Privacy Policy

KyoHub is currently operated by its founder as a sole trader, ahead of formal company incorporation, and is the data controller for the personal data described here. You can reach the person responsible for data protection matters at legal@kyohub.com. This section will be updated with the registered company name and address as soon as KyoHub is incorporated.

We collect the information you give us directly, plus a small amount of technical data needed to run the service securely:

• Account: your email address and, if you set one, your password (stored only as a secure hash by our authentication provider), used for sign-in and optional two-factor authentication.
• Profile: full name, role (Pilot or Team), country, and profile photo.
• Pilot profiles: self-declared FIA grade, categories, budget, race results and any supporting proof links, and identity/verification documents you upload for manual review by our team.
• Team profiles: team name, base country, seat listings, qualification requirements, and Stripe Connect payout account status.
• Messages: the content of messages and applications you exchange with other users through the platform.
• Payments: processed directly by Stripe. We never see or store your card details, only the resulting transaction, subscription and commission records.
• Technical & security data: anti-bot verification (Cloudflare Turnstile) on login, registration and password-reset forms, a check of new passwords against known data breaches (Have I Been Pwned; only the first 5 characters of a one-way hash of the password leave your browser, never the password itself), and error/crash reports (Sentry), which are configured to exclude your IP address and other personal identifiers.

KyoHub does not use artificial intelligence, machine learning or automated profiling to process your personal data, verify your identity, or make decisions about your account. Profile verification and moderation on KyoHub are performed manually by our team.

We use a single functional cookie to keep you signed in (managed by our authentication provider, Supabase). We do not use advertising cookies, tracking pixels, or third-party analytics.

• To operate the marketplace: creating your profile, matching pilots with seat listings, and enabling messaging between users.
• To process payments, subscriptions and commissions through Stripe, and payouts to Teams through Stripe Connect.
• To manually verify pilot credentials and documents.
• To send transactional emails: new messages, applications, contract and payment updates, and a reminder before your Premium subscription renews.
• To respond to support requests sent through the platform.
• To prevent fraud and abuse, and to keep the platform secure and reliable.

We share data with the service providers that run KyoHub's infrastructure, each acting under their own data processing agreement:

• Supabase (database, authentication and file storage, hosted in the EU).
• Stripe (payment processing and payouts).
• Resend (transactional email delivery).
• Cloudflare (bot protection).
• Sentry (error monitoring, without IP addresses or personal identifiers).
• Vercel (application hosting).

Some of these providers are based outside the European Economic Area. Where that applies, transfers are covered by Standard Contractual Clauses or an equivalent safeguard under their respective data processing agreements. We do not sell your data to anyone.

We keep your account and profile data for as long as your account is active. Verification documents are kept only for as long as needed to verify your profile and are deleted once no longer needed. Financial and transaction records are kept for the period required by Spanish tax and accounting law. If you delete your account, we remove or anonymise your personal data except where we're required to retain it by law.

Under the GDPR, you have the right to access, correct, delete, restrict, or export your personal data, and to object to certain processing. To exercise any of these rights, contact us at legal@kyohub.com. You can also lodge a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es) at any time.

We restrict access to your data using row-level security in our database, so users can only read and write data they're authorised to see. Verification documents are stored in a private location that is never publicly accessible. No system is completely secure, but we take reasonable technical and organisational measures to protect your data.

We may update this policy from time to time. If we make material changes, we'll notify you by email or through a notice on the platform.

For any question about this policy or your data, contact us at legal@kyohub.com.