Privacy Policy

1. Introduction

Purple Dragon ("we," "us," or "our") operates the Purple Dragon Dojo Management System ("DMS" or the "Platform"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Platform, visit our website, or interact with our services.

By using our Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, date of birth, gender, mailing address.
• Family & Guardian Information: Parent/guardian name and contact details for minor members.
• Emergency Contact: Emergency contact name, phone number, and relationship.
• Health Information: Medical conditions, allergies, or physical limitations relevant to martial arts training.
• Payment Information: Billing address and payment method details. Card data is tokenized via Authorize.net Accept.js — we never store raw card numbers on our servers.
• Photos & Media: Profile photos, belt promotion photos, and other media you upload.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interactions with the Platform.
• Device Information: Browser type, operating system, device type, and screen resolution.
• Check-in Records: Date, time, and location of class check-ins.
• Cookies: We use essential cookies for authentication and session management. No third-party advertising cookies are used.

2.3 Information from Third Parties

• Payment Processor: Transaction status and payment confirmation from Authorize.net.
• Error Monitoring: When an error occurs, an error report is sent to Sentry for debugging and reliability. Email addresses, phone numbers and similar details are scrubbed from reports before they leave our servers or your browser. If an error happens in your browser, a short session replay of the moments around it may be recorded; all text, form inputs and media in the replay are masked. Sessions without an error are not recorded.

3. How We Use Your Information

• Manage your membership, class enrollment, and attendance tracking.
• Process payments, generate invoices, and manage billing.
• Communicate with you about classes, promotions, billing, and account updates.
• Send SMS notifications if you have opted in (see Section 6).
• Notify parents/guardians when minor members check in to class.
• Track belt rank progression and curriculum requirements.
• Improve the Platform through usage analytics and error monitoring.
• Comply with legal obligations and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We may share information with:

• Payment Processors: Authorize.net to process transactions securely. Where a dojo is configured for them, Stripe, Square, PayPal or WiPay process that dojo's payments instead.
• Communication Providers: SendGrid (Twilio SendGrid) delivers email; Twilio delivers SMS and WhatsApp messages. Where a dojo is configured for them, Vonage or Telnyx deliver SMS, and Meta (WhatsApp Business Platform) delivers WhatsApp messages. These providers receive the recipient's name, email address or phone number and the message content.
• AI Provider: Anthropic processes message text and member activity data to power AI features such as summarizing inquiries, drafting suggested follow-up messages for staff to review, and generating reports for dojo staff.
• Error Monitoring: Sentry for application reliability (scrubbed error reports and masked error-session replays — see Section 2.3).
• Hosting Providers: Supabase (database hosting) and Vercel (application hosting).
• Web Fonts: Some pages load fonts from Google Fonts, so your browser requests them from Google's servers, which receive your IP address and browser details as part of that request.
• Legal Requirements: When required by law, court order, or governmental authority.
• Dojo Staff: Authorized staff at your dojo location can access your membership information to manage classes, billing, and communications.

5. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted via HTTPS/TLS encryption.
• Payment card data is tokenized — raw card numbers never touch our servers (PCI DSS compliant).
• Row-Level Security (RLS) enforced at the database layer to isolate data between locations.
• Role-based access control limits staff access to authorized functions only.
• Passwords are hashed using bcrypt via Supabase Auth.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. SMS Communications & Consent

Marketing and promotional texts — such as birthday greetings, re-engagement ("we miss you") messages and promotions — are sent only to members who have opted in to text messages.

Transactional texts about your account or a service you requested may be sent to the phone number on file, including:

• Class and lesson reminders, booking confirmations and schedule changes.
• Billing notifications, payment receipts and payment reminders.
• Parent/guardian notifications when minor members check in.

Message frequency varies. Standard message and data rates may apply. You can stop all texts — marketing and transactional — at any time by replying STOP to any message, or by turning off Text Messages under Message Preferences on the My Profile page of the member portal. Either one stops text and WhatsApp messages from that dojo to your number. Reply START to opt back in, or HELP for assistance.

Automated and promotional text messages are only sent between 8 a.m. and 9 p.m. in the dojo's local time zone.

SMS consent is not required as a condition of membership or purchase. Your consent information will not be shared with third parties for their marketing purposes.

6A. Email Communications & Unsubscribing

Every newsletter, promotion and other marketing email includes an Unsubscribe link and the dojo's postal address. Clicking the link and confirming (or using your email app's built-in unsubscribe button) removes that email address from the dojo's marketing email. You can also turn off Newsletters & Promotions under Message Preferences in the member portal.

Unsubscribing does not stop transactional email about your account, such as receipts, invoices, payment notices, booking confirmations, password resets and parental-consent requests.

7. Children's Privacy (COPPA)

Our Platform serves martial arts schools that enroll members of all ages, including children under 13. We seek verifiable parental or guardian consent for the personal information we hold about these children.

• Minor member accounts are created by dojo staff or parents/guardians — never by children directly.
• Parent/guardian contact information is collected and linked to minor member records.
• A child's member record may be created (for example, at enrollment or when booking a trial class) before consent has been given. When a member under 13 is recorded, the parent/guardian is emailed a consent request, and consent is given by the parent/guardian through the link in that email — dojo staff cannot record it on a parent's behalf.
• Until consent is given, no marketing, promotional or automated outreach is sent to that member, and push notifications cannot be enabled for them. Messages needed to run the membership — such as the consent request itself, receipts and booking or billing notices to the parent/guardian — may still be sent.
• Parents/guardians may withdraw consent, or review, update, or request deletion of their child's information, at any time by contacting the dojo.
• We do not knowingly collect more information from children than is reasonably necessary for participation in classes.

8. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal information, subject to legal obligations.
• Opt-out: Opt out of SMS or email communications at any time.
• Data Portability: Request your data in a portable, machine-readable format.

To exercise any of these rights, contact your dojo directly or email us at the address listed below.

9. Data Retention

We retain your personal information for as long as your membership is active or as needed to provide services. After membership termination, we retain records for a reasonable period for legal, accounting, and business continuity purposes. Inactive member records are retained for up to 7 years, after which they may be anonymized or deleted.

Communication records: a log of the messages sent to and received from you (email, text, WhatsApp and push notifications — including the recipient address or number and the message text; for emails, link addresses are stripped from the logged text) is kept indefinitely while your record exists — there is currently no automatic deletion period for these logs. Text-message send records, which include the full message body and the number it was sent to, are kept the same way. You can ask your dojo to delete your member record, which removes these logs with it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on the Platform with a revised "Last updated" date. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us: