Privacy Policy

Last updated: October 2026 · Legal counsel review completed prior to Quebec launch

Scope of this policy

This privacy policy describes how Tatame0 collects, uses, discloses, retains, and protects personal information when you use the Tatame0 member portal, iOS application, and platform services for a participating martial arts and combat sports academy. It complies with Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Information collected to provide the service

We process contact and account information (full name, email address, mobile phone number, encrypted password credentials). We also process membership, enrollment, student profile records (belts and stripes, birth date/age, assigned class roster, electronically signed acknowledgement of risk agreements), mat check-in attendance, and billing history provided by you or your participating academy.

Children's personal information (Minors under 14)

In accordance with Quebec Law 25, personal information regarding students under 14 years of age is collected only with the explicit consent of a parent or legal guardian during self-service enrollment or upon signing the acknowledgement of risk form. Academies and guardians may review or request deletion of minor records at any time.

Payments and PCI-DSS compliance

Payment checkout, recurring subscription billing, and receipt issuance are handled directly through Stripe’s secure, hosted payment infrastructure (Stripe Billing and Stripe Connect). Tatame0 does not collect, store, or process complete payment card numbers or CVVs on its servers or in the iOS app.

How information is used and disclosed

Your personal information is used exclusively to authenticate members, manage memberships and class check-ins, process subscription billing through Stripe, deliver transactional notices (such as email verification and payment receipts), provide customer support, and meet legal and tax obligations. Personal data is disclosed only to the specific academy you attend and to vetted service sub-processors (such as Stripe for payments and transactional email providers). Tatame0 does not sell personal information and does not deploy cross-app advertising tracking.

Data location, cross-border transfers, and security

Personal information is hosted on secure cloud infrastructure located in Canada and North America with industry-standard encryption in transit (TLS 1.3) and at rest (AES-256). Any data transfer outside Quebec is conducted under privacy impact assessments and contractual safeguards in accordance with Quebec Law 25.

Retention, deletion, and security safeguards

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, or to satisfy legal, tax, accounting, and dispute-resolution requirements. When no longer required, data is securely destroyed or anonymized. We maintain role-based access control, cryptographic password hashing (bcrypt), and automated security monitoring to protect your information.

Breach notification

In the event of a confidentiality incident involving personal information that presents a risk of serious injury, Tatame0 will promptly notify affected individuals and the Commission d'accès à l'information du Québec (CAI) as well as the Office of the Privacy Commissioner of Canada (OPC) as required by Law 25 and PIPEDA.

Your privacy rights (Access, rectification, consent withdrawal)

Under Quebec Law 25 and PIPEDA, you have the right to access your personal information, request rectification of inaccurate or outdated data, and withdraw your consent to data processing (subject to legal and contractual limits). To update contact info, you can use the member portal. For formal access or erasure requests, contact your academy or visit Tatame0 Support.

Person in charge of personal information protection (Privacy Officer)

Tatame0 has designated a Privacy Officer responsible for overseeing compliance with privacy legislation. For questions, concerns, or to exercise your rights, contact our Privacy Officer at: [email protected] (or [email protected] for French inquiries).

Academy role as data controller

Each participating academy acts as the primary data controller for its student rosters, attendance records, and membership agreements. Academies designate their own Privacy Officer within their Tatame0 Gym Settings, whose contact details are displayed on their public enrollment pages.

Policy updates

We may update this policy periodically as our platform evolves. The latest version will always be available on this page with its effective date.