Privacy Policy

This Privacy Policy applies to the BELTZ mobile application, progressive web application, and related services (together, the “Service”), operated by BELTZ Pty Ltd (“BELTZ”, “we”, “us”), a company registered in Queensland, Australia.

BELTZ is a management and engagement platform used by Brazilian Jiu-Jitsu academies and their students. This policy explains what data we access, collect, use, and share, and the choices you have.

Privacy point of contact: hello@beltz.co
You can also submit privacy inquiries through the in-app support option.

We only collect data that is necessary to operate the Service. Depending on how you use BELTZ, this may include:

We do not collect precise device location, contacts, SMS or call logs, or the inventory of other apps installed on your device. We do not link any persistent device identifiers (such as IMEI or SIM serial numbers) to personal data.

• To create and manage your account and your academy membership;
• To record attendance, track belt progression, and deliver curriculum and challenge features;
• To process membership payments through Stripe and manage billing;
• To send service communications such as class reminders, progression updates, and billing notices (by email, SMS, or push notification);
• To enable parent/guardian participation in children’s programs;
• To provide customer support;
• To maintain the security, reliability, and performance of the Service, including fraud prevention and debugging;
• To comply with legal obligations.

We limit the use of your data to the purposes described above. We do not use your personal data for third-party advertising, and we do not build advertising profiles.

We never sell personal or sensitive user data. We share data only in the following situations:

• Your academy. Instructors and administrators of the academy you are enrolled in can see your account, attendance, progression, and billing status, so they can run their academy and teach you.
• Service providers who process data on our behalf under contractual data-protection obligations:
  • Stripe — payment processing (Stripe Privacy Policy);
  • Supabase — secure database and authentication infrastructure;
  • Resend — transactional email delivery;
  • Twilio — SMS delivery;
  • Vercel — application hosting.
• Legal reasons. When required to comply with applicable law, a valid governmental request, or to protect the rights, safety, and security of users and the Service.
• Business transfers. As part of a merger, acquisition, or sale of assets, with legally adequate notice to users.

We handle all personal and sensitive user data securely:

• All data is transmitted using modern cryptography (HTTPS/TLS);
• Data at rest is stored in encrypted databases with row-level security, so each academy and user can only access their own records;
• Payment credentials are handled exclusively by Stripe, a PCI-DSS Level 1 certified processor;
• Access to production data is restricted to authorised personnel on a need-to-know basis.

We keep your personal data only for as long as your account is active or as needed to provide the Service. When your account is deleted, we delete the personal data associated with it (see Section 7).

We may retain limited data after deletion where required for legitimate purposes such as security, fraud prevention, tax and financial record-keeping, or other regulatory compliance (for example, transaction records required under Australian law). Such data is retained only as long as legally required and is not used for any other purpose.

If you created an account in the BELTZ app, you can request deletion of your account and associated data at any time:

• In the app: go to Profile → Settings → Delete account and confirm your request.
• On the web: visit beltz.app/delete-account and submit your registered email address. No app installation is required.

When you request deletion, we permanently delete your account and the personal data associated with it — including profile information, training history, and communications — within 30 days. Account deactivation or “freezing” is never used as a substitute for deletion. Any data retained beyond deletion is limited to what is described in Section 6.

BELTZ includes features designed for children’s martial-arts development (such as the BELTZ Kids Challenge). We take children’s privacy seriously:

• Child profiles can only be created and managed by a parent or legal guardian through the guardian’s own account;
• We collect the minimum data needed to run the program (first name, age group, belt rank, and challenge activity);
• Children’s data is never used for advertising and is never sold;
• Children’s profiles are visible only to the child’s guardian and the child’s academy;
• Guardians can review, update, or delete a child’s profile and data at any time from their own account, or by using the deletion methods in Section 7.

Before collecting personal or sensitive data, we obtain your clear, affirmative consent through in-app disclosures and consent actions. Where the app requests device permissions (for example, camera access to update a profile photo, or notification permission), the request is made at runtime, only when the related feature is used, and you may decline without losing access to the core Service.

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are located in the European Economic Area, United Kingdom, or Switzerland, we also process your data in accordance with the GDPR, UK GDPR, and applicable data-protection laws. Depending on your location, you have the right to:

• Access a copy of the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data (see Section 7);
• Object to or restrict certain processing;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with your data-protection authority — in Australia, the Office of the Australian Information Commissioner (OAIC).

To exercise any of these rights, contact us at hello@beltz.co. We respond to verified requests within 30 days.

Our infrastructure providers may store or process data in countries other than your own. Whenever data is transferred internationally, we ensure an adequate level of protection through contractual safeguards with our service providers consistent with applicable data-protection laws.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app or by email before the changes take effect, and we will update the “Last updated” date at the top of this page. This policy is always available at this URL and from within the BELTZ app.

BELTZ Pty Ltd
Queensland, Australia
Privacy inquiries: hello@beltz.co
Website: beltz.app