Privacy Policy · Kanchara: Padel Coach AI

Last updated: 13 July 2026

This privacy policy describes how MOPAWEB FACTORY SRL collects, uses, keeps and protects your personal data when you use the Kanchara: Padel Coach AI mobile application (the "Application") and the kanchara.com website (the "Site"), together the "Services".

It is drawn up in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

1. Data controller

MOPAWEB FACTORY SRL alone determines the purposes and means of the processing described below. It therefore acts as the data controller.

Data Protection Officer (DPO): no DPO has been appointed. Appointing a DPO is not mandatory in our case within the meaning of Article 37 of the GDPR. Any question about your data can be sent to contact@kanchara.com.

2. Summary of processing

3. Data we collect

3.1 Data you provide

When creating the account

• E-mail address
• Password (stored as a cryptographic hash, we never have access to it in plain text)
• Or, if you use Sign in with Apple or Google Sign-In: the identifier issued by Apple or Google and the associated e-mail address (Apple may let you hide your real address via a relay address)

In your player profile

• First name
• Declared playing level
• Dominant hand
• Player type (playing style)
• Playing frequency

When you use the Application

• The match videos you upload
• Your confirmation that you have obtained the consent of the other players appearing in the video (see §4)
• Any messages you send to support

3.2 Data generated by the Services

• Analysis results: playing time, distance covered, heat maps, coverage zones, technical metrics
• Advice generated by artificial intelligence
• History of your analyses and evolution over time
• Subscription status, in-app purchase history, subscriber identifier

3.3 Data collected automatically

• Technical device identifiers, operating system and version, Application version
• IP address, connection timestamps
• Aggregated usage data (screens viewed, features used)
• Error and crash reports

We do not collect your precise geolocation, your contacts, health data or banking data (see §7).

4. Match videos, specific processing

This is the most sensitive processing in our Services. We describe it precisely.

4.1 What a video contains

A padel match video generally shows four players, including you. Images of identifiable natural persons constitute personal data. The three other players are therefore also data subjects within the meaning of the GDPR.

4.2 Your commitment

Before any upload, the Application asks you to confirm that you have obtained the prior consent of the other players present in the video, for it to be uploaded, analysed and stored under the conditions described in this policy.

This confirmation is a condition of use of the service. By uploading a video, you warrant that you have this consent and undertake not to upload:

• a video containing a minor without the consent of their legal guardian;
• a video filmed without the knowledge of the people appearing in it;
• a video recorded in a place where capture is prohibited by the rules of the club or the operator.

Important: this warranty does not exempt us from our own obligations. We remain responsible for the processing of the images once they have been uploaded.

4.3 Rights of the other players filmed

Any person appearing in a video uploaded to Kanchara may exercise their rights (access, erasure, objection) directly with us, at contact@kanchara.com, without having to go through the user who uploaded the video. We act on any legitimate erasure request within one month, and then remove the video concerned.

4.4 Blurring

At this stage, the Application does not automatically blur the faces of third-party players. We are looking into introducing this feature. In the meantime, videos are stored in a private, encrypted, non-indexed space that is not publicly accessible.

4.5 No facial recognition

Our processing relies on silhouette detection, trajectory tracking and movement analysis. We use no facial recognition technology and we produce no biometric template capable of uniquely identifying a person. No biometric data within the meaning of Article 9 of the GDPR is generated.

4.6 Use of videos to improve our AI models

We use some of the uploaded videos to train, evaluate and improve the artificial intelligence models that produce the analysis. Without this option, the quality of the analysis could not progress: it is an essential component of how the service works.

Legal basis: legitimate interest (Article 6.1.f of the GDPR). This use is also provided for in our Terms of Use, which you accept when creating your account.

Balancing test. We have assessed this interest against your rights and freedoms:

• the videos are never made public, distributed, marketed or transmitted to any third party other than our technical processors;
• they are kept for 12 months maximum, in private, encrypted storage;
• no facial recognition is used (see §4.5);
• access to the videos is strictly limited to the people who need it, and logged;
• the reasonable expectation of a user of an AI analysis service is that their data will be used to improve its quality, which we clearly inform them about.

Your right to object. You may object to this use at any time, for reasons relating to your particular situation (Article 21 of the GDPR):

• from the Application settings; or
• by e-mail to contact@kanchara.com.

If you object, we stop using your videos for training purposes and remove them from our datasets within 30 days. You keep full access to the Services. The objection does not call into question the lawfulness of processing already carried out, and models already trained cannot be "un-trained".

Third parties appearing in a video have the same right to object (see §4.3).

5. Retention periods

You can delete a video or an analysis at any time from the Application, without waiting for these periods to expire.

6. Purposes and legal bases

6.1 Performance of the contract (art. 6.1.b GDPR)

• Create and manage your account
• Receive, store and analyse your videos
• Produce and return to you the statistics, heat maps and advice
• Manage your subscription and access
• Send you service-related notifications (analysis complete, analysis failure)

6.2 Consent (art. 6.1.a GDPR)

• Non-essential cookies and trackers on the Site
• Audience measurement in the Application
• Any promotional communications

You may withdraw your consent at any time, without this affecting the lawfulness of prior processing.

6.3 Legitimate interest (art. 6.1.f GDPR)

• Training, evaluation and improvement of our artificial intelligence models from the uploaded videos (see §4.6)
• Security of the Services, prevention of fraud and abuse
• Improvement of usability and features
• Bug fixing and incident monitoring
• Handling of support requests

We have balanced these interests against your rights and freedoms and consider that they do not override them, given the safeguards described in §4.6 and the limited nature of this processing. You have a right to object (see §10), the exercise of which does not affect your access to the Services.

