Privacy Policy

Phase 01 · Founder Waitlist
Last updated: 7 October 2026 · Version: 1.1

01 · About this Policy

This Privacy Policy explains how KUTR Pro League Pty Ltd (ABN 24 327 316 672) collects, uses, stores, and discloses personal information in connection with the KUTR platform at kutr.gg and any related applications and services (the “Platform”). It applies to everyone who interacts with the Platform: waitlist sign-ups now, account holders when accounts open, and visitors who don't sign up.

KUTR Pro League Pty Ltd is the data controller for the personal information described here. The Platform is operated under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you are a resident of the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR also apply to your personal information and we honor the rights they grant. Where you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply to the extent our processing is in scope, summarized in section 12.

During Phase 01, this Policy governs information we process for Founder Waitlist sign-ups. Updated terms will be issued with reasonable notice before paid features (Stake Battles, subscriptions) launch. Material changes will be notified per section 13. Questions: hello@kutr.gg.

02 · Personal information we collect

Waitlist (current phase)

When you submit the waitlist form, we collect: your email address; the role you intend to use the Platform under (Member, Barber, or Shop Owner); your country (as an ISO code); optionally, your city. We also automatically capture the IP address you submitted from stored only as a SHA-256 hash, not the raw address; the user-agent string your browser provides; UTM parameters present in the page URL if you arrived via a tracked link; and a timestamp.

Account and profile (when launched)

When account creation opens, we will collect the information necessary to operate the features you use: your name, date of birth (for age-gating), profile photo, bio, social links, location at city level for matchmaking, and role-specific data. For barbers, that includes portfolio photos and shop affiliation. For shop owners, that includes your business ABN, registered business address, and roster of barbers you approve. We do not collect government-issued identity documents during Phase 01.

Transaction data (when launched)

Payments are processed by Stripe. KUTR receives only the metadata necessary for our records: transaction ID, amount, status, and the last four digits of the card. We do not store full card numbers, CVCs, or bank account details. Stripe's own privacy practices apply to the data it processes on our behalf.

Usage and device data

As you use the Platform we record service operation data: pages and screens viewed, features used, KBR and REP score history, votes cast, predictions placed, bookings made, and battles entered. These records are timestamped and tied to your account (or to the waitlist row, before account creation).

03 · How we use it

We use personal information to operate the Platform, including: running contests and maintaining KBR and REP rankings; processing bookings and payments; honoring founder benefits when waitlist sign-ups create an account at launch; communicating with you about your account, your activity, and material changes to the Platform; preventing fraud, vote manipulation, and other abuse; complying with legal obligations and cooperating with regulators where required by law.

We also use de-identified or aggregated data to improve the Platform: for example, to analyze how features are used in aggregate, identify performance issues, and decide what to build next.

We do not use your personal information for marketing communications unless you have explicitly opted in. Service notifications (booking reminders, contest results, account security alerts) are not marketing and are sent regardless of marketing consent.

04 · Lawful bases (GDPR-applicable users)

For users in scope of the GDPR or UK GDPR, the lawful bases on which we process personal information are:

  • Performance of contract: for the operation of the Platform features you have requested (account, bookings, contests, payments).
  • Legitimate interest: for service analytics, fraud prevention, and platform integrity, with a documented balancing test that weighs your interests and rights against ours.
  • Consent: for marketing communications and any non-essential cookies if we introduce them.
  • Legal obligation: for regulator-required disclosures, tax records, and similar.

05 · Disclosure to third parties

We share personal information only with the processors necessary to operate the Platform. Each is contractually bound to data-protection obligations and uses your data only on our documented instructions.

  • Supabase Inc. (USA / EU regions): primary data hosting, Postgres database, authentication, realtime broadcasts.
  • Stripe Inc. (USA / Australia): payments, subscription management, payouts.
  • Vercel Inc. (USA): application hosting and edge network for the Platform.
  • Cloudflare Inc. (USA): DNS and the Turnstile anti-abuse service used on the waitlist form.
  • Resend Inc. (USA): transactional email delivery.
  • PostHog Inc. (USA): product analytics and session recording, only if you accept analytics cookies.
  • Functional Software, Inc. (Sentry) (USA): error monitoring for the Platform; session replay only if you accept analytics cookies.
  • Anthropic PBC (USA): AI assistant features (where you invoke them).

We do not sell personal information. We do not share personal information with advertising networks. Where any of our processors changes, this Policy will be updated to reflect the new arrangement.

