Privacy Policy

1. Who processes your data

The data controller is Alessio Cerizzi, registered at Via Giuseppe Verdi 9, 20851 Lissone (MB), Italy, VAT number 03069620965. For any matter concerning personal data you can write to info@droppromotion.com.

2. What data we collect

Data you give us

• Account: email address and password (stored only in encrypted form; we cannot read it).
• Profile: name, username, city, country, bio, profile photo, optional phone number and Instagram handle. All optional except what is needed to create the account.
• Training data: belt and degrees, starting year, weight category, training style, home academy, coach and lineage, competition results.
• Year of birth: we ask for it at sign-up to check the minimum age threshold (see section 8) and we use it to suggest your age division for competitions (Juvenile, Adult, Master). In your profile it is optional: you can leave it empty or delete it at any time. It does not appear on your public profile and we do not ask for the full date: the year is enough for both purposes.
• Gym data (if you are an owner): contact details, address, photos, schedules, instructors, events, announcements board.
• Other people's data that you upload (if you manage a gym): name, photo, rank or expertise of instructors and support staff who do not have an account on BJJ Square — for example a strength coach or an instructor of another discipline. This information is public on the gym page. Before saving it we ask you for an explicit declaration: that the qualifications are true and that the person agrees to appear. We record who declared it and when. The gym page owner is the controller of this data; we store and publish it on their behalf. Anyone appearing this way can ask to be removed by writing to us or using the report link on the gym page, and we remove them without asking the person who uploaded them.
• "Find training partners" posts: if you publish a post to find training partners, we store the preferences you set (belt, gi/no-gi, weight category, availability, notes) and the area you choose (the city or reference gym). The post is visible to other users for as long as you keep it active.

Data generated as you use the service

• Gym membership: if you link to a gym as a student, we record the link. It becomes effective only with mutual confirmation (you and the gym). The gym's managers can see their linked students in their panel.
• Attendance (check-ins): when you check in to a class we record the session, gym, date and time. The managers of that gym (coach and owners) can see your attendance in their panel. Publicly, on the gym page, we only show an anonymous count of attendees, never names.
• Notifications: we generate in-site notifications to inform you of activity that concerns you (for example an invitation to co-manage a gym). They stay in your notifications area until you delete them.
• Badges and statistics: some achievements and statistics are computed automatically from your activity (for example your check-ins).
• Competition alert by email: if you request it from a country's competitions page, even without an account, we store your email address, the country and the language. We only write to you after you confirm with the link you receive, at most once a week, with that country's competitions. Every email contains an unsubscribe link.
• Trial class requests: if you ask for a trial class from a gym's page, even without an account, we store your name, email and/or phone, the experience and belt you enter, the preferred class and your message, plus a code derived from your IP address (not the IP itself) to limit abuse. The request goes only to that gym's managers, in the app and by email, and they get back to you using the contact details you left. From then on the gym uses your contact details as an independent controller, to reply to you.
• Check-in from the gym's tablet: if the gym uses reception mode, you can record your attendance by tapping your photo on the tablet at the gym. We record it as a normal check-in, noting that it was made from the tablet.

Data collected automatically

• Essential technical data needed to run the service (IP address, browser type), processed by our infrastructure providers for security and abuse prevention.
• Location: if you use the "use current location" feature to filter nearby events, the location is used at that moment to compute distances and is not stored. The exception is the "find training partners" feature: there, the area you choose is saved in your post (see above). Otherwise we use the coordinates of the gym you set as your home academy.
• AI assistants (BJJ Square app in ChatGPT and MCP server): when you search for gyms or competitions from an AI assistant, we only receive the search parameters: city, country, coordinates of a place rounded to about 1 km, gym identifier, dates. We do not receive your name, your email or the text of the conversation, and no BJJ Square account is needed. We only keep a daily count of searches by type, with no data about who made them. Responses only contain data that is already public on the website. The assistant is run by its provider (for example OpenAI for ChatGPT), which processes the conversation under its own privacy policy.

3. Why we process your data and on what legal basis

We do not process your data for marketing purposes and we do not sell it to third parties.

4. Publicly visible data

BJJ Square is a community platform: some information is public by design. Specifically, anyone can see your athlete profile (name, username, city, belt, academy, bio, photo, competition results) and, if you are an owner, the whole gym listing with its published events and announcements board. If you publish a "find training partners" post, it is visible to other users with the preferences and area you set.

