← Back to home

Privacy policy

Effective December 1, 2026.

Martialnote helps martial arts schools manage their students. To do so, it keeps personal information: that of the people who use the app, and that which each school enters about its students and their parents, including minors. This policy explains what, why, who can access it, where it is kept, for how long, and how to exercise your rights. It applies wherever you live; depending on where you are (for example in the European Union, the United Kingdom, Canada or California), the law may give you additional rights, which we respect.

Who is responsible

Each school is responsible for the information it collects about its students and their parents: it decides to enter it, has the relationship with them and makes sure it is entitled to do so. Martialnote hosts and processes that information on the school's behalf and on its instructions, only to provide the service. Under the GDPR, the school is the controller and Martialnote its processor.

Martialnote is responsible for account information (owners and instructors) and for that of visitors to its website. For any question about the protection of personal information, write to its founder at bonjour@martialnote.com.

What we keep

For each account: name, email, display language and style, school and role, date the terms were accepted, and sign-in sessions. There is no password.

For each school, what it enters: students (first name, last name, email and phone for adults, emergency contact, minor or not, enrolment date), parents or guardians (name, relationship, email, phone), groups, schedule, attendance, progress and ranks, notes, subscriptions and recorded payments (amounts and dates, never a card number), and the messages sent. The app never asks for a date of birth.

A history of changes (who changed what, and when) is kept for security and to correct mistakes. A copy of each email sent (recipient, subject, text) is kept to deliver it and understand a delivery failure. The server also keeps technical logs (IP address, page requested, date) for security and troubleshooting. IP addresses linked to account creation and to the security log are never kept in plain text: only a fingerprint (computed with HMAC from a secret) is kept, and it is erased after 30 days; the rest of the security log is kept for at most 12 months.

Subscription payment: payment is processed by Stripe. The card and billing address are entered at Stripe and never pass through Martialnote, which does not see them. Martialnote only keeps the school's Stripe identifiers (customer, subscription), amounts, dates, the plan (monthly or yearly) and the subscription status, as long as the school uses Martialnote.

Cookies

The app uses a single cookie, required to sign in: it keeps your session open for up to 90 days. The landing page uses none. We measure how Martialnote is used anonymously: the screens and features used, by role and by school size and age. This measurement contains no name, no identifier, no amount and none of the content of your records or messages; it uses no cookie, it is hosted on our own server, and you can refuse it with Do Not Track or Global Privacy Control. There is no advertising pixel and no cross-site tracking.

What it is used for, and on what basis

To provide the service: display and save the school's data, send emails (sign-in links, invitations, the school's messages to its students), protect accounts and answer support requests. Never for advertising, profiling or sale: we do not sell or rent any information, and we do not use it to train artificial intelligence models.

For account information, we rely on the performance of the contract (providing the service you asked for), on our legitimate interest in protecting and improving the service, and on the legal obligations that apply to us. For the data of students and their parents, the school determines the legal basis; Martialnote follows its instructions.

Minors

A minor student has no email or phone in the app: the school communicates with their parents or guardians. Within the school, only the owner sees the contact details of students and parents; instructors see names, attendance, progress and the emergency contact.

Martialnote is not directed at children: only adults who run or teach at a school can create an account. Before entering a minor student, the school makes sure it has the permission of their parents or guardians, under the rules that apply where it operates.

Who has access

A school's data is visible only to the people of that school, according to their role; the database isolates each school from the others. At Martialnote, it is accessed only when needed for support, maintenance or security. To review a message held by security, a Martialnote operator may read the subject and the text of that held message, and nothing else: neither the addresses, nor the names, nor the school's other data.

We use a few providers, bound to confidentiality and security, who receive only what they need: Hostinger (server hosting), Backblaze (storage of backups, encrypted before they are sent), Resend (email delivery), Stripe (subscription payment and sending of receipts and invoices) and Cloudflare (Turnstile anti-robot check at account creation, which sees the IP address during the check). Reading names from a photo, off by default, sends the photo to OpenRouter and to the provider of the artificial intelligence model only if the school's owner turns it on; Martialnote keeps neither the photo nor the names read. Questions asked to the assistant on the Help screen are sent to OpenRouter and to the model's provider (Anthropic) to produce the answer; Martialnote keeps neither the question nor the answer, and the assistant receives no data from the school. Don't put any personal information in them.

We do not share information with anyone else, unless the law requires it (for example a court order), or with a buyer of Martialnote in the event of a sale, who would then be bound by this policy.

Where it is kept and how it is protected

The data is hosted in the United States. If you live elsewhere, your information is therefore transferred there; we choose providers that offer recognized safeguards for such transfers, such as the European Commission's standard contractual clauses. The data is protected by encrypted connections (HTTPS), the isolation of each school in the database, restricted access to the server, and backups encrypted before they leave the server.

How long

A school's data is kept as long as it uses Martialnote. What the school deletes stays 30 days in the trash, then is erased, along with its change history. The copy of a sent email is erased after 90 days. A sign-in link expires after 15 minutes; a session, after 90 days. The server's technical logs are kept 30 days. Payment identifiers, amounts and dates are kept as long as the school exists; Stripe keeps its own payment records according to its legal and accounting obligations. To close a school or delete an account, write to us: the data is then erased from the database, and disappears from backups within 12 months at most, as they are renewed.

Emails left on the former waiting list are used only to announce the opening of Martialnote, then are erased.

Your rights

Depending on the laws that apply to you, you can ask to see your information, have it corrected or deleted, receive a copy in a common format, restrict or object to its use, and withdraw your consent where processing relies on it. A school's owner can export all of its data at any time from the app.

If you are a student or a parent, first contact your school, which manages your information; you can also write to us and we will pass your request on. We answer within 30 days. You can also file a complaint with the data protection authority of your country or province, for example the Commission d'accès à l'information in Québec or the CNIL in France.

If an incident occurs

If an incident affects personal information and presents a risk of serious harm, we promptly notify the schools and people concerned, as well as the authorities where the law requires it.

Changes

If this policy changes in a significant way, accounts are notified by email at least 30 days in advance. The date at the top of the page shows the version in effect.

For any question or request: bonjour@martialnote.com.