PRIVACY POLICY

This Privacy Policy explains how PT Kesenian Melipat Manusia, doing business as Credence Jiu Jitsu ("we," "us," or "our"), collects, uses, stores, and shares your personal information when you visit https://www.credencejiujitsu.com, use our member portal, or train with us.

Credence Jiu Jitsu is a Brazilian Jiu-Jitsu academy. Through our website and member portal, visitors can view our classes, class schedule, coaches, membership plans and merchandise. Registered members can book and cancel classes, check in to sessions, manage their membership, upload payment proofs, order academy merchandise, and manage the accounts of children in their care. Our coaches use the portal to check in to the sessions they teach.

We handle personal data in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022). If you do not agree with this policy, please do not use our Services. If you have questions, contact us at credencejiujitsu@gmail.com.

Information you give us

When you create an account or complete your profile:

• your name, email address, phone number, date of birth, and gender
• your password (stored only in encrypted, hashed form; we cannot read it)
• your training background: experience level, whether you are new to BJJ, and the belt you declare
• an emergency contact name and phone number
• optionally, a profile photo and a short bio

When you use the member portal:

• your class bookings, cancellations, and check-ins
• your memberships, passes, and trials, and your payment history
• payment proofs you upload (photos or screenshots of your bank transfer) and merchandise orders
• the training waiver, if you sign it, including any medical or injury notes you choose to give
• friend requests and friendships with other members
• your notification and privacy settings
• stories you submit through "Share your story"

When you add a child to your account:

• the child's name, date of birth, and gender, and any other details you enter for them
• the child's bookings, memberships, and belt record

If you are a coach:

• your check-ins and check-outs for the sessions you teach, including the photo taken at check-in

Information we create

Our coaches and staff record your belt rank and promotions, your attendance, and the status of your payments and orders.

Information collected automatically

When you use the Services, our hosting and security providers record technical information such as your IP address, browser type, and the time of your request. We use this only to run the Services securely and to investigate problems. We record when you sign in and sign out of your account. We do not use analytics tools, tracking pixels, or advertising cookies. The cookies and browser storage we do use are listed in our Cookie Policy: https://www.credencejiujitsu.com/cookie-policy

When something in the app fails for you while you are signed in (a page that does not load, or a booking, payment or check-in that does not go through), we keep a short note of it: your account, the page, what failed, the technical error message, your browser type, the time, and whether it worked when you tried again. We use these notes only to find and fix problems. Only the academy's administrators can see them, and they are deleted automatically after 30 days. They never include what you typed into a form, your payment proofs, or your messages.

Information from Google

If you sign in with Google, Google shares your name, email address, and profile picture with us. We do not receive your Google password, contacts, or any other Google data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

When you register for training (the studio's registration form):

• your weight and height, the school or workplace you attend, and your area of residence
• the academy or gym you trained at before (if any), your belt level, and how you heard about us
• the class and package you register for
• an emergency contact, and any medical conditions or allergies
• for a child, anything the parent or guardian tells us to help the child feel comfortable in class

We use your personal information to:

• create and manage your account and keep you signed in
• take class bookings, enforce booking rules such as class capacity and membership type, and record check-ins
• verify your payments and activate your memberships, and process your merchandise orders
• record your belt rank and promotions and show your training progress
• send you notifications about your bookings, schedule changes, payments, and academy news, by in-app notification, push notification (if you turn it on), or email
• let a parent or guardian manage the children in their care
• keep the Services secure, prevent abuse, and stop automated sign-ups
• contact you or your emergency contact if something happens during training
• comply with our legal obligations, including tax and accounting rules

We process your information because it is needed to provide the Services you signed up for, because we have a legitimate interest in running and protecting the academy, because the law requires it, or because you gave us your consent (for example, for push notifications or medical notes). You can withdraw your consent at any time.

We do not sell your personal information, and we do not share it for advertising.

Within the academy: our coaches and staff can see the information they need to run classes, verify payments, and look after members.

With other members: depending on your privacy settings, other members can see your name, profile photo, and belt, find you in friend search, and see that you have booked a class. Your friends can see your training activity if you allow it. You can change these settings in the member portal at any time. Children are never shown to other members.

With service providers who process data for us:

• Supabase: database, sign-in, and file storage
• Vercel: website hosting
• Cloudflare: bot protection on sign-in, sign-up, and password reset (Turnstile)
• Google: sign-in with Google, if you use it
• Resend: sending account emails such as password reset links and welcome emails
• OneSignal: push notifications, only if you turn them on

These providers may store or process data on servers outside Indonesia. They may only use your information to provide their service to us.

