Legal
Privacy Policy
Effective date: 2 October 2026
App: kTool — Sail Performance Analysis
Website: www.ktool.hu
Company
H B D C Software Solutions DWC-LLC
Business Center Logistics City, Dubai Aviation City, P.O. Box 390667, Dubai, U.A.E.
Contact: info@ktool.hu
1. Who we are and what this policy covers
H B D C Software Solutions DWC-LLC (“kTool”, “we”, “us”) is the data controller for the personal data described in this policy. This policy explains what we collect, why, on which legal basis, who we share it with and what rights you have when you use:
the kTool web app at https://app.ktool.hu (the “App”),
our website at https://ktool.hu (the “Website”), and
emails we send you (account, transactional and marketing emails).
Our company is registered in the United Arab Emirates and we serve customers worldwide, including in the European Economic Area (EEA), the United Kingdom and Switzerland. Where the EU or UK General Data Protection Regulation (GDPR) applies to you, we follow it; where the UAE Personal Data Protection Law applies, we follow that.
For anything related to your personal data, contact us at info@ktool.hu.
2. What data we collect
a. Account data
When you create an account we collect your email address, a username, your first and last name and a password (stored only as a hash). We record when you accepted our Terms and whether you opted in to marketing emails. If you sign in with Google, we receive your name, email address and Google account identifier from Google and use them to create or sign you in to your kTool account; we never see your Google password.
b. Sailing data you upload
The App analyses GPS and sensor recordings that you upload as files from tracking devices. These files contain positions, timestamps, course and speed and, depending on the device, heading, heel, pitch, roll, acceleration, wind and environmental readings. You also give each boat a name and a class. We derive analysis results from these files: tracks, manoeuvres, straight-line statistics, inferred wind and performance metrics. To put a session into context we also look up historical weather for the approximate location (the average position of the track) and date of the recording from Open-Meteo.
Video files are never uploaded. Videos you attach to a session are played directly from your device. Only the file name, size, timestamps and playback offsets are stored in your browser so the attachment survives a page reload.
c. Report requests and AI reports
When you request a detailed report you can add free-text notes, your goals, a focus boat and a link to a public race replay. Reports prepared by our team are sent to your account address. AI-generated reports (section 6) use the analysis results of the selected session together with the notes and goals you enter. Report requests are kept while your account exists, even after you delete the session they refer to.
d. Payment data
Subscriptions are paid through Stripe. Your card details go directly to Stripe; we never receive or store them. We receive your subscription status, plan, renewal dates and the amounts paid so that we can provide the paid features and keep accounting records.
e. Communications
When you email us, request a report, ask for a data export or account deletion, we keep the correspondence. If you subscribe to our newsletter on the Website, your email address is added to our newsletter list until you unsubscribe. If you tick the marketing checkbox at sign-up, we record that choice on your account and may send you product updates and tips; you can change it at any time by contacting us or through the unsubscribe link in any such email.
f. Technical and usage data
Our servers and hosting providers log the IP address, browser type, time and requested page of every request to keep the service running and secure. With your consent we also collect product analytics and session recordings (section 11), and we collect error reports whenever the App fails (section 8). The country you are visiting from is derived from your IP address at our hosting provider's edge to decide which cookie banner to show; only the result (“in the EEA/UK or not”) is stored, in a cookie, for one day.
g. Referral and campaign data
If you arrive through a referral link or an advertising campaign, we store the referral code for 24 hours in your browser and record which campaign brought you, so that we can credit referrals and measure advertising (section 11).
3. Data about other people
kTool is used by coaches, and a coach typically uploads recordings of the sailors they train. GPS tracks are personal data of the sailor who was on the boat, even when the sailor has no kTool account.
If you upload data about other people, you are responsible for having the right to do so: you confirm that the sailors (or, for sailors under 16, their parents, guardians or sports organisation) know that their recordings are analysed in kTool, and you agree to tell them where they can read this policy. We process such data only to provide the service to you and as described in this policy, and we delete it when you delete the session or your account.
If you use kTool on behalf of a club, team or federation and need a data processing agreement, contact us at info@ktool.hu.
If you are a sailor whose data was uploaded by someone else, you can exercise the rights in section 12 directly with us. We may need to check with the account holder who uploaded the data.
4. Why we use your data and on what legal basis
Where we rely on consent you can withdraw it at any time: for cookies through the cookie settings (section 11), for marketing emails through the unsubscribe link in every email, and for anything else by contacting us. Withdrawing consent does not affect processing that happened before.
Where we rely on legitimate interest we have considered the impact on you and use only what is needed for that purpose. You can object to any processing based on legitimate interest (section 12).
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
5. Sharing sessions between accounts
You can share a session with another kTool user by creating a share link. Opening the link requires a kTool account; the session then appears in the recipient's list and they can see the same tracks, boats and analysis results you see. Sessions are not public: viewing one requires a kTool account and a link you created. The recipient also sees any AI-generated reports for that session, including the notes and goals you entered when requesting them. A share link stays valid until you delete the session. Only share sessions with people who are entitled to see the sailors' data in them.
6. AI-generated reports
Subscribers can ask kTool to generate a written debrief of a session. To do this we send the analysis results of that session (manoeuvre and straight-line statistics, wind, boat names and classes, timestamps and the session's time zone) together with the notes and goals you enter to a large language model. We do not send raw GPS tracks, positions, or your name, email or account id.
The models run on Amazon Web Services (AWS Bedrock) in the EU. Under the AWS terms your data is not used to train models and is not retained by the model provider beyond processing the request. Report text is stored with your session on our servers and deleted when you delete the session or your account.
While this feature is new, a member of the kTool team may review a generated report before it is published to you; the reviewer sees the report, the analysis it was based on and the notes and goals you entered, so please do not put other people's names or contact details in them. AI reports are informational: they can contain mistakes and they are not a substitute for your own judgement or a coach's advice.
7. Who we share data with
We do not sell personal data. We share it with the service providers below, who process it on our behalf under data processing terms, and with the advertising partners in section 11, who act as independent controllers.
We may also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition, in which case this policy continues to apply to your data.
8. Error monitoring
When something goes wrong in the App or on our servers we send a report to Sentry so that we can find and fix the problem. It contains the technical details of the error, the pages and actions that led to it, a replay of the screen at the moment of the error with text and media masked, and — if you are signed in — your account id, username and email address so that we can contact you if the error affected your data. Passwords, sign-in tokens and other secrets are removed before sending, our Sentry projects are configured not to store IP addresses, and Sentry sets no cookies. Reports are kept for 90 days. Error monitoring runs regardless of your cookie choice because we need it to keep the App working; you can object to it (section 12).
9. International transfers
Our main infrastructure and our analytics and error monitoring providers are in the EU. Some providers (Vercel, SendGrid, Stripe, Mapbox, Google and the advertising partners in section 11) process data in the United States. For transfers out of the EEA, the UK and Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) and, where the provider is certified, on the EU–US Data Privacy Framework. Certification status can change; the Standard Contractual Clauses apply in any case.
Our team works from the EU and the UAE and may access data from either location, under the same access controls and security measures wherever they are; within the UAE we also follow the Personal Data Protection Law.
10. How long we keep data
11. Cookies and similar technologies
We use cookies, local storage and similar technologies on the Website and in the App. They fall into three categories.
Essential
Needed for the sites to work: keeping you signed in, protecting forms against forgery, remembering your cookie choice and which banner to show you. These are always active and need no consent.
Analytics
With your consent we use PostHog to understand how features are used, including session recordings in which every text field is masked. PostHog is our processor and stores its identifier in a cookie shared between ktool.hu and app.ktool.hu, so that a visit to the Website and a later sign-up in the App are counted as one journey. Once you sign in to the App, that identifier is linked to your account (id, email address and username) so that we can look at usage per account; we stop linking your activity if you withdraw consent.
Advertising and campaign measurement
With your consent we load advertising tags through Google Tag Manager (which sets no cookies of its own) from Google Ads and Google Analytics, Meta, TikTok and Reddit. They tell us whether an advert led to a visit or a sign-up and let those platforms show our adverts to people who visited our sites. These partners are independent controllers: they use the data they receive for their own purposes under their own privacy policies, which is why these tags load only after you consent. We do not pass names, emails or user ids to them.
Cookie inventory
Your choice
If you visit from the EEA or the UK, analytics and advertising technologies are off until you click “Accept” in the banner; “Reject non-essential” keeps them off. Visitors from other countries are shown a notice and can opt out at any time. Your choice is stored in a cookie on the ktool.hu domain, so it applies to both the Website and the App; the App also keeps a copy of it in local storage in case cookies are unavailable. On the Website only, if you have not consented or have rejected, PostHog still counts page views anonymously: nothing is stored in your browser, no identifier is created, your IP address is discarded, and the visit cannot be linked to you or to a later one — the same footing as the Vercel measurements described below. In the App, nothing is sent to PostHog without consent.
You can change or withdraw your choice at any time using the “Cookie settings” link in the Website footer or, in the App, under Profile → Data management. When you withdraw, we also delete the advertising cookies and the analytics identifier from your browser, as far as the browser lets us. You can also block or delete cookies in your browser settings; blocking essential cookies will stop you from signing in.
The Website also uses Vercel Web Analytics and Speed Insights to count page views and measure loading performance. They set no cookies and store nothing in your browser; a page view is attributed to a short-lived hash that is not linked to you. We run them on the basis of our legitimate interest in keeping the Website fast.
12. Your rights
Depending on where you live, you have the right to:
access the personal data we hold about you and receive a copy;
have inaccurate data corrected;
have your data deleted (“right to be forgotten”);
receive the data you gave us in a portable, machine-readable format;
restrict or object to processing, including processing based on legitimate interest;
withdraw consent at any time, without affecting earlier processing;
lodge a complaint with a data protection authority.
To exercise any of these rights, email info@ktool.hu from the address on your account. We answer within one month.
Deleting your account and exporting your data
In the App, go to Profile → Data management and use Delete account or Export my data; both send us an email request from your account address. Deletion is processed within 30 days and permanently removes your account, sessions, boats, analysis results and reports; sessions you shared disappear from the recipients' lists too. An export gives you a copy of your personal data in a machine-readable format.
If you are in the EEA or the UK you can complain to the data protection authority of the country where you live or work. We would appreciate the chance to resolve your concern first.
13. Security
All traffic to the Website, the App and our servers is encrypted in transit. Data is stored in access-controlled cloud environments in the EU, passwords are stored only as salted hashes, and access to production systems is limited to the people who operate them. Payment card data never touches our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will inform you and the relevant authority of a data breach where the law requires it.
14. Children
kTool accounts are for people aged 16 and over. We do not knowingly create accounts for younger children; if you believe a child has created an account, contact us and we will delete it. Recordings of younger sailors may be uploaded by their coach or parent under section 3.
15. Changes to this policy
We will update this policy when our processing changes. The effective date at the top tells you when the current version took effect. For significant changes — a new purpose, a new category of data or a new kind of recipient — we will tell you in the App or by email before the change applies, and ask for your consent again where the law requires it.
16. Contact
Questions about this policy or your personal data:
Email: info@ktool.hu
Address: H B D C Software Solutions DWC-LLC, Business Center Logistics City, Dubai Aviation City, P.O. Box 390667, Dubai, U.A.E.
Our Terms of Use are at https://ktool.hu/terms.