Privacy Policy

1. Who we are and who this covers

MyIppon ("MyIppon", "we", "us", "our") makes online software for martial arts schools: member and family records, attendance and check-in, belt ranks, scheduling, billing and payments, messaging, forms and waivers, staff tools, video curriculum, websites and the MyIppon app (together, the "Services"). We are based in Ontario, Canada.

This policy covers:

• Dojos: martial arts schools and organizations that subscribe to MyIppon, and their owners, staff and instructors ("Dojo Users").
• Students and families: the members, students, parents, guardians, guests and prospects whose information a dojo keeps in MyIppon ("Members").
• Visitors: people who visit myippon.com, book a demo or contact us.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's privacy law where it applies.

2. Dojos and MyIppon: who is responsible

For Member information, your dojo is in charge. The dojo decides what to collect, why, and for how long. It is responsible for getting any consent it needs, including a parent's or guardian's consent for a child. MyIppon acts as the dojo's service provider. We process Member information only to provide the Services to that dojo, following the dojo's instructions, our agreement with the dojo, and this policy.

For Dojo User accounts, visitor information, and our own billing of dojos, MyIppon is in charge and is responsible under this policy.

If you are a Member and have a question about your information, please contact your dojo first. We will help the dojo answer you. If you contact us directly, we may pass your request to your dojo.

Each dojo's information is kept separate. A dojo can never see another dojo's members, payments or messages.

3. What we collect

Information a dojo enters or collects through MyIppon (Member information)

• Identity and contact: names, date of birth, age group, gender (if the dojo asks), email, phone numbers, mailing address, and parent, guardian and emergency contacts.
• Training records: programs, belt ranks and stripes, grading results, attendance and check-ins, class bookings, curriculum progress and quiz results.
• Health and safety information the dojo chooses to record, such as allergies, medical conditions or injuries. This is sensitive information. Dojos should collect only what they need to keep students safe.
• Forms, waivers and agreements: answers, electronic signatures, and the date and time of signing.
• Billing: memberships, invoices, payments, refunds and receipts. For cards, we keep only the details shown to you: brand, last 4 digits, expiry date and name on card. Full card numbers and security codes are handled by Stripe and are never stored by MyIppon.
• Notes, pictures and documents that staff add to a member's file. We remove location data (GPS) and other hidden camera data from pictures when they are saved.
• Messages: texts and emails sent to or received from the dojo through MyIppon, and the delivery status of each one.
• History: a record of changes made to a member's file, and who made each change.

Information about Dojo Users

• Name, email, phone, role and permissions, sign-in and two-step verification details, and a record of activity in the system.
• For staff tools: shifts, time-clock entries, timesheets and payroll details the dojo enters. These may include a Social Insurance Number if the dojo chooses to record it for payroll.
• The dojo's business details, subscription, invoices from MyIppon, and the payout account details collected by Stripe for the dojo.

Information collected automatically

• Technical information: IP address, browser and device type, pages requested, date and time, and error logs. We use these to run, secure and fix the Services.
• App check-in location: only when a member taps "Check in", the app checks the phone's location once to confirm they are at the dojo. We do not track location in the background, and we do not keep a location history.
• App notifications: if you turn notifications on, we store the notification address your phone or browser gives us, so we can reach that device.

Visitors to myippon.com

• What you send us when you book a demo or contact us: name, school, email, phone and your message.

4. How we use it

• To provide the Services the dojo has chosen: for example records, check-in, billing, receipts, reminders, messages, forms, the app and websites.
• To process payments through Stripe, and to send receipts, invoices and payment reminders the dojo has set up.
• To keep the Services secure: preventing fraud and abuse, verifying sign-ins, and keeping a history of changes.
• To support dojos: answering help requests and fixing problems. Our staff look at a dojo's data only when needed for support, security or legal reasons.
• To send service messages to Dojo Users, such as account, billing, security and "what's new" notices.
• To improve the Services using counts and totals that do not identify any person.
• To meet legal, tax and accounting obligations, and to enforce our agreements.

We do not sell personal information, rent it out, use it for advertising, or build marketing profiles of Members. We do not use Member information to train artificial intelligence models offered to anyone else.

5. Children and young athletes

Many martial arts students are children. Information about children is entered and managed by their dojo, and the dojo is responsible for obtaining a parent's or guardian's consent. In the MyIppon app, children are reached through a parent or family login set up by the dojo. We do not knowingly allow children to create accounts on their own. We never market to children, and we do not show advertising in the Services.

A parent or guardian can ask to see, correct or delete their child's information. See section 11.

6. Who we share it with

We share personal information only as described here.

• Your dojo. Member information belongs to and is visible to the dojo that keeps it, based on the permissions it gives its staff.
• Service providers that help us run MyIppon. Each one gets only what it needs to do its job, and is bound to protect it:

  Provider	What they do	What they receive
  Stripe	Card and bank payments, payouts to dojos	Payment details, name, email, amounts
  Twilio (and other text-message carriers a dojo selects)	Sending and receiving text messages	Phone number and the message
  Email delivery services	Delivering emails	Email address and the message
  Cloudflare	Secure connection, protection from attacks, delivering pages quickly	Technical information. Traffic is encrypted as it passes through.
  Google, Apple, Mozilla, Microsoft push services	Waking your browser for a notification (MyIppon in a web browser or added to the home screen)	A device address only. The text of the notification is not sent through them.
  Google Firebase Cloud Messaging, and Apple Push Notification service (iPhone)	Delivering notifications to the MyIppon app from Google Play or the App Store	A device address, and the notification's title, text and the page it opens. They deliver it and do not use it for anything else.
  Google	Optional sign-in, and inbox connection if a dojo connects its own Gmail	What the dojo or user authorizes

• Legal reasons. When the law requires it, for example a valid court order or warrant. We will try to tell the affected dojo first unless the law forbids it. We also share information when needed to protect someone's safety, or to protect our rights or prevent fraud.
• Business changes. If MyIppon is sold, merged or reorganized, information may move to the new owner. That owner must protect it as this policy says, and we will tell dojos in advance.
• With your permission. In any other case, we share information only with consent.

7. Where it is stored

MyIppon runs on servers we own and operate in Canada, with backup and standby servers that are also run by us. Some of the service providers listed above may process limited information in other countries, including the United States, for example when a text message passes through a carrier. When that happens, the information may be accessible to the authorities of that country under its laws. We choose providers that commit to protecting information to a standard comparable to Canadian law.

8. How we protect it

We use safeguards suited to the sensitivity of the information, including:

• Encryption in transit (HTTPS/TLS) for every page, app screen and connection.
• Card data handled entirely by Stripe, which meets PCI DSS Level 1, the highest payment-industry standard.
• Strict separation between dojos, enforced on every request and tested regularly.
• Role-based permissions for dojo staff, optional two-step verification (authenticator app), and limits on repeated sign-in attempts.
• A history of changes to member files showing who did what and when.
• Private files: pictures and documents are reached only through short-lived signed links. Tax receipts and similar documents are never publicly listed.
• Sign-in protection on internal admin tools, firewalls, private networking between our servers, and limited staff access.
• Regular backups, standby servers in a separate location, and automatic failover tested with drills.
• Safety checks run before every software update.

No system is perfectly secure. Please keep your password and PIN private, use two-step verification, and tell us right away at [email protected] if you think an account has been misused. If you find a security weakness, please report it to the same address. We welcome good-faith reports and will not take action against researchers who act responsibly and give us time to fix the problem.

9. If something goes wrong

If there is a breach of security safeguards involving personal information, we will act quickly to contain it and investigate. We will notify affected dojos without undue delay, aiming for within 72 hours of confirming it, with the details they need. Where there is a real risk of significant harm, we and the dojo will notify the affected individuals and report the breach to the Office of the Privacy Commissioner of Canada and other regulators, as the law requires. We keep a record of every breach, as PIPEDA requires.

10. How long we keep it

• Member information is kept while the dojo's account is active and the dojo keeps it. Dojos can mark students as former or remove them.
• Email copies older than one year are moved into compressed archives on our servers. The dojo can still open them when needed.
• Financial records such as invoices, payments and receipts may be kept for up to 7 years, to meet Canadian tax and accounting rules.
• After a dojo leaves, it can ask for an export of its data during the notice period. We then delete or anonymize its data within 90 days, except for what we must keep by law. Backups are overwritten on a rolling schedule.
• Technical logs are kept only as long as needed for security and troubleshooting.

11. Your rights and choices

You may ask to:

• see the personal information held about you, and learn how it has been used and shared;
• correct information that is wrong or incomplete;
• withdraw consent, for example to stop marketing messages. Withdrawing consent can mean the dojo can no longer provide some services, such as automatic payments;
• delete your information, where the law allows (see section 12);
• receive your information in a portable format, where the law provides for it.

Members should contact their dojo first. You can also write to [email protected]. We will confirm your identity before acting. We respond within 30 days, or tell you if we need more time as the law allows. These requests are free.

12. Deleting your account or data

Students and families (including app users): MyIppon accounts are created by your dojo. To delete your account and information, ask your dojo, or email [email protected] from the address on file, with your name and your dojo's name. We will work with the dojo to delete it within 30 days. Some records, such as payment and tax records, may be kept as long as the law requires, then deleted. You can also turn off app notifications and sign out of the app at any time.

Dojos: to close your account and delete your dojo's data, give notice as described in the Terms of Service, or email [email protected].

13. Texts, emails and app notifications

Dojos use MyIppon to send texts, emails and app notifications to their members. These include receipts, reminders, class news and offers. The dojo is the sender, and it is responsible for following Canada's Anti-Spam Legislation (CASL) and for having consent where needed. Marketing emails include a way to unsubscribe. You can reply STOP to a text to stop texts from that dojo. You can turn app notifications off on your device at any time. Payment receipts and other required service messages may still be sent.

14. Cookies and similar technology

We use browser storage and cookies only to keep you signed in, remember settings such as which child you are viewing in the app, and keep the Services secure. We do not use advertising cookies or cross-site tracking. Blocking this storage may stop sign-in from working.

15. The MyIppon app

The app uses the same information described above. It asks for permission before it uses location (only when you tap Check in), sends notifications, or uses the camera or your photos (only when you choose to add a picture, video or document). You can change these permissions in your phone's settings at any time. The app contains no advertising and no third-party tracking tools.

16. Changes to this policy

We may update this policy as the Services or the law change. We will post the new version here with a new "Last updated" date. If a change is significant, we will tell dojos in advance by email or in the Services.

17. Contact us and complaints

Our Privacy Officer is responsible for this policy and for how we handle personal information.

Privacy Officer, MyIppon
Email: [email protected]
Security reports: [email protected]
General support: [email protected]
Ontario, Canada

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, you can also go to the Commission d'accès à l'information.