Privacy notice

1. Who handles your data

Contact the KoraHub360 project at info@korahub360.com for privacy matters. The legal controller’s full identity and business address are pending; the absence of these disclosures is an outstanding compliance issue, not an exemption from the Saudi Personal Data Protection Law (PDPL). No appointed data-protection officer or Saudi-only hosting is claimed in this draft.

2. Data and purposes

Depending on features you use, data may include email/account identifiers, profile and role details, player age or birth date, guardian relationships, academy enrolments, attendance, assessments and development plans, opportunity applications, enquiries, consent records, uploaded media and private academy-verification documents. Public browsing does not require creating a child profile.

These are used for authentication, authorized account and academy management, guardian-led sharing, coaching and trial workflows, enquiries, verification, safeguarding, support and service security. Do not submit unnecessary health information, identification documents, financial credentials or children’s contact details in free-text fields or public media.

3. Lawful bases—not blanket consent

Each processing purpose must have a valid basis under the PDPL, such as required consent, a permissible contractual necessity or a legal obligation. Legitimate interests may be used only where legally available and assessed, not as a blanket basis for sensitive data. Required services and optional marketing or public-media choices must be distinguished.

Acknowledging this notice or accepting terms is not a waiver of privacy rights, a blanket processing consent, permission to train AI on child data or approval for overseas transfers. Where consent is the basis, use the relevant purpose-specific controls and withdraw it through those controls or the privacy contact. Withdrawal does not undo lawful prior processing or eliminate a separate lawful retention duty.

4. Children and guardians

Under-18 participation requires the applicable guardian arrangements. Verify lawful guardianship rather than assuming anyone who creates a child record is authorized. Collect only necessary information, act in the child’s best interests and keep academy access, development, trials and public media within their separately authorized scopes. A child’s account is not permission to publish their identity or images.

A guardian may exercise rights on behalf of a child where legally authorized. When the individual gains legal capacity, their own rights must be respected and account/consent arrangements reviewed. This notice does not replace the required guardian-confirmation workflows.

5. Sharing and public information

Access depends on verified role, assignment, enrolment and applicable guardian permissions. Coach-private notes and verification documents are not public listings. Published academy pages and approved media are public and can be copied by visitors; private child records must not be published merely because an academy has a public page.

A guardian enquiry shares the account email, chosen age group, programme and message with the verified listing owner after explicit consent. Withdrawing an enquiry through My requests removes its shared email and message from KoraHub360; copies already received externally cannot automatically be recalled. Academy processing outside the platform is governed by that academy’s own lawful responsibilities.

Necessary information may be disclosed to contracted service providers, competent authorities or to protect lawful rights and safety only on an applicable lawful basis, with minimization and confidentiality safeguards. This does not authorize selling children’s profiles or unrestricted disclosure to advertisers.

6. Providers, AI and international transfers

The product uses hosted services for authentication/database and file storage, hosting, transactional email and configured AI features. Supabase and Replit are among the infrastructure services used. An AI request may send the relevant coaching context to the configured provider; users must minimize identifiers and not include private or unauthorized information.

Processing may involve locations outside Saudi Arabia. The operator must complete the provider/location inventory, processor contracts, lawful transfer assessment, required safeguards and any impact assessment under the PDPL and transfer regulations before regulated reliance. These arrangements remain a launch-review item; this notice does not certify their completion or make clicking acceptance a transfer exemption.

7. Device storage and analytics

Essential browser/device storage supports authentication, security and preferences. The mobile welcome flag remembers only that the guide was completed, not the selected persona or child information. Signing out clears local authentication as supported by the product; account deletion is a separate request.

The website records operational and navigation/signup analytics. Avoid including free-text messages, child records, credentials or sensitive personal information in analytics. Optional tracking and direct marketing must have the disclosures, controls and lawful basis required for their actual use; terms acceptance is not marketing consent.

8. Retention, closure and deletion

Keep personal data only for the necessary service purpose or an applicable legal obligation or lawful claim. Retention depends on the record, active relationship, withdrawal, statutory duties and necessary security evidence; backups and lawful holds may delay complete erasure. A detailed retention/deletion schedule and provider deletion process must be finalized before launch reliance.

Request closure, access, correction or destruction at info@korahub360.com. Identity and guardian-authority checks may be necessary and must be proportionate. Do not send passwords. Any lawful refusal, limitation or retained record should be explained; signing out alone does not delete server records.

9. Your rights and response route

Subject to lawful conditions, you have rights to be informed, access and obtain a readable copy of your data, seek correction or completion and request destruction, and withdraw consent where applicable. Requests should be handled without delay within the applicable PDPL period, generally 30 days, with a notified justified extension only where permitted. You may complain to SDAIA or another competent authority.

10. Security and incidents

Technical and organizational safeguards, private storage, least-privilege access, incident procedures and processor oversight are required; no system can promise zero risk. Report suspected exposure promptly to info@korahub360.com. Applicable authority notifications—including the 72-hour PDPL implementing-regulation requirement where its conditions apply—and affected-person notifications must not be replaced by a disclaimer.