1. Who we are
KAVRO LTD (“KAVRO”, “we”, “us” or “our”) is a provider and publisher of mobile and web applications. KAVRO LTD is the data controller responsible for personal data processed through:
- our website at kavro.fit and any related sub-domains (the “Website”);
- mobile applications we publish on the Apple App Store, Google Play and other app stores; and
- web applications we operate,
(together, the “Services”). Where we build an app for a client and the client publishes it under its own name, the client is normally the data controller and its own privacy policy applies; we act as its processor.
Contact for all privacy matters: [email protected].
2. Scope of this policy
This policy applies to all Services that link to it. An individual app may have a supplementary privacy notice describing features specific to it (for example, health or location features); if so, that notice applies together with this policy. This policy does not cover third-party websites, services or apps that we link to, which have their own privacy policies.
3. Personal data we collect
3.1 Information you provide
- Account data: name, email address, password (stored in hashed form by our authentication provider), profile photo, and sign-in identifiers if you use Sign in with Apple or Google Sign-In.
- Content you create: data you enter into an app, such as notes, goals, activity logs, preferences, photos or files you upload.
- Optional profile and wellness data: in fitness or wellbeing apps, information you choose to enter such as age range, height, weight, goals or workout history.
- Communications: messages, feedback, support requests and survey responses you send us, including your email address and any attachments.
- Business enquiries: if you contact us about a project, your name, company, role and contact details.
3.2 Information collected automatically
- Device and technical data: device model, operating system and version, app version, language, time zone, and an app-instance or installation identifier.
- Usage data: features used, screens viewed, session length, in-app events and interactions, collected through analytics tools.
- Diagnostics: crash reports, performance data and error logs.
- Log data: IP address, browser type, referring page and timestamps when you visit our Website or use our web apps.
- Advertising identifiers: only where an app shows advertising and only with your permission where required (for example, Apple's App Tracking Transparency prompt).
- Notification tokens: if you allow push notifications.
3.3 Information from third parties
- Sign-in providers (Apple, Google): your name, email address (or Apple's private relay address) and a unique identifier, as permitted by your settings.
- App stores (Apple, Google): purchase and subscription status and transaction identifiers. We do not receive your full payment card details.
- Health platforms: where an app offers integration with Apple Health or Google Health Connect and you explicitly grant permission, the specific data types you approve.
3.4 Permissions
Some apps may ask for device permissions such as camera, photos, notifications, location or motion & fitness. We only request a permission when you use a feature that needs it, explain why, and the app continues to work without it where possible. You can change permissions at any time in your device settings.
4. How we use personal data and our legal bases
Under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), we must have a legal basis for each use of personal data:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account; providing app features; syncing your data across devices | Performance of a contract |
| Processing purchases and subscriptions; verifying entitlements | Performance of a contract; legal obligation (tax and accounting records) |
| Responding to support requests and enquiries | Performance of a contract; legitimate interests |
| Sending service messages (security alerts, changes to terms, receipts) | Performance of a contract; legal obligation |
| Analytics to understand usage and improve our Services; crash reporting and performance monitoring | Legitimate interests; consent where required by law |
| Keeping our Services secure; preventing fraud and abuse | Legitimate interests; legal obligation |
| Marketing emails and promotional push notifications | Consent (you can withdraw at any time) |
| Personalised advertising (where an app shows ads) | Consent |
| Processing health or fitness data you choose to provide | Explicit consent |
| Complying with law, responding to lawful requests, enforcing our terms | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and you may object at any time (see section 10).
5. Health and fitness data
Some of our apps may allow you to record health or fitness information. This is treated as special category data. We process it only with your explicit consent and only to provide the features you use. In particular:
- data obtained from Apple HealthKit or Google Health Connect is never used for advertising or marketing, never sold, and never shared with third parties except as needed to provide the feature you requested or as required by law;
- you can withdraw consent at any time in the app or in your device's health settings;
- our apps are not medical devices and do not provide medical advice.
6. How we share personal data
We do not sell your personal data, and we do not share it for cross-context behavioural advertising except with your consent. We share personal data only with:
- Service providers (processors) who process data on our instructions under written contracts, including:
- Google LLC / Google Ireland Ltd — Firebase (Authentication, Cloud Firestore, Cloud Storage, Hosting, Cloud Functions, Cloud Messaging, Crashlytics, Analytics, Performance Monitoring) and Google Cloud Platform;
- Apple Inc. and Google LLC — app distribution, sign-in, in-app purchases and push notifications;
- email and customer-support providers used to respond to you;
- payment processors for web purchases, where applicable;
- advertising partners (such as Google AdMob), only in apps that display ads and subject to your consent choices.