When the law requires it: we may share information with authorities when we are legally required to, or to protect someone's safety.

The Services link to other websites and apps, such as Instagram, WhatsApp, and Google Maps. We are not responsible for how those services handle your information. Please read their privacy policies before you use them.

We use cookies and browser storage only to run the Services: to keep you signed in, protect sign-in against bots, and remember your preferences. We do not use advertising or analytics cookies. The full list is in our Cookie Policy: https://www.credencejiujitsu.com/cookie-policy

The only social login we offer is Google. If you sign in with Google, we receive your name, email address, and profile picture, and use them only to create and identify your account. We do not post to your Google account or access your contacts. Your use of Google sign-in is also governed by Google's own privacy policy.

We keep your information for as long as you have an account with us. In particular:

• In-app notifications are deleted automatically after 14 days.
• Notes about problems in the app are deleted automatically after 30 days.
• Your bookings, attendance, and belt record are kept while your account exists, because they make up your training history.
• Payment records are kept for as long as Indonesian tax and accounting rules require.
• Technical logs kept by our providers are deleted on their own schedules, usually within a few weeks.

When you ask us to delete your account, we delete or anonymise your personal information, except records we must keep by law.

All traffic to the Services is encrypted (HTTPS). Passwords are stored only in hashed form. Access to data is limited by database rules so that members see only their own information, and staff see only what their role requires. Payment proofs and coach check-in photos are kept in private storage. Sign-in is protected by bot checks and a limit on failed attempts. No system is completely secure, so we cannot guarantee that your information will never be accessed without permission, but we work to prevent it and will tell you if a breach affects you.

You have the right to:

• see the personal information we hold about you
• correct it. You can edit most of your profile yourself in the member portal
• ask us to delete it, subject to records we must keep by law
• withdraw consent you gave us, for example by turning off push notifications or removing medical notes
• object to or limit how we use your information
• choose who can see your profile and training in the member portal's privacy settings

To use any of these rights, contact us at credencejiujitsu@gmail.com or on WhatsApp at +62 813 9977 7680. We will respond as required by Indonesian law.

You must be at least 18 to create your own account. Members under 18 can only be added by a parent or guardian, from the parent's or guardian's own account, and our staff verify the guardian relationship. A child's information is visible only to their verified guardians and our staff. Children never appear in friend search, public profiles, or class attendee lists, and they cannot send or receive friend requests. If you believe someone under 18 has created their own account, please contact us and we will remove it.

Some browsers offer a Do-Not-Track setting. We do not track you across other websites, so there is nothing for this setting to switch off on our Services.

We may update this Privacy Policy when our Services or the law change. The "Last updated" date at the top shows when it last changed. If a change significantly affects how we use your information, we will tell you in the member portal.

We process your personal data in accordance with Undang-Undang No. 27 tahun 2022 tentang Pelindungan Data Pribadi (the Personal Data Protection Law).

Why we hold it: to register you and run your membership, to keep you safe on the mat, and to contact the right person in an emergency. We ask for your agreement when you create an account, and a parent or guardian gives it for a child.

Health information: medical conditions, allergies and a child's comfort note are specific personal data. Only the academy's administrators and the coaches of a class you booked can see them, they are never shown to other members, and they are left out of exports and reports.

Photos and video: see Media Consent in our Terms (section 31). Unused or disused photos/footage are erased 7 years from when taken or last used.

CCTV: cameras are installed in all general purpose areas and on the gym floor for safety and security. There are no cameras in the bathrooms, changing rooms, or Studio.

Your rights: you may ask to see, correct or delete your personal data, or withdraw a consent you gave. Send the request via WhatsApp to the academy's official number, +62 813-9977-7680 — the channel the Membership Terms set for written notices. You can correct most of your details yourself in the member portal.

If you have questions or comments about this Privacy Policy, contact us at:

PT Kesenian Melipat Manusia
Jl. Boulevard Bukit Gading Raya No.A9-12 Lantai 2, RT.15/RW.3, Kelapa, Gading Barat, Jakarta, Daerah Khusus Ibukota Jakarta 14240
Jakarta Utara, DKI Jakarta 14240
Indonesia
Phone / WhatsApp: +62 813 9977 7680
Email: credencejiujitsu@gmail.com

Our Terms of Service are at https://www.credencejiujitsu.com/terms