Privacy Policy

1. Who processes your data

The data controller is Alessio Cerizzi, registered at Via Giuseppe Verdi 9, 20851 Lissone (MB), Italy, VAT number 03069620965. For any matter concerning personal data you can write to info@droppromotion.com.

2. What data we collect

Data you give us

• Account: email address and password (stored only in encrypted form; we cannot read it).
• Profile: name, username, city, country, bio, profile photo, optional phone number and Instagram handle. All optional except what is needed to create the account.
• Training data: belt and degrees, starting year, weight category, training style, home academy, coach and lineage, competition results.
• Year of birth: we ask for it at sign-up to check the minimum age threshold (see section 8) and we use it to suggest your age division for competitions (Juvenile, Adult, Master). In your profile it is optional: you can leave it empty or delete it at any time. It does not appear on your public profile and we do not ask for the full date: the year is enough for both purposes.
• Gym data (if you are an owner): contact details, address, photos, schedules, instructors, events, announcements board.
• Other people's data that you upload (if you manage a gym): name, photo, rank or expertise of instructors and support staff who do not have an account on BJJ Square — for example a strength coach or an instructor of another discipline. This information is public on the gym page. Before saving it we ask you for an explicit declaration: that the qualifications are true and that the person agrees to appear. We record who declared it and when. The gym page owner is the controller of this data; we store and publish it on their behalf. Anyone appearing this way can ask to be removed by writing to us or using the report link on the gym page, and we remove them without asking the person who uploaded them.
• "Find training partners" posts: if you publish a post to find training partners, we store the preferences you set (belt, gi/no-gi, weight category, availability, notes) and the area you choose (the city or reference gym). The post is visible to other users for as long as you keep it active.

Data generated as you use the service

• Gym membership: if you link to a gym as a student, we record the link. It becomes effective only with mutual confirmation (you and the gym). The gym's managers can see their linked students in their panel.
• Attendance (check-ins): when you check in to a class we record the session, gym, date and time. The managers of that gym (coach and owners) can see your attendance in their panel. Publicly, on the gym page, we only show an anonymous count of attendees, never names.
• Notifications: we generate in-site notifications to inform you of activity that concerns you (for example an invitation to co-manage a gym). They stay in your notifications area until you delete them.
• Badges and statistics: some achievements and statistics are computed automatically from your activity (for example your check-ins).

Data collected automatically

• Essential technical data needed to run the service (IP address, browser type), processed by our infrastructure providers for security and abuse prevention.
• Location: if you use the "use current location" feature to filter nearby events, the location is used at that moment to compute distances and is not stored. The exception is the "find training partners" feature: there, the area you choose is saved in your post (see above). Otherwise we use the coordinates of the gym you set as your home academy.

3. Why we process your data and on what legal basis

We do not process your data for marketing purposes and we do not sell it to third parties.

4. Publicly visible data

BJJ Square is a community platform: some information is public by design. Specifically, anyone can see your athlete profile (name, username, city, belt, academy, bio, photo, competition results) and, if you are an owner, the whole gym listing with its published events and announcements board. If you publish a "find training partners" post, it is visible to other users with the preferences and area you set.

Your attendance is not public: the gym page only shows the number of people at a class, never names. Email, phone number and password are never public. You can edit or remove your profile information at any time from your personal area.

5. Who we share data with

We do not sell your data. We do rely on providers that process data on our behalf, as data processors:

• Supabase — database, authentication and image storage.
• Vercel — website hosting and delivery.
• Resend — sending service emails (sign-up confirmation, password reset) and the internal notification to our team on each new sign-up.
• OpenStreetMap / Nominatim — converting addresses into map coordinates.
• CARTO — map background tiles.
• Cloudflare (cdnjs) — delivery of the map libraries.

Some providers may process data outside the European Union. Where this happens, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision.

6. How long we keep data

We keep your account data for as long as the account is active. You can delete it at any time from your profile settings: in that case your profile, attendance, "find training partners" posts, notifications and other associated personal data are erased, except what we must retain to comply with the law or to establish or defend a legal claim.

If you managed a gym, the gym listing is not deleted (it is information of interest to the community) but it is unlinked from you: it stays without an owner until someone else claims it. Public content you created for a gym (for example past events) may remain visible in a form that cannot be traced back to you.

7. Your rights

At any time you can:

• access your data and request a copy;
• correct or update it (mostly directly from your profile);
• request its erasure;
• request restriction of processing, or object to processing based on legitimate interest;
• receive your data in a machine-readable format (portability);
• withdraw a consent you gave, without affecting the lawfulness of earlier processing.

To exercise these rights write to info@droppromotion.com. If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.

8. Minors

You must be at least 14 years old to register on your own. For younger athletes the account must be created and managed by a parent or legal guardian. If we learn that an account was created by a child under 14 without such consent, we remove it.

At sign-up we ask for the year of birth and do not let anyone who declares they are under 14 complete registration. The data is self-declared and we do not verify it: it is a proportionate measure, not an identity check, and it does not let us know for certain how old someone is.

Kids-system belts may appear on a profile managed by a parent, or be assigned by the coach from the gym panel: in that case the child's data is entered by an adult, who is responsible for what they upload.

9. Cookies

We only use technical cookies necessary to run the site. Details are in the Cookie Policy.

10. Changes

If we update this notice we will change the date at the top of the page and, for significant changes, let you know by email or directly on the site.