Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how MatPilot Limited collects, uses, shares and protects personal data when you use the MatPilot mobile app, websites and related services (together, the "Service"). It applies wherever you are.

We do not sell your personal information, and we never have. We do not share it for cross-context behavioral advertising, we do not run advertising trackers on this site, and we do not use your academy's member data to train models. If you are in a state with a privacy law, that means most of what you would want to opt out of is something we do not do.

MatPilot applies one standard everywhere, and it is the strictest one we are subject to, rather than giving people in some states or countries fewer rights than people in others. Your rights under your own state's law are set out in clause 10, along with how to exercise them and who to complain to. Clause 4 covers children, including how we handle students under 13.

1. Controller & processor roles · 2. Data we collect · 3. How & why we use it (legal bases) · 4. Children · 5. Email & messaging · 6. Who we share with (sub-processors) · 7. International transfers · 8. Retention · 9. Your rights · 10. Your rights where you live · 11. Automated decisions & AI · 12. Security · 13. Cookies · 14. Operator data-processing terms · 15. Complaints · 16. Changes

1. Controller & processor roles

MatPilot is used by martial arts academies, gyms and coaches ("Operators") to run their business, and by their students and clients ("Members"). Who is responsible for which data depends on the data:

• MatPilot is the controller for: Operator account and staff data, billing and subscription data, website and app analytics we collect, security logs, and our own communications with you.
• The Operator is the controller, and MatPilot is the processor, for the Member data an Operator enters or uploads (member profiles, attendance, grading, documents, photos, guardian details, etc.). We process it only on the Operator's documented instructions, as set out in clause 14.

If you are a Member and want to exercise your rights over data held by your academy, contact your academy (the controller) and we will help them respond.

2. Data we collect

• Identity & contact: name, email address, phone, and (for Members where the academy records it) date of birth and address. Authentication is handled via Amazon Cognito.
• Academy & membership data: academy profiles, plans, classes, bookings, attendance/check-ins, belt & grading records, notes, documents and waivers an Operator creates or uploads.
• Photos: profile photos and end-of-class team photos uploaded by Operators or Members. Photos of identifiable people are personal data; for minors, photo consent is recorded per member.
• Guardian details for members who are minors, where the academy records them.
• Staff safeguarding data (instructors/managers): whether a background check and first-aid certification are on file, and when they expire, recorded by the Operator as informational flags. We do not run the checks and we do not hold their contents.
• Payment data: billing is processed by Stripe. We do not store full card numbers; we store references (e.g. customer/subscription IDs, amounts, status) needed to manage memberships and our own subscription.
• Communications: in-app messages/inbox, notification preferences, and support emails.
• Google Calendar (only if you connect it): a coach who connects a Google Calendar to offer bookable sessions gives MatPilot read access to the free/busy times of their primary calendar (when a busy period starts and ends) and the email address of the Google account they connected. We never see event titles, descriptions, attendees or locations, and we never create, change or delete events. See Google user data.
• Device, usage & log data: technical data (device/app version, IP address, timestamps, crash diagnostics) needed to operate, secure and debug the Service. Crash reporting uses Sentry.
• Location: we do not track your location. If an academy enables optional geofenced check-in, your device's coarse location is used only at the moment you check in, to confirm you are at the venue.

We do not intentionally collect sensitive personal information (health, biometric, precise geolocation, or the other categories your state may define). If an academy chooses to record an injury note or similar health data about a member, the academy is the controller of it and is responsible for handling it lawfully, including any consent its state requires.

3. Why we use it, and what we never do with it

What we do not do, in any state: we do not sell personal information; we do not share it for cross-context behavioral advertising; we do not use it for targeted advertising; we do not profile you in a way that produces legal or similarly significant effects; and we do not use an academy's member data to train AI models. We collect only what the purposes above need, and keep it only as long as clause 8 says.

Google user data

If you connect your Google Calendar to MatPilot Sessions, we use Google's Calendar API with one permission, free/busy, plus your Google account's email address so you can see which account is connected.

