Privacy Policy

Operator: KOVA Technologies Inc., a Texas corporation ("KOVA," "we," "us").

Service: app.kova8.com, the KOVA iOS app, and the Director / Coach / Player / Parent / Kiosk portals.

Effective date: The date this version is published in the Service. Version: v1.0 (acceptance is version-recorded; see §13).

Plain-language summary (not a substitute for the full policy): KOVA helps soccer academies develop players. To do that we store information the academy and its families give us, including — where a family consents — video of players who are minors. We use a small set of trusted service providers to run the app, send email, and (for optional AI features) process text. Children under 16 are represented by managed accounts operated by a parent. We describe our optional AI companion in detail below even though it is switched off at launch, so that families know exactly what it would do before it is ever enabled for their child. We never use children's data to train AI models, and we never sell personal information.

1. Scope and the 16 age line

This policy explains how we handle personal information across the Service. KOVA uses a global age line of 16: a person under 16 is represented by a managed account operated by a consenting parent or legal guardian, and does not log in themselves; a person 16 or over may have their own login.

Because the Service is used by and about children, this policy — together with the Parental Consent and Media/Film Release — is written to support compliance with the U.S. Children's Online Privacy Protection Act (COPPA) and comparable rules. KOVA is the operator of the Service and obtains verifiable parental consent directly from parents and guardians in-app, including for all U.S. children under 13, who are covered by the same managed-account model as all children under 16. The Service launches U.S.-only (see §12).

2. Information we collect

• Account and profile information. Names, email addresses (or system-generated placeholder emails), usernames, role (Director / Coach / Player / Parent), academy affiliation, and, for players, date of birth (which determines the managed-vs-independent account boundary) and team assignment.
• Academy content. Rosters, teams, schedules, attendance, training sessions, matches, coach notes, messages, announcements, and similar operational content created by academy staff and families.
• Player-development data. Ratings, assessments, and development metrics generated within the Service about a player's soccer development — for example, technical, tactical, and physical development ratings entered by coaches or generated from film analysis. These are sport-development assessments, not clinical or psychological instruments. They are used only to support coaching and the player's development, are visible only to the academy's authorized roles and the player's family, and are retained under §9.
• Film and video of players. Where a family has consented via the Media/Film Release, video clips of players — including players who are minors — recorded for coaching and development, together with related annotations, voice comments, and automated analysis of that footage. See §7.
• AI companion interactions. If and when the AI companion is enabled for a child (see §6), the messages exchanged with it and limited related development context.
• Technical and usage information. Log data, device information, IP address, and app interaction data used to operate and secure the Service. The Service uses only strictly necessary and functional cookies and equivalent technologies (session, authentication, security, and preference). We use no third-party advertising trackers and no behavioral-advertising SDKs, and we do not respond differently to "Do Not Track" signals because we do not track users across other sites.
• Payment information. Handled by our third-party payment processor, Stripe, Inc.; KOVA does not store full card numbers. Stripe processes payment card data as an independent processor under its own agreements with the paying academy.

We do not knowingly collect more information from or about a child than is reasonably necessary to provide the Service, and we do not condition a child's participation on disclosing more information than is reasonably necessary for the activity.

3. How we use information

We use personal information to: provide and operate the Service and its portals; create and manage accounts and managed sub-accounts; enable coaching, scheduling, attendance, messaging, and film review; generate player-development insights; send transactional email (invitations, password resets, notifications, and, where applicable, safety alerts); secure the Service and prevent abuse; provide optional AI features where consented (see §6); comply with law; and operate our business.

Model training — our position. We do not use children's personal information — including film of minors and AI-companion interactions — to train KOVA's or any third party's AI or foundation models, and our agreements with our AI provider prohibit it from using KOVA inputs and outputs to train its models. We may use de-identified, aggregated data that cannot reasonably be used to identify any person — for example, aggregate feature-usage statistics or aggregate development-trend analytics — to improve the Service, and we commit not to attempt to re-identify de-identified data.

We do not sell personal information, we do not "share" personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws, and we do not use children's personal information for advertising of any kind.

4. Service providers (subprocessors)

We share personal information with a limited set of service providers who process it only on our instructions, under data-processing agreements, to run the Service. All processing occurs in the United States.

