Privacy Policy

The short version

• The parent owns the account. The child does not log in.
• We never collect a child's real name, date of birth or photo. Children are represented anonymously by an animal avatar (e.g. Cheetah, Eagle) and a 3-year age band only the parent picks.
• We never sell data and never serve third-party personalised ads.
• Data is encrypted at rest and in transit, stored on Supabase infrastructure.
• You can export or delete your child's data at any time.

1. What we collect

• Parent account: email, name, phone (optional), county (optional).
• Child profile (anonymous): an animal avatar chosen by the parent, an age band (e.g. 9–11), a primary sport, and an optional private nickname visible only to the signed-in parent. No real name, no date of birth, no photo, no school, no county at child level.
• Assessment responses: the answers your child or you provide on the questionnaire.
• Usage data: aggregated, non-identifying analytics so we can improve the product.

Because we hold no identifying information about children, the questionnaire responses and learning progress in our database are attached to an anonymous animal — not to a named child. Only the parent, off-platform, knows which animal represents which child.

2. Lawful basis (Kenya DPA 2019)

We process child data under the explicit consent of the parent or guardian, and our legitimate interest in delivering the service you signed up for. Consent can be withdrawn at any time from your settings.

3. Who can see your child's data

• You (the parent) — always.
• Coaches, mentors or schools you explicitly invite — only what you choose to share.
• Our engineering team — only when strictly required to operate or fix the platform, under confidentiality.

4. What we never do

• We do not sell your data.
• We do not place third-party advertising or behavioural trackers.
• We do not contact your child directly outside the in-app experience.

5. Your rights

• Access and download all data we hold about you and your child.
• Correct any inaccurate data.
• Delete your account and all associated child profiles at any time.
• Withdraw any specific consent (e.g. marketing features, sharing) without losing core access.

6. Contact

Data Protection Officer · privacy@thesportsacademy.co.ke

7. Payment processing & Merchant of Record

Purchases on The Sports Academy are processed by Paddle.com Market Limited ("Paddle"), our Merchant of Record and payment infrastructure provider. When you make a purchase, Paddle processes your payment details (card information, billing address, email) directly. Paddle may also process your name, IP address, and transaction data for payment processing, tax compliance, fraud prevention, and customer support. Paddle acts as the data controller for the payment data it processes. See Paddle's privacy policy at paddle.com/legal/privacy.

8. Data retention periods

• Account data (parent email, name, phone, county): retained while your account is active, plus 12 months after deletion for reactivation and legal compliance.
• Child profiles (animal avatar, age band, sport, assessment responses, learning progress): retained while the parent account is active; deleted within 30 days of profile or account deletion.
• Payment and transaction records: retained for 7 years after the transaction date, as required by the Kenyan Income Tax Act. Paddle retains its own payment records per its own policy.
• Consent records (version agreed, timestamp, IP): retained indefinitely as evidence of consent, per the Kenya Data Protection Act, 2019.
• Communication logs (emails sent to you): retained for 24 months, then deleted.
• Usage analytics (anonymised, aggregate): retained indefinitely for service improvement; cannot identify individuals.

When data is deleted, it is removed from active databases. Backup copies may persist for up to 30 additional days before automatic purge.