Privacy policy

Instructors and their members

If you run a dojo (or teach at one with access to it), you have an account with us and we're responsible for your information.

If you're a member (or a parent of a member), your dojo uses KeikoDojo to manage your membership, classes and bookings. Your dojo decides what to ask you and what to record about your training; we store and process that information for them. For questions about what your instructor records, or to ask for a correction, contact your instructor first. You can also contact us at any time.

What we collect

From dojos:

• your name, email, business name, phone, photo and the profile details you choose to publish
• your classes, locations, membership plans and prices, policies and payment details for members (such as your PayID or bank details)
• your answers to the sign-up questions, used to set up your account and to improve the service
• your subscription: plan and billing history. Card payments are handled by Stripe; we never see or store your card number
• the questions and ideas you send us through Help & ideas, and our replies. A question carries details of your own account to help us answer it (your plan, which features you use and recent email delivery problems), never your members' records

From members and parents, through the dojo's join page, their member page or the dojo:

• name, email, phone, and for anyone under 18, a parent or guardian's name and contact details
• bookings, attendance, payments you've told your dojo about (not card details: payments are made directly to the dojo)
• information you choose to share, such as training experience, goals, injuries or medical information relevant to training, and an emergency contact
• a signed waiver, if your dojo uses one: the name you signed, the date and the waiver version
• grades, attendance, notes and progress your dojo records about your training

From visitors to our website: the pages you visit and the campaign you came from (for example, a Facebook ad), using the Meta pixel described below, if we use one.

Children

Many members are under 18. For them, we ask for a parent or guardian's details, and emails about classes and payments go to the parent or guardian. We don't market to children, and no advertising pixel ever runs on join or booking forms or members' pages.

How we use it

• to run the service: classes, bookings, reminders, member pages, memberships and payments tracking, gradings and the dojo's records
• to send emails on a dojo's behalf, in its name (for example, booking confirmations, payment details and announcements)
• to bill dojos for paid plans
• to keep the service secure and fix problems
• to understand how dojos use the service and improve it
• to measure our own advertising, on our marketing pages only

We don't sell personal information, and we don't use members' information for our own marketing.

Cookies and the Meta pixel

We use our own Meta (Facebook) pixel on our public marketing pages only: the home page, pricing and the sign-up pages. It never runs once you're signed in, on dojos' pages, or on members' pages. We send page views, taps on Start free or Contact, and sign-up events only, with automatic events and automatic form matching switched off.

A dojo can add its own Meta pixel to its public page, for example to measure visits from their Facebook posts. It records a page view on that profile page only; it never runs on their booking form, gift page or members' pages. An instructor who adds a pixel is responsible for telling their members and for their own use of Meta's services.

A dojo's public pages (its free class, come and watch, join and course pages) count visits for the dojo: a daily tally of how many visits each page had, where they came from (for example a link the dojo shared, a Facebook ad or a search engine), whether on a phone or a computer, and the hour. The tally never records who visited: no name, cookie or IP address. If you then sign up, your record notes where that visit came from, so the dojo can see which of its posts and ads bring people in.

We also use your browser's storage to keep you signed in and to remember small settings.

Who we share it with

We use trusted providers to run the service. They handle personal information only to provide their service to us:

• Base44, which hosts the app and its data and delivers sign-in emails
• Resend, which delivers the emails we send on dojos' behalf (Base44's email service is the backup if Resend can't deliver one)
• Stripe, which processes dojos' subscription payments
• Meta, which receives the pixel events described above

Some of these providers store or process information outside Australia, including in the United States. We also share information if the law requires it.

Business details and billing records

When a dojo moves to a paid plan, changes it, or changes its billing details, we keep a record of what it told us: its name, organisation type, address, tax or registration numbers, its website, whether it confirmed it's buying for a dojo or club as a business, who confirmed it and when, the country of the connection, and a summary showing the dojo charges its members (the names and prices of its paid plans and how many payments it has received). We keep these records for at least six years, even after a dojo closes its account, because tax law in Australia, the United Kingdom and New Zealand requires us to be able to show why we charged tax the way we did.

If you're in the United Kingdom or New Zealand

United Kingdom. For dojos' own account information we are the controller; for members' information we process it on the dojo's behalf, as its processor, under these terms. Our lawful bases are: providing the service a dojo has signed up for (contract); keeping records the law requires, such as tax records (legal obligation); and running, securing and improving the service (legitimate interests). Information is stored with our providers, including in Australia and the United States. Where the UK has no adequacy decision for a country, we rely on the safeguards our providers offer, such as the UK International Data Transfer Addendum to standard contractual clauses.

Under the UK GDPR you can ask for a copy of your information, ask us to correct or erase it, object to or restrict how we use it, and ask for it in a portable form. Members should usually start with their dojo, which decides what is recorded about them. You can complain to the Information Commissioner's Office (ico.org.uk).

New Zealand. We handle personal information in line with the Information Privacy Principles of the Privacy Act 2020. Information may be stored outside New Zealand with providers who protect it in ways comparable to New Zealand law. You can ask for access to, or correction of, your information, and complain to the Office of the Privacy Commissioner (privacy.org.nz) if you're not satisfied with our response.

If a privacy breach is likely to cause serious harm, we'll tell the people affected and the regulator where the law requires it, and tell any dojo whose members are affected so it can meet its own obligations.

Keeping it secure

Each dojo's data is kept separate from every other dojo's. Members' private page links are stored only in a scrambled form, can be replaced at any time, and stop working when a member is deleted. No system is perfectly secure, but we take reasonable steps to protect personal information from misuse, loss and unauthorised access.

How long we keep it, and what delete means

When a dojo deletes a member in KeikoDojo, the member disappears from the dojo's lists, rolls and totals, and their private page stops working. We keep the record for a while so a mistake can be undone.

If you want your information erased, ask your dojo or email us at privacy@keikodojo.com. We then permanently remove your personal details. We keep only:

• attendance and payment records with your name removed, so the dojo's records still add up
• if you signed a waiver: the name signed, the date and the waiver version, and for a member under 18, their date of birth and the parent or guardian's name. We keep these only as long as they may be needed for a legal claim.

Copies in our hosting provider's backups are overwritten on its normal schedule, after which they're gone too.

Instructors can close their account by emailing us. We then delete their account and their members' information, except anything we must keep by law.

If a dojo sends us a question through KeikoDojo, we keep it and our replies for up to two years after it is solved, so we can help with any follow-up, and then delete it.

Seeing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing privacy@keikodojo.com. Members can also ask their dojo. We'll respond within 30 days.

Questions and complaints

Email privacy@keikodojo.com. We'll look into it and reply within 30 days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this policy

We'll update this page when our practices change and change the date at the top. For significant changes, we'll tell dojos by email.