Privacy Policy

1. Introduction

Purple Dragon ("we," "us," or "our") operates the Purple Dragon Dojo Management System ("DMS" or the "Platform"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Platform, visit our website, or interact with our services.

By using our Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, date of birth, gender, mailing address.
• Family & Guardian Information: Parent/guardian name and contact details for minor members.
• Emergency Contact: Emergency contact name, phone number, and relationship.
• Health Information: Medical conditions, allergies, or physical limitations relevant to martial arts training.
• Payment Information: Billing address and payment method details. Card data is tokenized via Authorize.net Accept.js — we never store raw card numbers on our servers.
• Photos & Media: Profile photos, belt promotion photos, and other media you upload.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interactions with the Platform.
• Device Information: Browser type, operating system, device type, and screen resolution.
• Check-in Records: Date, time, and location of class check-ins.
• Cookies: We use essential cookies for authentication and session management. No third-party advertising cookies are used.

2.3 Information from Third Parties

• Payment Processor: Transaction status and payment confirmation from Authorize.net.
• Error Monitoring: Anonymized error reports via Sentry for debugging and reliability.

3. How We Use Your Information

• Manage your membership, class enrollment, and attendance tracking.
• Process payments, generate invoices, and manage billing.
• Communicate with you about classes, promotions, billing, and account updates.
• Send SMS notifications if you have opted in (see Section 6).
• Notify parents/guardians when minor members check in to class.
• Track belt rank progression and curriculum requirements.
• Improve the Platform through usage analytics and error monitoring.
• Comply with legal obligations and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We may share information with:

• Payment Processors: Authorize.net to process transactions securely.
• Communication Providers: Twilio (SMS) and SendGrid (email) to deliver messages you have opted into.
• Error Monitoring: Sentry for application reliability (anonymized data only).
• Hosting Providers: Supabase (database hosting) and Vercel (application hosting).
• Legal Requirements: When required by law, court order, or governmental authority.
• Dojo Staff: Authorized staff at your dojo location can access your membership information to manage classes, billing, and communications.

5. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted via HTTPS/TLS encryption.
• Payment card data is tokenized — raw card numbers never touch our servers (PCI DSS compliant).
• Row-Level Security (RLS) enforced at the database layer to isolate data between locations.
• Role-based access control limits staff access to authorized functions only.
• Passwords are hashed using bcrypt via Supabase Auth.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. SMS Communications & Consent

We may send SMS messages to members who have explicitly opted in. SMS messages may include:

• Class reminders and schedule changes.
• Billing notifications and payment reminders.
• Birthday greetings and re-engagement messages.
• Parent/guardian notifications when minor members check in.

Message frequency varies. Standard message and data rates may apply. You can opt out at any time by replying STOP to any message or by updating your preferences in the member portal. Reply HELP for assistance.

SMS consent is not required as a condition of membership or purchase. Your consent information will not be shared with third parties for their marketing purposes.

7. Children's Privacy (COPPA)

Our Platform serves martial arts schools that enroll members of all ages, including children under 13. We collect personal information about minor members only with verifiable parental or guardian consent.

• Minor member accounts are created by dojo staff or parents/guardians — never by children directly.
• Parent/guardian contact information is collected and linked to minor member records.
• Parents/guardians may review, update, or request deletion of their child's information at any time by contacting the dojo.
• We do not knowingly collect more information from children than is reasonably necessary for participation in classes.

8. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal information, subject to legal obligations.
• Opt-out: Opt out of SMS or email communications at any time.
• Data Portability: Request your data in a portable, machine-readable format.

To exercise any of these rights, contact your dojo directly or email us at the address listed below.

9. Data Retention

We retain your personal information for as long as your membership is active or as needed to provide services. After membership termination, we retain records for a reasonable period for legal, accounting, and business continuity purposes. Inactive member records are retained for up to 7 years, after which they may be anonymized or deleted.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on the Platform with a revised "Last updated" date. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us: