Privacy policy

Version of 05.10.2026 · Terms of use

This policy explains what personal data Let's Kite collects, why, how long we keep it, who we share it with and how to exercise your rights. It applies to letskite.ch (and letskite.fr, letskite.be, lets-kite.com), its widgets, its API and our apps. In case of discrepancy, the French version prevails.

1. Controller

Fred Contat, trading as “Let's Kite”, Ch. de la Riettaz 4, 1442 Montagny, Switzerland. Contact: contact form.

2. Legal framework

We are established in Switzerland and process your data in accordance with the Swiss Federal Act on Data Protection (FADP). As the Service also addresses people in the European Union, we also apply the principles of the GDPR.

3. The data we process

We do not sell your personal data and do not use it for targeted advertising. We do not collect bank card numbers, which stay with Stripe.

You are not obliged to provide this data, but some of it is necessary to provide the Service: without an e-mail, there is no account.

4. Cookies and similar technologies

• Strictly necessary cookies: session cookie (keeps you logged in, deleted when you close the browser), persistent “remember me” login cookie (1 year, deleted when you log out), preferred language cookie.
• Matomo audience measurement: self-hosted on our domain stats.letskite.ch, with no transmission to any third party. It may set cookies lasting up to 13 months. You can object by enabling “Do Not Track” in your browser or by asking us.
• No advertising cookies and no social network trackers. Any partner banners we display are served by our own system.
• Some interface elements (icons, ALTCHA anti-bot check) are loaded from third-party content delivery networks (CDNs): your IP address is then necessarily disclosed to them.

5. Who we share your data with

Your data is only accessible to us and to providers who help us deliver the Service, who are bound to protect it:

• Hosting: dedicated server rented from Hetzner (Finland). The database, the search engine, audience measurement, error tracking and authentication of the Wind Tracker app (Supabase) run on our own servers.
• Stripe (payments and subscription management).
• E-mail delivery provider (service e-mails, alerts, newsletter).
• Telegram and Strava, only if you enable these features.
• Mobile notification services of your system (Apple, Google), if you enable app notifications.
• Map tile and resource providers (maps, fonts and icons), which receive your IP address when your browser loads their resources.
• Authorities, if the law requires us to or to defend our rights in court.
• In case of a takeover of the business, the acquirer, under the same commitments.

Nicknames you publish (comments, ads, public sessions) are visible to all visitors.

6. Transfers abroad

Some of our providers (notably Stripe) may process data outside Switzerland and the European Economic Area, including in the United States. In that case, we make sure an appropriate level of protection is ensured, through an adequacy decision (for example the Swiss–US data privacy framework) or standard contractual clauses.

7. Retention periods

Retention periods are shown in the table in article 3. When they expire, data is deleted or anonymised. We may keep it longer if the law requires (accounting obligations) or if we need it to establish, exercise or defend a right (ongoing dispute, investigation of fraud or breach of the Terms). When you delete your account, your account data, preferences and content are deleted, or anonymised where deleting them would disrupt the community, except for what we must legally keep.

8. Security

We protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored in irreversibly encrypted form, restricted access, logging, backups. No measure offers absolute security. In case of a security breach likely to present a high risk to your rights, we inform you and notify the competent authority, as required by law.

9. Your rights

At any time you may:

• obtain information about the data we hold and receive a copy;
• have inaccurate data corrected;
• have your data deleted, or its processing restricted;
• object to processing based on our legitimate interest;
• withdraw a consent given (Telegram, Strava, newsletter), without affecting what happened before;
• request your data in a common format (portability).

To exercise these rights, write to us through the contact form from the e-mail address of your account. We may ask you to prove your identity and reply within one month. You can also change much of your data directly in your account.

If you believe your data is being mishandled, you may contact the Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the European Union, the data protection authority of your country.

10. Automated decisions

We make no decision producing legal effects on you based solely on automated processing. However, automatic tools detect abnormal behaviour (for example use of an account from an unusual number of IP addresses, or bursts of requests). They are used to raise alerts, and any account suspension is reviewed by a human.

11. Children

The Service is not intended for children under 16, who must not create an account without the consent of their legal guardian. If we learn that we hold a child's data without such consent, we delete it.

12. Changes

We may amend this policy, for example if our processing changes. The version in force is the one published here, with its date. We will inform you of significant changes by e-mail or when you log in.