- Professional advisers such as lawyers, accountants and auditors, under duties of confidentiality.
- Authorities where required by law, court order or to protect the rights, property or safety of KAVRO, our users or others.
- Business transfers: a buyer or successor in connection with a merger, acquisition, financing or sale of assets, who will be bound by this policy.
- With your direction: when you choose to share content or connect a third-party service.
7. International data transfers
Our service providers may process personal data outside the United Kingdom and the European Economic Area, including in the United States. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the EU–US Data Privacy Framework and its UK Extension, the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum. You can request details of these safeguards by contacting us.
8. How long we keep data
| Data | Retention period |
|---|---|
| Account data and app content | For as long as your account is active. Deleted within 30 days of an account deletion request (backups purged within a further 35 days). |
| Inactive accounts | We may delete accounts that have been inactive for 24 months, after giving notice where possible. |
| Purchase and transaction records | Up to 6 years after the transaction, to meet tax and accounting obligations. |
| Support correspondence | Up to 3 years after the enquiry is resolved. |
| Analytics data | Up to 14 months, then aggregated or deleted. |
| Crash and diagnostic logs | Up to 90 days. |
| Marketing preferences | Until you unsubscribe, plus a suppression record so we respect your choice. |
9. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest, access controls based on least privilege, security rules on our databases, multi-factor authentication for staff accounts, and regular review of our systems. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant regulator of a personal data breach where required by law.
10. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — obtain a copy of your personal data;
- Rectification — correct inaccurate or incomplete data;
- Erasure — ask us to delete your data (see Delete Account);
- Restriction — ask us to limit how we use your data;
- Portability — receive your data in a structured, machine-readable format;
- Objection — object to processing based on legitimate interests or to direct marketing;
- Withdraw consent — at any time, without affecting processing already carried out;
- Not to be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).
To exercise your rights, email [email protected] with the subject “Data Request”. We may need to verify your identity. We respond within one month (extendable by two months for complex requests, in which case we will tell you). Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints: you have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU, you may contact the data protection authority in your country. We would appreciate the chance to address your concerns first.
11. Additional information for US residents
If you live in California or another US state with a comprehensive privacy law (such as Colorado, Connecticut, Virginia, Utah, Texas or Oregon), you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to obtain a portable copy; and to opt out of the “sale” or “sharing” of personal information and of targeted advertising. We do not sell personal information and we do not knowingly sell or share the personal information of consumers under 16. We will not discriminate against you for exercising your rights. You or your authorised agent may submit a request to [email protected]; we will verify your request before responding. If we deny a request, you may appeal by replying to our decision. Where an app uses advertising, we honour Global Privacy Control signals on our web services.
Categories of personal information collected in the past 12 months: identifiers; customer records; commercial information (purchase history); internet or other electronic network activity; and, only where you choose to provide it, sensitive personal information (health data), used only to provide the Services.
12. Children
Our Services are not directed to children under 13 (or under 16 in the EEA and UK where that is the age of digital consent), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact [email protected] and we will delete it. If a specific app is intended for younger users, it will have its own notice that complies with applicable children's privacy laws, including the UK Age Appropriate Design Code and COPPA.
13. Cookies and similar technologies
Our Website and web apps use cookies and local storage, and our mobile apps use SDKs that serve similar purposes. Strictly necessary technologies are used without consent; analytics and advertising technologies are used only with consent where required. See our Cookie Policy for details.
14. Marketing
We will only send you marketing messages if you have opted in or, where permitted by law, if you are an existing customer and have not opted out. Every marketing email includes an unsubscribe link, and you can turn off promotional notifications in the app or device settings at any time.
15. Third-party links and services
Our Services may contain links to, or integrations with, third-party services. Their privacy practices are governed by their own policies, including Google's Privacy Policy, Firebase Privacy and Security and Apple's Privacy Policy.
16. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new “Last updated” date and, where changes are significant, notify you by email or in-app message before they take effect.
17. Contact us
KAVRO LTD
Email: [email protected]
Website: kavro.fit