Privacy Policy

Who Controls Your Information

Martial Arts Toolkit is operated by Martial Arts Toolkit Ltd, a company registered in England and Wales (company number 17273779), registered office 209 Whitley Wood Lane, Reading, RG2 8PT, United Kingdom. Martial Arts Toolkit Ltd is the data controller for account, sign-in, billing, and platform information, and is registered with the UK Information Commissioner's Office under reference ZC224999.

Your club is the data controller for the student, family, attendance, grading, safeguarding, document, and consent records it manages in the platform. Martial Arts Toolkit Ltd processes those records on the club's behalf. Contact your club about records it controls, or email support@martialartstoolkit.com if you are unsure who to ask.

What Martial Arts Toolkit Does

Martial Arts Toolkit is a club management and training platform. Clubs can use it to manage students, families, staff, classes, registers, attendance, grading, training resources, communications, documents, consent forms, payments, and student progress. Account sign-in is also used for personal training tools and to provide access to the appropriate club, staff, student, parent, or guardian areas.

Information We Store

We store the information needed to provide the parts of the service that you or your club use. This can include:

• Your email address, verification state, display name, and account preferences.
• Your Google account identifier if you choose Google sign-in.
• A salted password hash if you choose email/password sign-in.
• Your signup role intent when you create an email/password account.
• Your optional preference for receiving release update emails.
• Club details, staff roles and permissions, training locations, classes, registers, attendance, trials, grading activity, assessments, training plans, achievements, reports, and operational audit history.
• Student and family records such as names, membership identifiers, dates of birth, contact details, guardian details, family relationships, class assignments, and progress history.
• Safeguarding and safety information entered by a club or an authorised linked adult, including medical conditions, allergies, medication notes, injuries, training restrictions, emergency actions, and emergency contacts.
• Announcements, email communications, recipient and delivery history, documents, images, online training resources, and acknowledgement history.
• Membership, shop, session, insurance, and other club-fee records, including amount, status, payer relationship, provider identifiers, receipts, refunds, and audit history.
• The name, email address, phone number, optional club name, and preferred day and time you provide when you request a demo.
• Your saved combos, lesson plans, assessment cards, and training plans.
• App session records so you can stay signed in, including sign-in and last-active times, a short browser/device summary, and a one-way hash of the network address used for security. We do not store the raw network address in the session record.
• If a club uses Refer a club, the referral code, linked clubs and owner accounts, qualifying billing identifiers, reward status, and support/audit events needed to administer the offer.
• If a club enables digital consent forms, the assigned document and exact version, the signer and student roles, the declarations accepted, typed legal name, signing method and time, receipt details, and integrity hashes needed to preserve the record.

Information We Do Not Store

• We do not store raw passwords.
• We do not store your Google password.
• We do not store Google access tokens or refresh tokens.
• We do not read or store Gmail, Google Drive, Calendar, contacts, or photos.
• We do not request broad Google profile data.
• We do not store full payment-card or bank-account details. Stripe handles those details when an online payment or payout account is used.

Club, Student And Safeguarding Records

Clubs decide which records they need to run safely and lawfully, who is authorised to access them, and how long club records should be kept. Martial Arts Toolkit applies role and relationship checks so club records are available only to authorised staff, the relevant student, or an authorised linked parent or guardian.

Tightly controlled platform support may also access records where necessary to operate, secure, or support the service. Platform access is grant-controlled, and sensitive support actions are logged.

Medical and safeguarding information can be particularly sensitive. It is kept separate from general contact details, encrypted at rest where the feature supports encrypted fields, and shown only in workflows where the authorised person needs it for student safety or club administration. Clubs and users should enter only information that is relevant and necessary.

Enquiries, Feedback And Fault Reports

If you submit a fault report or feedback, we store the details you provide so we can understand and fix the issue. If you choose to add your email address to a report, we may use it to reply to you about that report.

If you request a demo, we send the details you provide to our support inbox. We use them to arrange the demo, help with switching and club setup, and contact you about your request. Details sent through the Founding Club enquiry form, which closed on 1 October 2026, are kept and used in the same way.

Cookies And Browser Storage

Martial Arts Toolkit sets only its own cookies. There are no advertising cookies, and nothing on this site is used to track you across other websites.

• Signing in. A session cookie keeps you signed in, with short-lived cookies used while completing Google sign-in or a two-step verification challenge. These are required for the service to work at all.
• Your preferences. Light or dark mode, whether the sidebar is expanded, and similar choices are stored so the app looks the way you left it. These are only set once you make the choice. When you sign in, we also remember whether you used Google or your email address, so the sign-in page can point you to it next time. It never records who you are.
• Club referrals. If you arrive through a club's referral link, the referral code is stored so the club receives the credit when you sign up.
• Browser notifications. Only if you turn them on for a device. We keep the notification address your browser gives us, and your browser maker's push service (Google, Apple, Mozilla or Microsoft) delivers each one, encrypted so that service cannot read it. Message notifications never include the message itself. Turn them off at any time in Account settings or your browser.

The app also uses your browser's local storage for the same kinds of preferences, and for drafts so that work in progress is not lost. That information stays in your browser.

Our analytics do not use cookies, which is why you are not asked to accept them. You can clear or block cookies in your browser at any time; if you clear the sign-in cookie you will be signed out, and preferences will return to their defaults.

Analytics And Logs

Martial Arts Toolkit uses Vercel Analytics, Vercel Speed Insights, and server logs to understand site reliability, performance, and usage at a high level. Error logs include request IDs and safe error messages, not raw passwords, password reset tokens, or Google tokens.