06 · Cross-border transfers

Personal information may be transferred to and stored in the United States and the European Union via the processors listed above. For Australian users, this is disclosed under Australian Privacy Principle 8 (cross-border disclosure of personal information). For users in the EU or UK, transfers outside the EEA are protected by the European Commission's Standard Contractual Clauses, with supplementary safeguards where required following the Schrems II decision.

You may request a copy of the relevant transfer mechanism for any disclosure by emailing hello@kutr.gg.

07 · Retention

Waitlist emails are retained until six (6) months after your region launches publicly, then deleted unless you have converted the row into an account. If you convert, the waitlist row is preserved as part of your account record.

Account data is retained for the duration of your active account and for ninety (90) days after a deletion request, after which only data legally required to be retained (financial records under tax law, regulator disclosures, fraud-prevention logs) is kept, and only for as long as the relevant law requires.

Aggregated and anonymized data (for example, count of contests run per city, average KBR per region) may be retained indefinitely for analytics. This data is irreversible: it cannot be re-associated with an individual.

08 · Security

Data in transit is encrypted with TLS 1.2 or higher. Data at rest in our primary database is encrypted by Supabase at the storage layer (AES-256). Access to personal information is controlled by row-level security policies enforced in the database, so the Platform's own code cannot return rows the requesting user is not authorized to see. Internal access by KUTR personnel is on a need-to-know basis with audit logging.

We maintain an incident-response procedure. Where a data breach is reasonably likely to result in serious harm, we notify affected users and the Office of the Australian Information Commissioner (OAIC) within the timelines required by the Notifiable Data Breaches scheme; for users in the EU or UK, we notify within the timelines set by GDPR Articles 33 and 34.

09 · Your rights

Depending on where you live, you have some or all of the following rights over your personal information:

  • Access: request a copy of the personal information we hold about you.
  • Correction: fix data that is inaccurate or out of date.
  • Deletion: close your account and delete your personal information, subject to the retention exceptions in section 7.
  • Portability: receive your data in a machine-readable format where technically feasible.
  • Object to processing for marketing.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au, or your local supervisory authority if you are in the EU or UK.

To exercise any of these rights, email hello@kutr.gg from the email address on file. We respond within 30 days and will tell you if we need an extension or additional verification.

10 · Cookies and similar technologies

The waitlist landing uses essential cookies for session continuity, authentication state, and the Cloudflare Turnstile anti-abuse check on form submission. We do not use advertising cookies, third-party tracking pixels, or browser fingerprinting.

We use analytics cookies only if you accept them in the cookie banner. Our analytics processor is PostHog (see section 5). Analytics stays off until you accept, choosing Essential Only keeps it off, and you can change your choice at any time from Cookie settings. Error monitoring (Sentry) runs for every visitor to keep the Platform working; its session replay runs only if you accept analytics cookies.

11 · Children

The Platform is targeted at adults and at competitive barbering professionals, who are adults. We do not knowingly collect personal information from anyone under the age of 16. Stake Battles are 18+ regardless. If we become aware that we have collected personal information from someone under 16 without verifiable parental consent, we will delete it promptly.

Parents or guardians who believe a child under 16 has provided personal information to the Platform can email hello@kutr.gg to request deletion.

12 · California residents

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the rights to: know what personal information we collect about you and how we use it; delete your personal information, subject to legal retention exceptions; correct inaccurate personal information; opt out of the sale or sharing of personal information; and not be discriminated against for exercising these rights.

KUTR does not sell personal information and does not share it for cross-context behavioral advertising. Requests under the CCPA/CPRA can be made by emailing hello@kutr.gg.

13 · Changes to this Policy

We may update this Policy from time to time. Material changes (anything that meaningfully affects how we collect, use, or disclose your personal information) will be notified by email to the address on file and by an on-Platform notice with at least 30 days' advance notice where practicable. Non-material changes (clarifications, formatting updates, processor list adjustments) take effect on publication. We encourage you to review this Policy periodically.

14 · Contact and Data Controller

The data controller for the personal information described in this Policy is KUTR Pro League Pty Ltd (ABN 24 327 316 672). All privacy questions, access requests, deletion requests, and complaints can be sent to hello@kutr.gg.

KUTR Pro League Pty Ltd
ABN 24 327 316 672
117/530 Little Collins Street, Melbourne VIC 3000, Australia

The mark “KUTR” is a registered trade mark of KUTR Pro League Pty Ltd, IP Australia Trade Mark 2646208 (filed 21 April 2026).