6.4 Legal obligation (art. 6.1.c GDPR)

• Retention of accounting and tax records
• Response to requests from competent authorities

7. Payments

Subscriptions and purchases are made exclusively through the in-app purchase mechanisms of Apple (App Store) and Google (Google Play).

We do not collect, see or store any bank card data. This data is processed directly by Apple and Google, each acting as an independent data controller.

We use RevenueCat to know the status of your subscription (active, expired, renewed) and give you access to the corresponding features. RevenueCat receives a subscriber identifier and the transaction receipts transmitted by the stores, without any banking data.

8. Recipients and processors

Your data is never sold or rented. It is shared only with the following providers, acting as processors within the meaning of Article 28 of the GDPR, on the basis of a data processing agreement (DPA):

[TO BE COMPLETED], the GPU infrastructure provider used for video processing (e.g. RunPod) must be added to this table once decided, with its hosting region and signed DPA.

We may also disclose your data:

• to judicial or administrative authorities, where the law requires us to;
• to our advisers (lawyer, accountant), bound by professional secrecy;
• to a potential acquirer, in the event of a sale of the business, subject to informing you beforehand.

9. Transfers outside the European Union

We systematically favour hosting located in the European Union. Our videos and databases are hosted in the EU.

Some providers (OpenAI, RevenueCat, Apple, Google) are established in the United States or may transfer data there. These transfers are governed by:

• the standard contractual clauses adopted by the European Commission (decision 2021/914); and/or
• the provider's membership of the EU–US Data Privacy Framework; and
• additional technical measures (encryption in transit and at rest, minimisation of the data transmitted).

You can obtain a copy of the applicable safeguards by writing to contact@kanchara.com.

10. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access, obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification, have inaccurate or incomplete data corrected.
• Right to erasure, request the deletion of your data, in particular when you withdraw your consent or close your account.
• Right to restriction, request that a contested processing be frozen.
• Right to object, object, for reasons relating to your particular situation, to processing based on our legitimate interest, in particular the use of your videos to train our AI models. Exercising this right does not deprive you of any feature.
• Right to portability, receive your data in a structured, commonly used and machine-readable format, or have it transferred to another controller.
• Right to withdraw your consent at any time, for the processing that depends on it (cookies, audience measurement, promotional communications).
• Right to give directives regarding what happens to your data after your death.

How to exercise them: write to contact@kanchara.com. We reply within one month, extendable by two months for complex requests. We may ask you for proof of identity in the event of reasonable doubt.

Account deletion: you can delete your account directly from the Application (settings → delete my account), in accordance with the requirements of the App Store and Google Play Store. Deletion results in the erasure of your videos, analyses and profile data within 30 days, except for data we are legally required to keep (billing).

Complaint: you have the right to lodge a complaint with the competent supervisory authority:

Data Protection Authority (DPA) Rue de la Presse 35, 1000 Brussels contact@apd-gba.be, +32 (0)2 274 48 00 www.dataprotectionauthority.be

11. Automated decision-making and artificial intelligence

Kanchara relies on artificial intelligence systems. In accordance with the transparency principle of Regulation (EU) 2024/1689 (the "AI Act"), we explicitly inform you that:

• the analysis of your videos is carried out by automated computer vision models;
• the advice sent to you is generated automatically by a language model, from the metrics extracted from your match;
• these results are probabilistic in nature: they may contain errors, inaccuracies or approximations;
• Kanchara is a sporting training aid. It replaces neither a coach, nor a fitness trainer, nor a healthcare professional. It provides no diagnosis or medical advice.

This processing produces no legal effect concerning you and does not significantly affect you within the meaning of Article 22 of the GDPR. You may nevertheless ask us for human intervention or contest a result by writing to contact@kanchara.com.

12. Security

We implement appropriate technical and organisational measures:

• encryption of communications (TLS 1.2 or higher);
• encryption of videos and data at rest;
• storage of videos in private, non-indexed spaces, accessible only via signed URLs with a limited lifetime;
• password hashing (no storage in plain text);
• named access control limited to staff who need it;
• access logging;
• regular backups.

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will inform you as quickly as possible and notify the DPA within 72 hours, in accordance with Articles 33 and 34 of the GDPR.

13. Minors

The Services are reserved for people aged 16 or over. We do not knowingly collect data concerning people under 16.

It is also prohibited to upload a video featuring a minor without the consent of their legal guardian.

If you notice that a minor under 16 has created an account, or that a minor appears in a video without authorisation, write to us at contact@kanchara.com: we will delete the data concerned without delay.

14. Cookies

The Site and the Application use cookies and similar technologies. Details are given in our Cookie Policy.

15. Changes to this policy

We may change this policy, in particular in the event of a change to our processing, our providers or the regulations. The date of the last update appears at the top of the document.

In the event of a substantial change, we will inform you by e-mail and/or by a notification in the Application, at least 30 days before it takes effect. Where the change concerns processing based on your consent, we will seek fresh consent.

16. Contact

For any question about this policy or your data:

MOPAWEB FACTORY SRL Rue du Bois d'Ausse (Sart-Bernard) 27 5330 Assesse, Belgium contact@kanchara.com +32 472 98 42 57