Privacy Policy

Introduction

Kai Fitness Platform (“we”, “our”, or “us”), operated by MENTOR AGORA LTD (UK Company Number: 16692440), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This Privacy Policy applies to all users of our platform, including studio owners, studio staff, and studio members who use the Kai member app.

Data Controller

MENTOR AGORA LTD is the data controller for personal data processed through the Kai platform. For studio-specific member data (such as booking history, attendance records, and member profiles), the studio owner acts as the data controller and Kai acts as the data processor on their behalf.

Contact: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Legal Basis for Processing

We process personal data under the following legal bases as defined by the UK GDPR:

• Contract performance: Processing necessary to provide the Kai platform services you have signed up for.
• Legitimate interests: Analytics and service improvement, fraud prevention, and platform security.
• Consent: Marketing communications and optional integrations such as WhatsApp Business messaging.
• Legal obligation: Where we are required to retain data for tax, accounting, or regulatory purposes.

Information We Collect

We collect information that you provide directly to us, including but not limited to:

• Account information (name, email address, phone number)
• Business information
• Member data that you input into the platform (profiles, bookings, attendance)
• Payment information (processed securely through Stripe — we do not store card numbers)
• WhatsApp message content and metadata when you use our WhatsApp messaging features
• WhatsApp phone numbers and contact information for messaging purposes
• Usage data and analytics (pages visited, features used, clicks, and interactions collected automatically through PostHog)
• Session recordings (visual replays of how you interact with the platform, with sensitive form inputs automatically masked)
• Device and browser information (browser type, operating system, screen resolution)
• AI interaction data (which AI features you use, response times, and model performance metrics — prompt content is not stored in analytics)

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices and support messages
• Respond to your comments and questions
• Facilitate WhatsApp messaging between you and your members
• Process and deliver WhatsApp messages through the WhatsApp Business API
• Maintain message history and conversation records
• Analyse usage patterns, feature adoption, and platform performance through anonymised analytics

Cookies and Tracking Technologies

We use the following types of cookies on our platform:

• Analytics cookies (PostHog): These cookies (identified by the ph_* prefix) are used for session identification and to collect anonymised usage data such as page views, feature usage, and interaction patterns.
• Functional cookies: These are strictly necessary cookies used for authentication, session management, and theme preferences. They are essential for the platform to function correctly.

Legal basis: Analytics cookies require your explicit consent. You can accept or reject analytics cookies via the cookie consent banner displayed when you first visit the platform. Functional cookies are strictly necessary for the operation of the Service and do not require consent.

Managing your preferences: You can change your cookie preferences at any time through the cookie settings link in the footer of our website, or by clearing your browser cookies. Rejecting analytics cookies will not affect your ability to use the platform.

PostHog analytics data is processed and stored on PostHog's EU Cloud infrastructure. All analytics data remains within the European Union.

Analytics and Platform Improvement

We use PostHog for product analytics to understand how our platform is used and to improve the experience for all users. This includes:

• Page views and navigation patterns
• Feature usage and click patterns
• Session recordings (with sensitive form inputs such as passwords, email fields, and phone numbers automatically masked)
• AI feature performance metrics (response times and model usage)

This data is used solely to improve the platform experience, identify usability issues, and optimise features. We do not sell, rent, or share analytics data with any third parties. This data is used exclusively by Kai to improve the Service.

Session recordings automatically mask sensitive form inputs (passwords, email fields, phone numbers) to protect your privacy. You will never be personally identified through session recordings.

WhatsApp Business API and Third-Party Services

When you use our WhatsApp messaging features, we integrate with Meta's WhatsApp Business API to deliver messages. This integration requires us to share certain information with Meta (Facebook) in accordance with their terms and policies.

Information Shared with Meta/WhatsApp:

• Phone numbers of message recipients and senders
• Message content and metadata (message IDs, timestamps, delivery status)
• Business account information necessary for API authentication

Meta's use of this information is governed by Meta's Privacy Policy and WhatsApp Business Terms. We recommend reviewing WhatsApp's Business Policy and Meta's Privacy Policy to understand how they handle your data.

We do not sell your personal information to third parties. We only share information with Meta/WhatsApp as necessary to provide the messaging service you have requested.

Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data where there is no compelling reason for continued processing.
• Restriction: Request that we restrict processing of your personal data in certain circumstances.
• Portability: Request your personal data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: You may withdraw your consent for analytics cookies at any time by updating your cookie preferences. This will not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us through our contact page. We will respond to your request within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.

WhatsApp Communications

If you use our WhatsApp messaging integration, you may opt out of receiving WhatsApp messages at any time by replying “STOP” to any message or by adjusting your notification preferences in your account settings. You may also disconnect your WhatsApp Business Account from the platform at any time.

Data Processors and Sub-Processors

We use the following third-party processors to deliver and improve our services:

• PostHog (EU Cloud)— product analytics and session replay
• Supabase— database and authentication infrastructure
• Stripe— payment processing
• Vercel— hosting and content delivery
• Resend— transactional email delivery

We only share the minimum data necessary with each processor to provide the relevant service. None of these processors use your data for their own purposes beyond providing services to us.

Data Security

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet is 100% secure.

WhatsApp messages are transmitted through Meta's secure infrastructure. While we encrypt sensitive data at rest and in transit, message content transmitted through WhatsApp is subject to Meta's security practices and policies.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the platform services. When you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required for legal obligations (e.g. financial records retained for 6 years under UK tax law).

Studio member data is retained for as long as the studio's account is active. Studio owners may delete individual member records at any time. WhatsApp message data may also be stored by Meta in accordance with their data retention policies.

Contact Us

If you have questions about this Privacy Policy, please contact us at our contact page.