's data.

5. Who can see data

With a family login you can see the records of the players you own. Sharing with coaches follows the Terms of Use; when sharing is stopped, the coach's access to that data ends.

Our operations staff view records only as needed for support, incidents and misuse, and such access is logged.

6. Processors and processing abroad

We use Supabase for authentication and the database and Vercel for web and API delivery; their data centres are outside Japan and Thailand. Apple (App Store) and Google (Google Play) are used to verify store purchases and Stripe for web payments. Google purchase notifications contain identifiers used to look up the purchase. Record text and player names are never sent as purchase identifiers.

We are located in Thailand and users live in Japan or Thailand. Each processor operates under contracts and security measures required by applicable law, and we supervise them as required.

We use the API of OpenAI, a United States provider, for generation and input/output safety checks. Processing takes place abroad, including in the United States. Only the question and necessary selected text are sent; fixed name, school and contact fields are excluded. API data is not used for model training by default. Response storage is disabled, but inputs and outputs may normally be retained for abuse monitoring for up to 30 days, subject to legal and other exceptions. This is not Zero Data Retention. See the AI Use and Data Notice.

7. Retention and deletion

Records, drafts, export files, routine operation history, statutory records and backups are kept separately.

After a Note closure is accepted, main data is erased within 30 days at most. Export files can be downloaded for 24 hours after completion. Routine operation history without record text is kept for up to 180 days. These are our operational upper limits, not periods for deferring the erasure of data that is no longer needed.

Tax and accounting records and purchase verification records are kept for the period required by applicable law (in principle five years under Thai accounting and revenue law). Backups are encrypted, and restoring a backup never reverses a deletion or a sharing stop.

Data belonging to other services on the shared account (KICKUP Online) is not deleted when only Note is closed. Deleting the whole shared account is explained separately.

8. Security

We protect data with encrypted connections, access control (row-level restrictions), operation logging and supervision of processors. Drafts left on a device are erased at sign-out.

9. Your rights and contact

Requests for access, correction, deletion, restriction, withdrawal of consent and complaints are accepted in the app settings or at info@nv-st.com. We verify the identity of the person or guardian as needed to protect the data. We normally reply within 30 days.

Rights under the Japanese Act on the Protection of Personal Information and Thailand's PDPA are handled through the same contact. Complaints under the PDPA may also be lodged with Thailand's Personal Data Protection Committee (PDPC).

10. Changes

We will announce changes to this notice, with the effective date, in advance in the app or by email. Material changes to the data collected or the purposes require renewed consent.