1. Who we are
Kivow is a cycling and running application and sports social network, developed and operated by F. Kennedy Carlos Leite LTDA — trading as Kivow Sport Tech —, registered under Brazilian company number (CNPJ) 68.052.254/0001-97 (the "Controller"), established in Brazil, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018).
For privacy and data processing matters, contact us at: privacidade@kivow.com.br.
2. Data we collect
To provide Kivow's services, we collect the following categories of personal data:
2.1 Account data
- Name or nickname (username)
- Email address
- Password (stored encrypted — never in plain text)
- Profile photo (optional)
- City, state, gender, date of birth and sports practiced (for your profile and to build rankings)
2.2 Physical activity data
- Speed, pace, distance, duration and elevation
- Cadence and power (when you connect compatible sensors)
- Activity files in FIT, GPX and TCX formats (when imported by you)
- Brand, model and identifier of the Bluetooth sensors you pair with the app
2.3 Location — including in the background
To record the route of your ride or run, Kivow collects your precise location (latitude, longitude and altitude) while an activity is being recorded.
Collection happens only while an activity is being recorded, started by you. Kivow does not track your location when no activity is in progress, and does not use your location for advertising. You may revoke this permission at any time in your operating system settings — recording will then work only with the app open on screen.
You can also set privacy zones in the app (for example around your home or workplace) so that the start and end of your routes are hidden from other users, and you can choose the visibility of each activity individually.
2.4 SENSITIVE personal data — health
Therefore: it is only collected if you pair a sensor of your own accord; processing is based on specific and highlighted consent (Art. 11, I), not on contract performance; it is private by default — never shown to other users; and you may withdraw consent at any time by disconnecting the sensor or deleting the data in the app.
If you hire a coach through Kivow, this data is only shared with them upon your specific consent, and you may end the relationship at any time, which stops the sharing.
2.5 Photos and images
- Profile photo (optional)
- Photos of your activities and the image chosen as cover
- Photos of listings you publish on the Marketplace
- Photo of groups you administer in the Community
- Photos of your equipment, when you request an insurance quote
Access to the camera and photo library is requested only at the moment you choose to send an image, and may be denied without preventing use of the app's other features.
2.6 Third-party data you provide to us
When setting up Kivow Cuida (our safety feature), you may register emergency contacts — the name and phone number of other people. By doing so, you declare that you have those people's authorization to provide their data and for them to be contacted in an emergency.
This data is used exclusively to trigger SOS and crash detection, feeds no other feature, and may be removed by you at any time. If an emergency contact wants their data deleted, they may write to privacidade@kivow.com.br.
2.7 Kivow Insurance data
If you request a quote, we collect the data needed to forward it to the partner broker or insurer: description, brand, model and value of the equipment, photos, and your contact details. This data is only shared upon explicit consent, recorded in the app at the time of the request.
2.8 Usage and device data
- Device model and operating system
- Installed app version
- Device identifier (for offline functionality and notifications)
- Access and error logs (for technical improvement of the app)
- Anonymous interaction events (feature usage)
2.9 Communication and ecosystem data
- Messages, comments, likes and social interactions on the platform
- Follow requests/followers and group participation
- Listings, messages and negotiations on the Marketplace
- Interactions with coaches and insurance quote requests with partners
2.10 Connected accounts from partner platforms
You may, if you wish, connect to Kivow your account on third-party platforms that store your activities — for example Garmin Connect, Strava, Wahoo or iGPSPORT.
The connection is always initiated by you and authorized through the OAuth 2.0 protocol, on the platform's own page. Kivow never has access to your password on those platforms.
What we receive when you connect an account:
- Your account identifier on the platform
- Your completed activities and their activity files (FIT, GPX or TCX), with the metrics they contain: route, distance, time, elevation, speed, cadence, power and heart rate
How we use this data: exclusively to record your activities in Kivow, calculate your statistics and your position in rankings, and display them according to your privacy settings — the same rules applied to activities recorded directly in the app.
Heart rate: when a received file contains heart rate, it is treated as sensitive personal data, exactly as described in item 2.4 — private by default and never shown to other users.
Limits we respect:
- We do not use this data to train artificial intelligence or machine learning models
- We do not sell, rent or share this data with third parties for advertising purposes
- We respect the usage restrictions imposed by each source platform. Where a platform restricts display of the data to the data subject only, that data is visible solely to you, and does not feed rankings, groups or the public feed
How to disconnect: you may revoke the connection at any time, in Kivow's settings or directly on the source platform. Revocation immediately stops the receipt of new activities. Activities already imported remain in your Kivow account and may be deleted by you, individually or in bulk, at any time. If you delete your Kivow account, this data is erased along with the rest, within the period described in item 8.