Club pages count their own visits without cookies, so a club can see how many people look at its page. Each count records the page, the name of the website or app the visitor came from (never its full address), any tag on the link they followed that says where the club shared it, whether they used a phone, tablet or computer, and whether they were signed in as one of the club's students, families or staff. No IP address is stored: a visitor is counted with a code made from their network and browser (or their account, if they are signed in) that changes every day and is different for every club, so visits cannot be followed from one day or club to the next. Clubs see totals only, and these records are normally removed after about 13 months.

To prevent abuse and protect accounts, selected forms, sign-in routes, and public tools store only pseudonymised network identifiers. Those rate-limit records never store raw IP addresses. Short-window rate-limit records are inactive after their short window and normally removed after about one day during later public requests. Revoked session-security records become eligible for deletion after 30 days and are normally removed during later account or session maintenance. Application performance and error logs are normally retained for up to 30 days.

How We Use Your Information

• To sign you in and manage your account.
• To provide club management, student, family, training, communication, and reporting workflows.
• To save, load, rename, share, and delete your training content.
• To process and reconcile club and Toolkit payments through Stripe.
• To send selected release summaries to eligible club owners and instructors with release emails enabled.
• To respond to support or fault reports when you provide contact details.
• To arrange demos and help clubs switch and get set up.
• To keep the app reliable and secure.

Service Providers

We use service providers to operate Martial Arts Toolkit. These currently include Vercel for hosting, private file storage and site analytics, Railway for managed database hosting, Stripe for payments, Resend for email delivery, PureSMS for text messages, Google for optional Google sign-in, OpenAI where an authorised user chooses an AI-assisted drafting feature, Ionx Solutions for scanning uploaded files for malware, and Ideal Postcodes for UK address lookup. Each provider receives only the information needed for the relevant service. A full list of the providers that process personal data on a club's behalf, and what each one receives, is published at martialartstoolkit.com/privacy/subprocessors.

AI-assisted features send the selected prompt and relevant working context to the AI provider to produce a draft. Users should review the draft before use and should not put unnecessary safeguarding, medical, payment, password, or other sensitive information into an AI prompt.

Digital Consent Forms

Clubs choose their own consent wording, who must sign it, when it needs renewing, and how long their records should be retained. Martial Arts Toolkit provides the signing workflow and does not provide legal wording or decide whether a particular form is suitable for a club. Ask the club if you need an accessible or paper alternative before signing.

Each electronic signature is kept against one locked document version. We encrypt the typed legal name and signing-link contact details at rest, store only one-way signing tokens, and use integrity hashes so evidence can be checked without changing the original record. We do not store a drawn signature, biometric signature data, or a raw IP address as signature evidence. A club may record that it received a paper copy, but the paper document remains with the club.

Signature evidence is not silently replaced when a document changes or a request is sent again. Corrections, exemptions, replacements and attendance overrides are recorded as additional audit events. Access is limited to authorised club users and support access requires a recorded reason.

Calendar Links

A student or parent can put the classes, seminars and gradings of everyone on their account into their own calendar app, such as Google Calendar, Apple Calendar or Outlook, with one private link, and club owners and instructors can do the same with the club's timetable. You choose which of the three the link carries. It shows the club's name and each session's name, time and place, never a student's name. Anyone who has the link can see those sessions, so keep it to yourself; Reset link on the Classes page ends the old link straight away. Once you subscribe, your calendar provider fetches the link for you and holds the sessions under its own privacy terms.

Release Email Preference

Eligible club-owner and instructor accounts are subscribed to release emails by default when created. Martial Arts Toolkit may use your verified account email address to send selected release summaries while you own an active club or are a current instructor at one. Not every deployment is emailed. You can turn this optional preference off at any time from the account page, and eligibility is checked again before each email is sent.

Club Referrals And Billing Credit

We use referral records to confirm eligibility, prevent duplicate or self-referrals, apply Toolkit billing credit, send the beneficiary club owner a transactional credit confirmation, reverse credit following a refund or dispute, and help with support enquiries. Stripe processes the underlying subscription payment. We do not store full card details; where needed to prevent misuse, we may compare the non-card-data payment method fingerprint supplied by Stripe for the two clubs.

Referral reward and audit records may be retained after an account or club is archived where needed for billing reconciliation, fraud prevention, disputes, and financial or support records.

Retention

Account and active club records are kept while they are needed to provide the service. Short-lived sign-in tokens and rate-limit records expire or become eligible for removal after their security purpose has ended and are pruned during later maintenance. Diagnostic logs use the shorter periods described above.

Some records may need to remain after an account or club is closed, including payment and refund history, consent evidence, referral and billing records, safeguarding or attendance audit history, and records needed for fraud prevention, disputes, legal obligations, or the club's own retention duties. Where practical, those retained records are detached from active sign-in details or use locked historical snapshots.

Deleting Your Account

You can delete your account from the account page. This removes your sign-in methods and active sessions and deletes personal saved work. Where historical club, payment, consent, safeguarding, or audit records need to remain, the active identity is replaced with a closed-account record or detached from those records. Accounts with no such retained relationship may be deleted completely. If you own a club, the deletion flow explains that the club and its active services will also be closed. Public shared links are separate copies and may remain available unless removed separately.

Where you signed a club consent form, the club may need to retain the immutable evidence and receipt after your Toolkit account is deleted. The evidence keeps the document, student and signer snapshots but no longer depends on an active account. Contact the club about its retention policy or a request concerning that record.

Your Privacy Choices

You can update many account, contact, communication, and linked-student details in the app. Contact your club about a club-managed student, safeguarding, attendance, document, or consent record. Contact Martial Arts Toolkit if you need help accessing, correcting, exporting, restricting, or deleting information that cannot be managed in the app.

Contact

For privacy or account questions, email support@martialartstoolkit.com.

If you are not satisfied with how we have handled your information or your request, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling their helpline on 0303 123 1113. We would appreciate the chance to address your concern first.