Terms of Service

1. Acceptance of Terms

By accessing or using the Service, you confirm that you have read, understood, and agreed to these terms. If you do not accept these terms, you must not use the Service.

You must be at least 16 years old to use this Service. If you are under 18, you declare that you have obtained consent from your parents or legal guardians.

2. Service Description

OSS Academy is a management platform for Brazilian Jiu-Jitsu academies. The Service allows:

• Class and schedule management
• Attendance and progress tracking
• Access to educational resources
• Subscription and payment management
• Communication between academy members

3. User Account

Account Creation

To use the Service, you must create an account with accurate and up-to-date information. You are responsible for maintaining the confidentiality of your login credentials.

Account Responsibility

You are responsible for all activities performed under your account. In case of unauthorized use, you must inform us immediately at contact@oss-academy.com.

Suspension and Termination

We reserve the right to suspend or terminate your account in case of violation of these terms or inappropriate behavior.

4. Usage Rules

By using the Service, you agree to:

• Respect other users
• Not post offensive, defamatory, or illegal content
• Not impersonate others
• Not attempt unauthorized access to systems
• Not use the Service for unauthorized commercial purposes
• Respect intellectual property rights

5. User Content

You retain your rights to the content you post (photos, comments, etc.). By posting content, you grant us a non-exclusive license to display it within the Service.

We reserve the right to remove any content that violates these terms or that we deem inappropriate.

6. Subscriptions and Payments

Pricing

Some features may require a paid subscription. Prices are displayed before any purchase and may be changed with 30 days notice.

Billing

Payments are processed by Stripe. By subscribing, you authorize automatic billing according to your chosen frequency (monthly or annual).

Refunds

In accordance with withdrawal rights, you may request a refund within 14 days of your first payment. After this period, payments are non-refundable.

7. Intellectual Property

The Service, its design, source code, logos, and all content are the exclusive property of OSS Academy SAS and are protected by intellectual property laws.

You are not authorized to copy, modify, distribute, or use these elements without our prior written consent.

8. Limitation of Liability

The Service is provided "as is". We do not guarantee that the Service will be available uninterrupted or error-free.

To the extent permitted by law, OSS Academy SAS shall not be liable for indirect, incidental, or consequential damages resulting from the use of the Service.

We are not responsible for injuries occurring during training or competitions. Use of the Service does not replace advice from a qualified professional.

9. Changes to Terms

We may modify these terms at any time. Significant changes will be notified by email or in-app notification at least 30 days before they take effect.

Your continued use of the Service after this period constitutes your acceptance of the new terms.

10. Termination

You may terminate your account at any time from the app settings or by contacting us.

Upon termination, your data will be processed in accordance with our Privacy Policy. Active subscriptions remain due until the end of the current period.

11. Governing Law

These terms are governed by French law. Any dispute relating to the interpretation or execution of these terms shall be submitted to the competent courts of Paris, France.

12. Contact

For any questions regarding these terms of service, contact us:

OSS Academy SAS

Email: contact@oss-academy.com

Annex: processing of club data on behalf of clubs (Article 28 of the GDPR)

This annex forms part of these terms of use for any club that uses OSS Academy to manage its members. It governs the processing of personal data that OSS Academy carries out on behalf of the club.

1. Parties

The club (association or company) that uses OSS Academy to manage its members, hereinafter “the Club”, and OSS Academy SAS, publisher of the application, hereinafter “OSS Academy”.

2. Purpose and roles

This annex governs the processing of personal data that OSS Academy carries out on behalf of the Club when the Club uses the OSS Academy application (mobile app, web app, administration console) and the connector for AI assistants described in section 4.

• The Club is the controller: it decides why and how the data of its members, their legal representatives, its prospects and its coaches is processed.
• OSS Academy is a processor within the meaning of Article 28 of the GDPR: it processes this data solely to provide the service to the Club, on its instructions.

3. Description of the processing

• Nature: hosting, recording, consultation, making the Club's data available in the application; sending emails and notifications; read-only transmission to the AI assistant of an authorised user (section 4).
• Purposes: management of memberships, classes and attendance, grades, competitions and events, trials, payments and invoicing; communication by the Club with its members; assistance in organising classes by an AI assistant.
• Data subjects: adult and minor members; holders of parental authority; prospects who book a trial; coaches, assistants and managers of the Club.
• Data, depending on the functions used by the Club: identity (last name, first name, date of birth, photo); contact details; membership and subscription; attendance and bookings; grades and progression; competitions and results; registration files; payments and invoices; declared physical condition, including the “injured” status, health data within the meaning of Article 9 of the GDPR.
• Duration: the term of the contract between the Club and OSS Academy, then the return or deletion provided for in section 11.

4. Connector for AI assistants

The connector allows an authorised user of the Club to ask questions about their club from their own AI assistant (ChatGPT by OpenAI or Claude by Anthropic), for example “who is registered for my 6 pm class?”. The assistant queries OSS Academy, which returns an answer computed on demand.

• Read-only: no tool of the connector creates, modifies or deletes any data.
• Who can connect it: a manager (owner or co-owner) or a coach of the Club, from their account, after entering their password (and their two-factor authentication code if enabled) and ticking the clubs they open. Certain information is reserved for managers (new registrations, registration files, students who are dropping out).
• What comes out: only the fields provided for by each tool, described in the data protection impact assessment provided to the Club on request. Members are identified there by their first name and the initial of their last name. An injured member may be flagged as “injured”, without the nature of the injury. No contact details (email, phone, address) come out.
• Duration of a connection: 90 days at most, after which the user must reconnect. The user can cut it off at any time from the app; a manager or coach who loses their role in the Club loses access at the next call.

Instruction of the Club. By accepting this annex, the Club authorises its managers and coaches to connect an AI assistant to its data under these conditions. This authorisation constitutes a documented instruction within the meaning of Article 28(3)(a) of the GDPR. The Club may withdraw it at any time in writing at contact@oss-academy.com; OSS Academy then cuts off the existing connections to the Club within 5 working days.

The assistant's provider is not a sub-processor of OSS Academy. The AI assistant is chosen and subscribed to by the user, under their own account and according to the terms of OpenAI or Anthropic. OSS Academy has no contract with these providers for this flow and does not count them among its sub-processors: it transmits the answer of a tool to the assistant that the authorised user has connected themselves. Consequently:

• the Club ensures that its users preferably use a business plan of the assistant, with a data processing agreement and without training of the models on conversations. OSS Academy recommends this on the connection page, without being able to verify it;
• what is entered into a conversation remains there according to the provider's terms. OSS Academy can neither view nor delete it. Only the user can delete their conversations;
• the provider processes the data in the United States; the safeguards for this transfer fall under the contract between the provider and the user or the Club.

Call log. Each call to a tool is logged: which user, with which assistant, on which club, which tool, and when. Neither the parameters of the question, nor the content of the answer, nor the names of the people appearing in it are logged. This log is kept for one year. Each user sees their own calls in the app (“AI assistants” page); at the Club's request, OSS Academy provides it with the extract concerning the Club, for example to answer a member who asks who queried an assistant about the club, and when.

5. Obligations of OSS Academy

OSS Academy undertakes to:

• process the data only for the purposes of section 3 and on the Club's documented instructions, including with regard to transfers outside the European Union; if an instruction appears to it to infringe the GDPR, it informs the Club immediately;
• ensure confidentiality: the persons authorised to access the data are bound by secrecy and trained in data protection;
• implement the security measures of Article 32 of the GDPR, described in the privacy policy;
• engage a sub-processor only under the conditions of section 9;
• assist the Club in responding to requests to exercise data subject rights (access, rectification, erasure, objection, restriction, portability): it forwards without delay any request received directly and provides the necessary extracts, including that of the call log;
• assist the Club in meeting its obligations regarding security, breach notification, data protection impact assessment and prior consultation (Article 28(3)(f) of the GDPR); to this end, it provides the Club with the connector's data protection impact assessment and its revisions;
• notify the Club of any personal data breach concerning it without undue delay and at the latest 48 hours after becoming aware of it, with the information required by Article 33(3) of the GDPR that it has available;
• at the end of the contract, apply section 11;
• make available to the Club the information necessary to demonstrate compliance with this annex and allow audits under the conditions of section 10.

6. Obligations of the Club

The Club undertakes to:

• have a legal basis for each processing operation and inform its members, the parents of minor members and its prospects, in particular of the use of the connector; OSS Academy provides it with template texts on request;
• enter in the application only the necessary data, and no health data beyond what the functions provide for;
• ensure that only its managers and coaches currently in office have an account with these roles, and remove their role when they leave;
• give its instructions in writing and document its processing choices.

7. Health data and minors

The “injured” status of a member is health data. It is passed to an assistant only in the form of the single word “injured”, without any description. Minor members are treated like adults by the connector; the Club informs their legal representatives at registration.

8. Location and transfers

The Club's data is hosted in the European Union, with Scaleway, in France. A transfer outside the Union by a sub-processor takes place only if it is covered by an adequacy decision (including the Data Privacy Framework between the EU and the United States) or by standard contractual clauses. The transfer to the provider of an AI assistant falls under section 4.

9. Sub-processors

The Club gives OSS Academy a general authorisation to engage the sub-processors listed below. OSS Academy informs the Club of any addition or replacement at least 30 days in advance; the Club may object on grounds relating to data protection and, failing agreement, terminate without charge. OSS Academy imposes on each sub-processor the same obligations as those of this annex and remains liable for their performance.

• Scaleway: hosting of the API, the database and the files (France);
• Grafana Labs (Grafana Cloud): technical logs and traces;
• Brevo: sending of emails;
• Expo: sending of push notifications;
• Sentry: reporting of application errors;
• PostHog: measurement of application usage;
• Stripe: online payments (Stripe partly acts as a separate controller).

Neither OpenAI nor Anthropic appears in this list: see section 4.

10. Audits

OSS Academy answers in writing the Club's reasonable questionnaires on data protection. An on-site audit, or an audit by an independent auditor bound by confidentiality, is possible at most once a year, with 30 days' notice, at the Club's expense, without access to the data of other clubs.

11. End of the contract

At the end of the contract, at the Club's choice expressed in writing, OSS Academy returns the data in a common format and then deletes it, or deletes it directly, within 30 days, unless there is a legal retention obligation (in particular accounting documents and the logging of payments received). The connections of AI assistants to the Club are cut off as soon as the contract ends.