Política de privacidad

1. Quiénes somos

Combat Control is operated by CombatControl, a sole trader based in Queensland, Australia. We provide a SaaS platform for Brazilian Jiu-Jitsu gym owners to manage their academies. For privacy matters, contact us at [email protected].

2. Qué información recopilamos

We collect information you provide directly and information generated by your use of the service:

Account information: your name, email address, hashed password, gym name, and gym contact details.
Payment information: billing is handled by Stripe. We do not store card numbers, bank account details, or other payment credentials on our servers.
Usage data: pages visited, features used, marketing attribution (UTM source, referrer, hashed IP, user agent), and error logs (collected via Sentry for service reliability).
Communications: records of emails we send you (transactional, billing, alerts) and any replies you send us.

3. Cómo usamos tu información

We use the information we collect to:

Provide, operate, and maintain the Combat Control service.
Send necessary transactional emails: email verification, billing receipts, payment failure notices, and security alerts.
Detect and prevent abuse, fraud, or unauthorised access.
Improve the product based on how it is used.
Comply with our legal obligations under Australian law.

We share your information only with the third-party service providers necessary to operate the platform:

Stripe: payment processing and subscription management.
Resend: transactional email delivery.
Cloudflare: DNS, DDoS protection, and bot detection via Turnstile.
Sentry: error tracking and application monitoring.
AWS / Cloudflare R2: file uploads and backup storage.
Google Analytics 4, Meta Pixel, Microsoft Clarity: when enabled and only after you grant cookie consent on a public marketing page, these services receive pageview and conversion events to help us understand how visitors discover and use the site. They are never loaded inside the authenticated app.

We never sell your data to third parties.

5. Tus derechos

Under the Australian Privacy Act 1988 and the EU GDPR (where applicable), you have the following rights:

Access: request a copy of all personal data we hold about you.
Correction: update inaccurate data at any time via your account settings.
Deletion: request deletion of your account and all associated data. Requests are processed within 30 days.
Portability: export your data in a machine-readable format (CSV) via the Data Export feature.

To exercise any of these rights, email [email protected].

6. Conservación de datos

We retain your data for as long as your account is active. When your account is closed, personal data is deleted within 90 days. Certain records may be retained for longer where required by law. For example, financial and tax records are retained for 7 years under Australian law. Anonymised, aggregated data may be retained indefinitely for product improvement purposes.

7. Seguridad

We take reasonable technical and organisational measures to protect your data, including:

TLS encryption for all data in transit.
Encryption at rest where supported by our infrastructure providers.
Passwords hashed using bcrypt. We never store plaintext passwords.
Two-factor authentication (2FA) available for admin accounts (when implemented).

No system is 100% secure. In the event of a data breach affecting your personal information, we will notify you within 72 hours in accordance with the Australian Notifiable Data Breaches (NDB) scheme.

8. Cookies

Combat Control uses a session cookie that is required to keep you logged in. Cloudflare Turnstile (our bot-detection service) may set a cookie as part of its verification process.

On our public marketing pages, when third-party analytics are enabled, you will see a cookie banner before any analytics or pixel cookies are set. Choosing Accept stores your decision in a cc_analytics_consent cookie and allows Google Analytics 4, Meta Pixel, and Microsoft Clarity to load. Choosing Decline stores the same cookie with the opposite value and prevents those scripts from running. You can clear the cookie at any time from your browser settings to revoke consent.

9. Transferencias internacionales de datos

Your data may be processed in the United States or the European Union by our service providers (Stripe, Resend, Sentry, Cloudflare). Each of these providers maintains appropriate data protection safeguards, including Standard Contractual Clauses and Privacy Shield equivalents where applicable. By using Combat Control you consent to these transfers.

10. Menores de edad

Combat Control is not intended for users under the age of 16, except as student accounts managed within a gym account. When gym owners create student accounts for minors, the gym owner is solely responsible for obtaining appropriate parental or guardian consent as required under Australian law and applicable local laws.

11. Cambios a esta política

We may update this Privacy Policy from time to time. We will notify you of material changes via email before they take effect. Your continued use of Combat Control after the effective date of the updated policy constitutes acceptance of the changes. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contacto

For any privacy questions, data requests, or concerns, contact us at: [email protected]. We aim to respond within 5 business days.