• What we use it for: only to stop clients booking a session at a time your Google Calendar shows you as busy. Nothing else.
• What we keep: the connected account's email address and an access credential from Google, encrypted. Your busy times are read when someone looks for a slot, held for at most two minutes, and never saved.
• What we never do: we do not sell it, use it for advertising, use it to train AI models, or share it with anyone. No one at MatPilot reads it, except with your permission, where needed for security, or where the law requires it.
• Disconnecting: disconnect at any time from Sessions, Availability in the app, or from your Google Account's third-party access page. Disconnecting deletes the credential and revokes our access at Google.

MatPilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Children

You must be at least 16 to create your own MatPilot account. That is higher than the Children's Online Privacy Protection Act (COPPA) requires, and deliberately so: we apply one minimum worldwide rather than a different one per country, and we set it above every threshold we are subject to. We do not knowingly collect personal information from a child under 13 directly, and a child cannot create an account.

Kids' programs are a large part of martial arts, so most academies do manage members who are minors. When they do, the child's record is created and controlled by the academy, not by the child, and the academy is responsible for obtaining and keeping verifiable parent or guardian consent before entering a minor's information, including their photograph. MatPilot provides the tools for this: a family portal where a parent or guardian holds the login and signs on the child's behalf, per-member photo-consent controls, and a warning to staff before a class photo including a minor without consent on file is posted.

If you are a parent or guardian and believe your child's information was entered without your consent, contact the academy, or email us at admin@matpilot.io and we will help get it corrected or deleted.

5. Email & messaging

MatPilot sends transactional, account-related email only (for example: a payment received or failed, a trial converting, a new member joining, grading ready). These are triggered by activity in the account and include a List-Unsubscribe header. We do not send marketing email through this channel and we do not email purchased or scraped lists. Owner notifications can be turned off per category in-app. Email is delivered via Resend; we suppress addresses that hard-bounce or complain. Any member-facing messages an Operator sends must comply with the electronic-marketing law that applies to its members. In the US that is the CAN-SPAM Act, the TCPA for text messages (which requires prior express consent and working STOP handling), and your state's own rules. Opt-outs must be honored.

Text messages (SMS). When your academy texts you through MatPilot, the messages come from the academy's own number and are about your classes, bookings and membership, and, only if you agreed to them separately, the academy's news and offers. Message frequency varies, and message and data rates may apply. Reply STOP to stop the texts, or HELP for help. We do not share your mobile number or your text-message opt-in with third parties or affiliates for their marketing. Your number and your opt-in are shared only with the providers that deliver the messages (Twilio and the mobile carriers), and only to deliver them.

If you receive a message through the in-app inbox that is harmful, offensive, or unlawful, you can report it directly within the app. We review reports promptly.

6. Who we share data with (sub-processors)

We do not sell personal data. We share it only with the service providers that help us run the Service:

Each is bound by a data-processing agreement. We may also disclose data where required by law, to establish or defend legal claims, or to protect the rights and safety of users.

7. International transfers

MatPilot is operated from Ireland, and our core infrastructure runs on Amazon Web Services in the EU. Several providers process data in the United States: the AI features (Amazon Bedrock / Anthropic), push notifications (Expo), and parts of Stripe and Twilio. So your data crosses the Atlantic in both directions, and we tell you that plainly rather than burying it.

Every provider is bound by a written data-processing agreement, and the transfers are covered by appropriate safeguards: the European Commission's Standard Contractual Clauses (2021/914), the providers' own supplementary measures, and the EU–US Data Privacy Framework where a provider is certified to it. The protection does not depend on which side of the transfer you are on. We minimize what is sent (for the AI features, only the limited context noted above). You can ask us for more information about these safeguards.

8. How long we keep data

When we erase data, we remove or irreversibly anonymise it except where we must keep limited records (e.g. transaction IDs for tax) by law.

9. Your rights

Wherever you live, and whichever law covers you, we give you the right to:

• access your personal data and get a copy;
• rectify inaccurate data and complete incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to processing, including processing based on legitimate interests;
• data portability: receive your data in a structured, machine-readable format;
• withdraw consent at any time where we rely on consent;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (see clause 11).

Exercise any of these in-app (you can update your details, manage notifications, and file an export or deletion request from your account), on our Data & privacy rights page (sign in to request a copy of your data, or delete some or all of it), or by emailing admin@matpilot.io. We respond within one month (extendable by two months for complex requests, with notice), free of charge in normal cases. For data held by an academy about its Members, we route the request to that academy as controller and assist it.