3. Purposes of processing
We process your data for the following purposes, under the legal bases set out in the LGPD:
3.1 Performance of a contract (Art. 7, V)
- Create and manage your user account
- Record and display your cycling and running activities
- Calculate your position in rankings by sport, discipline, city, state, country and gender
- Operate Community, Marketplace, Coaches and Kivow Cuida
- Process and manage the Kivow Pro subscription
3.2 Legitimate interest (Art. 7, IX)
- Continuously improve the app's features and experience
- Detect and prevent fraud, abuse and ranking manipulation
- Anonymous statistical analysis of service usage
3.3 Consent (Art. 7, I)
- Sending marketing communications and news (revocable at any time)
- Collection of location in the background, with the screen off, while recording an activity (item 2.3)
- Sharing real-time location with trusted contacts (Kivow Cuida)
- Sharing data with partner insurers for quotation/contracting
- Push notifications about your network's activities
3.4 SPECIFIC consent for sensitive data (Art. 11, I)
Processing of health data — heart rate read from sensors (item 2.4) — requires, under the LGPD, specific and highlighted consent, distinct from the general consent to use the app. This consent is collected when you pair a heart rate sensor, and applies to:
- Recording your heart rate alongside the activity
- Calculating training zones, effort analyses and derived indicators
- Sharing this data with a coach you hire (separate consent, per relationship)
Withdrawal is free and available at any time: disconnect the sensor to stop new collection, or delete the activities/data already recorded. Withdrawal does not affect the lawfulness of processing carried out before it.
Anonymized and aggregated data. We may use information in aggregated and/or anonymized form — which, under Article 12 of the LGPD, is not considered personal data — to improve the service, generate statistics and enable community and safety features (for example, rankings and aggregated usage views). We apply measures so that such data does not allow you to be re-identified.
4. Firebase and third-party platforms
Kivow uses Firebase (Google LLC) as back-end infrastructure: Authentication, Cloud Firestore (storage of profiles and activities), Cloud Messaging (notifications), Analytics (anonymized metrics) and Crashlytics (error reports).
Data processed by Firebase is subject to Google's Privacy Terms. For Kivow Pro payments, we use certified processors (App Store, Google Play and/or PCI DSS gateways). Kivow never stores full credit card data.
5. How we protect your data
- Transmission via HTTPS/TLS (encryption in transit)
- Hashed passwords (never in plain text)
- Sensitive data, including location, under restricted access control
- Monitoring for detection of unauthorized access
- Regular backups with redundancy
6. Data sharing
Kivow never sells, rents or trades your personal data to third parties. Your data may be shared only:
- With other users: public profile, activities marked as public and ranking positions, according to your privacy settings
- With technical providers: Firebase/Google, to operate the infrastructure
- With your trusted contacts: real-time location, only when you activate route sharing or SOS
- With insurers and partners: only the data needed for quotation/contracting, when you request it — Kivow acts as an intermediary, not as an insurer
- With coaches: the data needed for the coaching service, when you hire a coach
- With platforms you connect: when you connect a third-party account (item 2.10), Kivow receives your activities from that platform. We do not send your Kivow data back to them, unless you expressly request such a transfer
- By legal obligation: when required by a competent authority, court order or applicable law
7. Your rights as a data subject
Under the LGPD, you may at any time: confirm and access your data; correct incomplete or outdated data; request anonymization, blocking or deletion; port your data in a structured format (CSV, GPX); object to processing based on legitimate interest; withdraw consent; and disconnect, at any time, the partner platform accounts you have connected (item 2.10).
To exercise your rights, use the app settings or write to privacidade@kivow.com.br. We will respond within 15 days.
8. Data retention
- Active account: data retained while you keep a Kivow account
- Deleted account: your personal data and activities are erased within 30 days, except where the law requires longer retention
- Security logs: up to 6 months, for fraud prevention
- Payment/tax data: for the period required by law
- Shared content: messages already sent to other users and comments on third-party posts may remain visible to them, as they form part of someone else's conversation/post — authorship is unlinked from your account
- Media files: images removed from the app stop being displayed immediately; definitive erasure from storage occurs in the subsequent cleanup cycle
9. Children's and adolescents' data
Kivow is not directed at children — defined by the LGPD as persons under 12 years of age (Art. 14 in conjunction with the Brazilian Child and Adolescent Statute). We do not create accounts for this age group.
Adolescents (12 to 17 years old) should only use the app with the authorization and supervision of parents or legal guardians, who may exercise all data subject rights on the adolescent's behalf by writing to privacidade@kivow.com.br. Processing in this age group is always carried out in the best interest of the data subject, and features involving public exposure (rankings, feed, Marketplace) should be used under supervision.
If we become aware of the collection of a child's data without the specific consent of a parent or guardian, we will delete that data immediately. If you are a guardian and have identified an account in this situation, please notify us at the email above.
10. International transfer
Data processed via Firebase may be stored on servers outside Brazil (in the United States and other countries where Google operates), based on standard contractual clauses ensuring a level of protection equivalent to that of the LGPD.
11. Cookies and similar technologies
The mobile app does not use cookies. The web version may use local storage to keep your session, remember preferences and perform anonymous usage analysis. You can manage this in your browser settings.
12. Changes to this policy
We may update this Policy periodically. In case of material changes, we will notify you through the app and/or by email at least 15 days in advance. Continued use after that period implies acceptance.
13. Contact and Data Protection Officer (DPO)
Under Art. 41 of the LGPD, the Controller designates as Data Protection Officer (DPO) the person responsible for Kivow's operation, reachable through the channel below. This is the official channel for privacy questions, exercise of data subject rights and communications from the ANPD (the Brazilian data protection authority).
- Controller (registered name): F. Kennedy Carlos Leite LTDA
- Trading as: Kivow Sport Tech
- Company number (CNPJ): 68.052.254/0001-97
- Data Protection Officer (DPO) — official channel: privacidade@kivow.com.br
- Response time: up to 15 days
- Competent authority: ANPD — www.gov.br/anpd