Privacy Policy

1. Data Collected

Registration Data

When creating your account, we collect your email address, first name, last name, and a password (stored in encrypted form).

Profile Data

You can complete your profile with: date of birth, country, phone number, gender, weight category, age category, belt color, and profile photo.

Activity Data

We record your class attendance, your ratings on educational resources, your participation history, and your training statistics.

Payment Data

Payments are processed by Stripe. We never store your credit card information directly. Only a Stripe customer identifier is kept.

Technical Data

We securely store session information on your device to maintain your connection and send you notifications. In case of application crashes or errors, technical data (device type, OS version, error trace) is automatically collected to help us improve the Service.

2. Data Usage

We use your data to:

• Provide and maintain the Service
• Manage your account and class registrations
• Process your subscription payments
• Send you transactional emails (verification, password reset)
• Send you class reminder notifications
• Calculate statistics and rankings
• Improve our Service

3. Legal Basis for Processing (GDPR)

Contract Execution

Processing your registration, profile, and activity data is necessary for the execution of the service contract.

Consent

Push notifications and certain communications are based on your consent, which you can withdraw at any time.

Legitimate Interest

Improving our Service and preventing fraud are based on our legitimate interest.

4. Data Sharing

We share your data only with the following providers:

Stripe (Payments)

For secure payment processing.

Brevo (Emails)

For sending transactional emails (email verification, password reset).

Expo (Notifications)

For sending push notifications to your device.

Sentry (Monitoring)

For detecting and analyzing application errors and crashes to improve its stability.

We never sell your personal data.

5. AI assistants (ChatGPT, Claude)

What is this about?

A manager or coach of your club can connect their AI assistant, ChatGPT (published by OpenAI) or Claude (published by Anthropic), to OSS Academy. They can then ask their assistant questions about the club, for example “who is registered for my class tonight?” or “which students are close to their next belt?”. The assistant queries OSS Academy, which answers it. The assistant can only read: it cannot create, modify or delete anything in OSS Academy.

Who is the controller?

Your club is the controller of your data. OSS Academy acts on its behalf, as processor. To exercise your rights, please contact your club first.

Who can connect an assistant?

Only the managers and coaches of the club, each from their own account, for the clubs they choose. A connection lasts 90 days at most. It is cut off as soon as the person loses their role in the club, and it can be cut off at any time from the app.

What data can be transmitted?

Only what is useful for running the club, and only when the manager or coach asks a question that requires it:

• the schedule: classes, times, locations, the coach's first name, numbers of registered students and trials;
• for a class or a student: the students' first name and the initial of their last name, their date of arrival at the club, their grade and progression, their attendance and upcoming classes, their competitions (age, weight and belt categories, time, results), their fighter profile and the free text they wrote in it, the ratings and comments they gave to the techniques practised;
• in the club news: medals, grade promotions and birthdays (the day of the birthday, never the date of birth);
• whether a student is injured, without the nature of the injury;
• for people who book a trial: their first name and the initial of their last name, and the status of their trial (for example “no-show”);
• for managers only: new registrations and pending membership requests, the status of the documents in the registration file (provided, missing, to be validated, never their content), students whose attendance is declining, absent students and those whose bookings are suspended;
• for coaches: their teaching hours and the classes for which they did not take attendance, which their colleagues can also view.

Minor students are treated like adults. The following are never transmitted: the full last name, the email address, the phone number, the postal address, the photo, the date of birth, payments and subscriptions.

The texts that you write yourself in the app (fighter profile, comment on a technique) can be read by your coaches and by their assistant: do not write any medical information in them.

Where does this data go?

To the publisher of the assistant chosen by the manager or coach: OpenAI for ChatGPT, Anthropic for Claude. These publishers process the data in the United States, under their own terms and depending on the type of account used. OSS Academy recommends that clubs use a business plan, with a data processing agreement and without training of the models on conversations. OSS Academy does not use this data to train a model and does not sell it.

Why?

To help the club organise its classes: knowing who is coming, who is injured, who is preparing for a competition, who to welcome for a trial. The legal basis is the club's legitimate interest in organising its activities.

For how long?

• OSS Academy does not keep the answers sent to the assistant.
• OSS Academy keeps a log of the queries made by assistants (which user, which assistant, which club, which type of information, when), without their content or the names of the people concerned, for one year.
• At the assistant's publisher, conversations are kept according to its terms and the account used. OSS Academy cannot delete them: only the assistant's user can delete their conversations.

Your rights

You can ask your club for access to your data, its rectification, its erasure, or object to its transmission to an AI assistant. With the help of OSS Academy, your club can tell you which users have consulted, through their assistant, club information of a type that may concern you, and when; the log does not keep the names of the people appearing in the answers. A rectification or erasure in OSS Academy applies to all subsequent questions, but not to a conversation already stored at the assistant's publisher. You can also contact OSS Academy at contact@oss-academy.com, and lodge a complaint with the CNIL (cnil.fr).

6. Your Rights

GDPR Rights (European Union)

You have the following rights:

• Right to access your data
• Right to rectify inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restriction of processing
• Right to withdraw your consent

CCPA Rights (California)

California residents have additional rights, including the right to know what data is collected and the right to request its deletion.

How to Exercise Your Rights

Contact us at contact@oss-academy.com. We will respond within 30 days.

7. Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, modification, disclosure, or destruction.

8. Data Retention

Your data is retained as long as your account is active. After account deletion, we retain certain data for a limited period for legal obligations (accounting, potential litigation).

9. Local Storage Technologies

Our application uses your device's local storage to maintain your session, save your preferences, and remember your active academy. This data remains on your device and is deleted upon logout.

10. Changes to This Policy

We may update this privacy policy. In case of significant changes, we will notify you via in-app notification or email.

11. Contact

For any questions regarding this privacy policy or to exercise your rights, contact us:

OSS Academy SAS

Email: contact@oss-academy.com