10. Your rights as a US resident

Clause 9 is what we give everyone, in every state, whether or not your state has passed a privacy law. Where your state has one, it names these rights specifically:

These rights are recognized in different words by the state laws now in force, including the CCPA as amended by the CPRA (California), the VCDPA (Virginia), the CPA (Colorado), the CTDPA (Connecticut), the UCPA (Utah) and the comparable acts in Texas, Oregon, Montana and the other states that have followed them. We do not check which state you are in before honoring a request.

Authorized agents. You may use an authorized agent to make a request. We will ask for proof that you gave them permission, and we may ask you to verify your own identity directly.

Complaints. If you are not satisfied with how we handled a request, you can complain to your state attorney general. In California you may also contact the California Privacy Protection Agency at cppa.ca.gov. We would rather hear from you first at admin@matpilot.io.

You exercise all of them the same way: in-app, on the Data & privacy rights page, or by emailing admin@matpilot.io. If your state's law gives you a right this policy does not mention, you still have it, and asking us is enough.

11. Automated decision-making & AI

We do not make decisions producing legal or similarly significant effects about an individual by solely automated means. The AI assistant and co-pilot summarise data and suggest or draft actions, but anything that affects a Member (such as sending a message) requires a human at the academy to confirm it. AI processing uses Amazon Bedrock / Anthropic in the US with the safeguards in clause 7, and is limited to the context needed to answer.

The AI may surface informational alerts about compliance matters, such as an applicable sales-tax rate or an Operator responsibility, to help Operators run their business. These are for information only and do not constitute legal, tax or professional advice.

12. Security

We use appropriate technical and organizational measures: encryption in transit (TLS), encryption at rest, scoped role-based access controls, EU-hosted managed infrastructure, audit logging, and least-privilege service permissions. No system is perfectly secure, but we work to protect your data and will notify you, our lead supervisory authority and any other regulator entitled to be told of a personal-data breach, within the deadline the law that covers you sets.

13. Cookies

Our marketing website uses Google Analytics to see which pages you find useful. In the EEA, the UK and Switzerland nothing is stored until you accept: on your first visit a banner asks, and no analytics cookie is written unless you say yes. Elsewhere analytics starts on, and declining in that same banner turns it off. Either way we remember your choice so you are not asked again, and to change it you clear this site's data in your browser and the banner comes back. We use no advertising or cross-site tracking cookies anywhere. The mobile app uses secure device storage (not browser cookies) to keep you signed in, which is strictly necessary to run the app.

14. Data-processing terms for Operators (Article 28)

Where MatPilot processes Member personal data on an Operator's behalf, the following terms apply and form part of our agreement. MatPilot will:

• process Member data only on the Operator's documented instructions (including these Terms and use of the Service), unless required by law;
• ensure persons authorized to process the data are bound by confidentiality;
• apply appropriate security measures (clause 12);
• engage only sub-processors listed in clause 6 (or notified to the Operator) under written terms with equivalent obligations, and remain responsible for them;
• assist the Operator, taking account of the nature of processing, with data-subject requests and with security, breach-notification and impact-assessment obligations;
• notify the Operator without undue delay on becoming aware of a personal-data breach;
• at the Operator's choice, delete or return Member data at the end of the service, save for records we must retain by law;
• make available information needed to demonstrate compliance and allow reasonable audits.

Subject matter: provision of the Service. Duration: the term of the account. Nature/purpose: academy management. Data types/subjects: as in clause 2, concerning the Operator's Members and staff.

15. Complaints

We would like the chance to resolve any concern first. Please contact admin@matpilot.io. You also have the right to complain to a regulator, and you can always choose the one where you live rather than the one where we are.

In the United States that regulator is your state attorney general. In California you may also complain to the California Privacy Protection Agency (cppa.ca.gov), and you can report unfair or deceptive practices to the Federal Trade Commission (reportfraud.ftc.gov). Clause 10 covers the appeal you may have first.

16. Changes to this policy

We may update this policy from time to time. We will update the date above and, for material changes, give reasonable notice (by email or in-app) before they take effect.

Contact

MatPilot Limited (Company No. 819708, Republic of Ireland): admin@matpilot.io. See also our Terms & Conditions.

Terms & Conditions →