Your attendance is not public in detail: the gym page only shows the number of people at a class, never names. If you leave the Activity visible on your profileswitch on (in your training log, Tatami tab of your profile), your public profile shows yourpassport — the gyms where you checked in or that you entered in your training log and the city of the competitions you took part in, with the number of times but never dates, and only from 3 gyms up — and your last-30-day totals. With the same switch you appear in the weekly attendance ranking and in your gym's ranking, which only its confirmed members and managers can see. If your gym uses thegym screen (a TV or tablet at its premises), with the same switch your first name and last initial, photo and belt can appear on the screen among those on the mat, in the monthly ranking, in the weeks-in-a-row streaks and among the new belts; with the switch off you only count in the numbers, without your name. For minors this information is never public and never appears on the screen. Your Want to roll there list is visible only to you; for gyms not yet claimed we count internally how many people listed them, only the number and never the names, to know which ones to contact. When you tap I'm going on an event or open mat, only the number of people going is public, never your name. When your coach records a promotionfor you, you receive a congratulations email and, if you are an adult, the promotion gets a public page (name, belt, coach, gym and date) and appears among the New belts of the registry: you can hide it at any time from your promotions. If you tap Add to Google Wallet, we send Google (Google Wallet) your name, belt and stripes, who certified it, your gym and the link to your profile, to create the card on your phone; if you don't, nothing is sent to Google. The email address, phone number and password of your profile are never public. You can edit or remove your profile information at any time from your personal area.

The contact details you enter on an event are an exception: the WhatsApp number and contact email you fill in when you submit or publish an event are published on the public page of the event and also shown in the events feed. They are therefore visible to anyone, including people without an account, and can be indexed by search engines. Only put there a contact you want to be public: you can remove it at any time by editing the event.

5. Who we share data with

We do not sell your data. We do rely on providers that process data on our behalf, as data processors:

• Supabase — database, authentication and image storage.
• Vercel — website hosting and delivery.
• Resend — sending service emails (sign-up confirmation, password reset), the competition alert to those who requested it, the notice to a gym's manager when a trial class request arrives, and the internal notification to our team on each new sign-up.
• Cloudflare Turnstile — anti-bot check on the trial class request form (receives technical browser data and the IP address).
• OpenStreetMap / Nominatim — converting addresses into map coordinates.
• CARTO — map background tiles.
• Cloudflare (cdnjs) — delivery of the map libraries.

Some providers may process data outside the European Union. Where this happens, the transfer relies on the Standard Contractual Clauses approved by the European Commission or on an adequacy decision.

6. How long we keep data

We keep your account data for as long as the account is active. You can delete it at any time from your profile settings: in that case your profile, attendance, "find training partners" posts, notifications and other associated personal data are erased, except what we must retain to comply with the law or to establish or defend a legal claim.

If you managed a gym, the gym listing is not deleted (it is information of interest to the community) but it is unlinked from you: it stays without an owner until someone else claims it. Public content you created for a gym (for example past events) may remain visible in a form that cannot be traced back to you.

The competition alert address is deleted 30 days after you unsubscribe, or 30 days after the request if you never confirmed it.

Trial class requests are deleted automatically 12 months after they are sent. You can ask us to delete them earlier by writing to us.

7. Your rights

At any time you can:

• access your data and request a copy;
• correct or update it (mostly directly from your profile);
• request its erasure;
• request restriction of processing, or object to processing based on legitimate interest;
• receive your data in a machine-readable format (portability);
• withdraw a consent you gave, without affecting the lawfulness of earlier processing.

To exercise these rights write to info@droppromotion.com. If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.

8. Minors

You must be at least 14 years old to register on your own. For younger athletes the account must be created and managed by a parent or legal guardian. If we learn that an account was created by a child under 14 without such consent, we remove it.

At sign-up we ask for the year of birth and do not let anyone who declares they are under 14 complete registration. The data is self-declared and we do not verify it: it is a proportionate measure, not an identity check, and it does not let us know for certain how old someone is.

Kids-system belts may appear on a profile managed by a parent, or be assigned by the coach from the gym panel: in that case the child's data is entered by an adult, who is responsible for what they upload.

9. Cookies

We use technical cookies necessary to run the site and one first-party statistical cookie that, on your first visit, remembers for 30 days where you came from (the referring site, for example a search engine, or the source label of a link such as a flyer, a newsletter or a post) and the landing page. If you sign up, this is stored on your profile so we know which channel brought you here: the cookie holds no identifiers and nothing is shared with third parties. Details are in the Cookie Policy.

10. Changes

If we update this notice we will change the date at the top of the page and, for significant changes, let you know by email or directly on the site.