• Supabase — database, authentication, and file storage: account data, academy content, player-development data, and stored film/video and images.
• Vercel — application hosting / delivery: serves the web app and processes requests; handles technical/log data.
• Anthropic (Claude models) — AI processing for optional AI features: text sent to and from AI features — e.g., companion messages and limited development context, staff copilot prompts, and message translation — only when those features are used. Under Anthropic's commercial terms, inputs and outputs are not used to train Anthropic's models.
• Resend — transactional email delivery: recipient email address and message content for invitations, notifications, and safety-escalation alerts.
• Stripe, Inc. — payment processing: payment/transaction data.

We maintain this list in this policy and will update it with a new policy version (triggering the §13 notice-and-consent process where the change is material to children's data). We may also disclose information to comply with law, enforce our Terms, protect the rights and safety of children and others, or in connection with a business transfer in which the recipient assumes the commitments of this policy.

5. Legal bases and consent

For information about children under 16, we rely on verifiable parental consent obtained from an authenticated parent or guardian before the relevant processing, as described in the Parental Consent. The v1 method of record is affirmative checkbox acknowledgment given in an authenticated session by a parent who received an email invitation and created their own credentialed account; each consent is recorded with the document version, child, timestamp, and consenting account. Some processing (the Media/Film Release, and the AI companion) requires separate, specific consent captured as its own affirmative act. For non-child data, we process information as needed to perform our contract with you and your academy, to comply with law, and for the legitimate operation and security of the Service.

6. The AI companion and AI features — full disclosure (feature ships OFF)

KOVA includes an optional AI companion for players and AI assistance for staff. At launch these AI features are disabled. We describe them fully here so that a parent can make an informed choice in advance; the AI companion is only ever activated for a child whose parent has given the separate AI-companion opt-in (see Parental Consent), and only after KOVA turns the feature on. When enabled for a child, the AI companion:

• What it is. An artificial-intelligence assistant powered by a third-party AI provider (Anthropic's Claude models). It is AI, not a human, and users are told so in the interface.
• What it reads / processes. The player's messages to the companion and a limited set of that player's own soccer-development context within the Service (their ratings, session notes, and schedule). The companion cannot access other children's data, other users' messages, or academy-wide content.
• What it is for. Soccer and player development only. It is scoped to sport and is not an open-ended, general-purpose chatbot. If a conversation drifts into personal, emotional, or health topics, the companion is designed to gently redirect to the player's development and to point toward human support.
• It is not advice. The companion does not provide medical, psychological, diagnostic, or safeguarding advice, and is not a substitute for a trusted adult or professional.
• Human welfare escalation. Because we cannot control what a child may choose to say, the companion includes a safety design: if it detects a welfare or safety signal — even unsolicited, even mid-conversation about a match — it sends an email alert to the academy's designated Welfare Officer (a named human), via our email provider. The alert contains the nature of the signal and the relevant conversation excerpt. This escalation is email-only and fail-closed: the companion cannot be enabled for an academy that has not designated a Welfare Officer. The Welfare Officer and the academy remain responsible for any response, including any reporting required of them by law; the escalation feature does not replace or discharge anyone's mandatory-reporting obligations.
• Retention. Companion interactions are retained for the duration of the child's participation in the Service so that the companion can maintain development context, and are deleted within 30 days of a parent's deletion request or withdrawal of the AI opt-in, and in any event within 90 days after the child's participation in the Service ends. Welfare-escalation alert records are retained by the receiving academy as its own safeguarding records.
• Off by default; consent-gated; reversible. The feature is off at launch and requires the separate opt-in for any child. A parent may withdraw the AI opt-in at any time in the Parent Portal (Manage Child → Privacy & Consents) or by emailing legal@kova8.com; withdrawal disables the companion for that child immediately and the child's companion history is deleted within 30 days.

The staff copilot and message translation features also send text to the AI provider when used. Staff copilot prompts may include academy content the staff member can already access under their role. Message translation, when a recipient uses it, sends the message text — which may include a message authored on behalf of a managed child by their parent, or by an independent teen — to the AI provider solely to produce the translation; translation processing is covered by the general Parental Consent for managed children and is subject to the same no-training commitment in §3.

7. Film and video of minors

Where a family consents via the Media/Film Release, players — including minors — may be recorded, and those clips stored (in Supabase Storage), annotated, commented on, shared within the academy's authorized audience, and analyzed automatically to support coaching and development. Film of minors is treated as sensitive and is subject to separate consent, access controls, and the retention rules below.

Sharing boundary. Clips of minors are shared only within the academy's authorized audience — the academy's permitted coaching staff, the player's managed account or independent account, and the linked parent(s) — as controlled by roles and permissions. Clips of minors are never shared outside that audience — including for promotion, marketing, showcases, or scouting — in v1 of the Service; no consent in the current documents permits it, and any future external use would require a distinct, clearly-labeled additional consent.

8. How we protect information

We use access controls, row-level security, encrypted transport, and role-based permissions to limit access to personal information, with particular care for children's data and film. If we become aware of a breach of security affecting personal information, we will notify affected users and academies, and regulators where required, without undue delay and within the timelines required by applicable law. No system is perfectly secure; we cannot guarantee absolute security.

9. Data retention and deletion

We retain personal information only as long as reasonably necessary for the purposes described here, then delete or de-identify it:

• Film clips of a player and AI-companion interactions: retained for the duration of the child's participation in the Service, unless a parent requests deletion sooner; deleted within 30 days of a parental deletion request or consent withdrawal, and in any event within 90 days after the child's participation or the academy's use of the Service ends.
• Account, profile, academy content, and player-development data: retained for the life of the account or academy workspace; deleted or de-identified within 90 days of account deletion or academy termination (after the 30-day export window in the Terms).
• Technical logs: retained up to 12 months for security and operations.
• Consent and acceptance records: retained as an audit trail for 5 years after the related account closes, even after the underlying document changes, so we can demonstrate what was consented to and when.
• Legal holds: any category may be retained longer where required by law or to resolve a dispute, then deleted.

10. Your choices and rights

Parents and guardians of managed children, and independent users, may access, correct, or request deletion of personal information, may refuse further collection from a child, and may withdraw consents, including the AI-companion opt-in and the Media/Film Release.

How to exercise rights. In-app via the Parent Portal (Manage Child → Privacy & Consents) or account settings, or by emailing legal@kova8.com. We verify parental requests against the authenticated parent account linked to the child, or, for out-of-app requests, by confirming control of the parent's registered email. We respond within 30 days (or any shorter period applicable law requires) and will confirm completion of deletions. A parent's COPPA rights — to review the child's information, direct its deletion, and refuse further collection or use — are honored through the same channels; refusing further collection ends the child's participation in the Service.

Residents of U.S. states with comprehensive privacy laws have the rights those laws provide (including access, correction, deletion, and portability); because we do not sell personal information or use it for targeted advertising, there is nothing to opt out of in those categories. We do not discriminate against anyone for exercising privacy rights.

11. Managed accounts and parental control

A child under 16 is represented by a managed account operated by their parent/guardian. The operating parent controls the managed child's participation and can exercise the rights above on the child's behalf.

Independent teens (16–17). An independent 16–17 player's in-app messages are privacy-protected by default: parents linked to the teen can see the teen's schedule, attendance, development data, and film, but not the content of the teen's individual messages. A parent or guardian of a 16–17 minor may still exercise access and deletion rights over the teen's account as permitted by applicable law by contacting legal@kova8.com.

12. International users

The Service launches U.S.-only. It is offered to academies and families in the United States, and all processing occurs in the United States. We do not currently offer the Service in the EU/EEA, UK, or other regions; if that changes, we will update this policy with the required regional disclosures and transfer mechanisms before launch there.

13. Changes to this policy

We may update this policy and will publish a new version with a new version identifier. The Service records which version you accepted and when. For material changes affecting children's data — including any new category of children's data collected, any new use, or any new subprocessor with access to children's data — we will notify parents by email and in-app and seek renewed consent before continuing the affected processing.

14. Contact

Privacy questions or requests: legal@kova8.com · KOVA Technologies Inc., 7600 Chevy Chase Dr Ste No 300, Austin, TX 78752. Parents who want to speak with a human about a child's data can request a callback via legal@kova8.com and will be contacted by a member of KOVA's team within 5 business days.