Privacy policy

The controller of your personal data is Max Buzin, Dubai, United Arab Emirates. For anything about your data, write to maxbuzin@proton.me.

We follow the UAE Personal Data Protection Law (Federal Decree-Law 45/2021), the Brazilian LGPD (Lei 13.709/2018), and the EU GDPR, and apply the strictest rule where they differ.

We collect only what the site and the school apps need. We do not ask for date of birth, phone number, address, ID numbers, or photos. Children have no login and no email address.

• Email, password (hashed), and sign-in sessionsPlus and JitsLab accounts. Purpose: Let you sign in. Legal basis: Contract. Kept: Until your account is deleted.
• Email, role, last sign-in, account statusJiu-Jitsu Plus (school app). Purpose: Decide who can see and do what. Legal basis: Contract. Kept: While you are a member, then erased 12 months after the account is disabled.
• Student names, belt, and stripes, including childrenJiu-Jitsu Plus households. Purpose: Class roster and rank. Legal basis: Contract with the adult account holder; parental consent for children. Kept: While you are a member, then erased 12 months after the account is disabled.
• Class bookings and check-insJiu-Jitsu Plus. Purpose: Attendance. Legal basis: Contract. Kept: 24 months.
• Record of admin actions (who changed which account, and when)Jiu-Jitsu Plus. Purpose: Security and accountability. Legal basis: Legitimate interest. Kept: 24 months.
• Email, display name, techniques, journal notes, plans, and progress snapshotsJitsLab. Purpose: Your personal training journal. Legal basis: Contract. Kept: Until you delete your JitsLab account.
• A one-way keyed hash of your IP address or email (never the raw value)Rate limiting. Purpose: Stop password guessing and abuse. Legal basis: Legitimate interest. Kept: Overwritten when the limit window ends (minutes to hours).
• Server request logs (IP address, page, browser)Hosting. Purpose: Run and secure the site. Legal basis: Legitimate interest. Kept: Hosting provider default (days).
• Pages visited, device, approximate location, analytics cookie idGoogle Analytics, marketing pages only, only if you accept. Purpose: Count visits. Legal basis: Consent. Kept: 2 months.

If you write to hello@maxbuzin.com or message us on WhatsApp, your message stays in that inbox and is used only to answer you.

• Neon (Databricks): Database and sign-in. AWS eu-central-1, Frankfurt, Germany.
• Vercel: Hosting and request logs. fra1, Frankfurt, Germany; control plane in the United States.
• Google (Google Analytics 4): Visit statistics, only after you accept. United States.

School and JitsLab data is stored in the EU. Google Analytics sends data to the United States, under Google's Standard Contractual Clauses and the EU-US Data Privacy Framework. We do not sell your data or share it for advertising.

Kids' classes are booked by a parent or guardian. A child appears only as a name, belt, and stripes inside the guardian's household, visible to that household and to school staff. Children never sign in, have no email, have no public profile, and are never tracked by analytics. The school app has no analytics at all.

The parent or guardian gives consent for their child's data and can see, correct, export, or delete it at any time by writing to maxbuzin@proton.me.

Sign-in cookies are strictly necessary and are set only when you sign in. The mb_consent cookie remembers your analytics choice and the policy version for 12 months.

Google Analytics cookies (_ga, _ga_*) are set only if you click Accept on the marketing site. Reject is always one click, and nothing loads until you choose. Change your choice at any time:

Cookie settings

You can ask to confirm whether we hold your data, access it, correct it, get a copy in a portable format, delete it, restrict or object to processing, withdraw consent, and know who we share it with. Withdrawing consent does not affect processing done before.

• JitsLab: download or delete your data yourself from your JitsLab profile.
• Jiu-Jitsu Plus: download your household data yourself from your profile. To delete your account and household, write to maxbuzin@proton.me from your account email.
• Anything else: write to maxbuzin@proton.me.

We check that a request comes from the account owner before acting on it and answer within 15 days.

You can also complain to a regulator: the UAE Data Office, the ANPD in Brazil, or the data protection authority where you live in the EU.

Data is encrypted in transit and at rest. Each household sees only its own data, enforced in the database. If a breach puts your data at risk, we will tell you and the regulator as the law requires.

When this policy changes, the version date above changes and we ask for your analytics choice again.