Privacy Notice

Who we are

EveryDojo is a trading name of Rondas Exports Ltd. Registered in England and Wales, company number 14519851. Company details are in the terms. For data protection purposes, where a club uses EveryDojo to manage its own members, the club decides what is held about its members and why — it is the controller — and EveryDojo processes that data on the club's behalf. Where you deal with EveryDojo directly, for example your own login, EveryDojo is the controller.

Contact for anything in this notice: hello@everydojo.com. You can complain to the Information Commissioner's Office at ico.org.uk.

1. What this covers

This notice covers everyone who creates an EveryDojo account: parents and adult students managing a membership, and instructors running a club. It explains what we collect, why, who can see it, and what your rights are.

2. What we collect

Account details: name, email address, mobile number, and a securely hashed password (we never store or can see your actual password).

Membership/licence record for each person you register (yourself or your child): address and postcode, date and place of birth, profession, nationality, an emergency (next of kin) contact, any prior martial arts experience, current governing-body licence details if you hold one, and a health declaration covering conditions relevant to safely taking part in physical training (e.g. epilepsy, asthma, heart conditions, diabetes). You also choose whether to add a photo and a signature.

Payment information: which payment method you've chosen (cash, bank transfer, or GoCardless Direct Debit) and, if bank transfer, the amount and reference you use. We never see or store your card or bank account details directly — if your club uses GoCardless, that's held by GoCardless (see below), not by us.

Messages: anything you send in your club's group chat or in a direct message to your instructor, including any photo or voice note you choose to attach.

Your own planning: if you save an area alert, the town or postcode you searched and the style you picked, until you stop it; and any note or "how did it go" you add to a trial class, which only you can see, never the club.

3. Why we process it, and on what basis

To run your account and your club membership, track attendance and licence status, and let you and your instructor communicate. We only contact you by email or phone about training, attendance, licence renewals, or club updates with your explicit consent, given as a separate checkbox at sign-up, which you can withdraw at any time.

Health information is a special category of data under UK GDPR. We collect it because your instructor genuinely needs it to train you or your child safely, only with your explicit consent at sign-up, and it's never used for anything else.

4. Who can actually see it

Your own club's owner can see everything you submit for your membership. A club can also give specific helpers scoped access instead of full access — a "Safeguarding" role sees contact and health/licence details but never payment information, a "Finance" role sees payment information but never health details, and a "Register" role sees only names, classes, and attendance. Access to a student's full health/licence record is logged, recording who viewed it and when.

If you book an event that another club has opened to everyone, that club sees who is coming, their age and any health notes (so it can run the event safely), and your name, email and phone, the same as for its own members' families.

Beyond your own club, EveryDojo (the team running the platform) can access data as needed to operate, support, and fix the service. We don't sell your data, and we don't share it with anyone for their own marketing or advertising purposes.

5. Other services we rely on

EveryDojo runs on other companies' infrastructure, and some of them can reach your data in order to do their job — hosting, the database, email delivery, Direct Debit, and the AI assistant used to build and maintain the product.

Rather than describe that in prose here and let it drift out of date, the complete and current list lives in one place: who else touches your data. It names every company, what it does, exactly what it can see, and which country the data is stored in. That page is the authoritative list and is updated whenever it changes.

None of them use your data for their own purposes. There is no advertising network, no analytics profiling and no data broker. We do not sell data. Visits to public pages are counted with Vercel Web Analytics, without cookies; signed-in pages and search terms are never counted.

6. Where your data is stored

EveryDojo's database is hosted in the United States (Virginia). That means personal data about UK members, including children and health information, is transferred outside the UK. Transfers outside the UK are permitted where appropriate safeguards are in place, and we rely on the providers' standard data protection terms for that. Club logos and photographs are stored in London. Direct Debit data stays with GoCardless in the UK and EEA.

We are telling you this in the main notice rather than a footnote, because it concerns children's information. The full list of who stores what, and where, is on the subprocessor page.

7. How long we keep it

We keep your data while your account or your child's membership is active. If your club archives a membership (for example, when a student leaves), the instructor chooses a real deletion date, 3 or 6 months out, and the record is automatically and permanently deleted on that date, not just hidden. A short training record (each club, the dates, the grades and how many classes) stays in the family's own account, visible only to them, until they delete it. Account deletion requests are reviewed by a real person, since a claimed club or family account can have other records depending on it.

8. Children's data

A child's membership is always created and managed by their parent or guardian's own account — a child never has their own separate login. The parent is the one who submits, can review, correct, or delete their child's information at any time, and is who any request about that data should come from.

9. Your rights

You can download a real copy of your own account and membership data at any time from Settings → Download my data, and you can request account deletion from the same page. You can also raise a request with your club directly and they'll pass it on. You can ask to see, correct, or delete what we hold, and withdraw contact consent, at any time.

10. Changes, and where cookies are covered

As EveryDojo grows this notice will be replaced with a properly reviewed policy, including a formal lawful-basis review and a Data Protection Impact Assessment. For what cookies and similar storage this site actually uses, see our Cookies page. See our Terms for everything else about using EveryDojo.