Privacy Policy

Jitsunami+ is operated by Aptitude Agency Ltd (company number 06922078), a company registered in England and Wales whose registered office is at Unit 5, Avenue Business Park, Brockley Road, Elsworth, Cambridge, CB23 4EY, United Kingdom. Our VAT registration number is 175581971. In this document, "we", "us", "our" and "Jitsunami+" mean Aptitude Agency Ltd.

Depending on how the Platform is used, we may process:

• Account and profile data: name, email address, password (stored only as a secure hash), date of birth, roles, and the academies you belong to.
• Academy history: if an Academy you belonged to leaves the Platform and its data is deleted, your account keeps a short record of it: the Academy's name, your role, the dates you joined and left, the belt you held there, and a note that the Academy has been removed from Jitsunami+.
• Contact details: phone number, postal address and an emergency contact, where you or your Academy provide them.
• Membership data: attendance, belts and stripes, gradings and promotions, bookings, waitlists, and waiver signatures.
• Payment data: subscription and invoice records, and the status of payments. Payments are processed by the relevant payment provider; we never see or store full card numbers.
• Medical information: where an Academy or Member chooses to record it. Medical notes are encrypted with a separate key and are excluded from the AI Assistant by default.
• Communications and support: messages, notifications (including text messages, if you agree to receive them), support tickets you send or receive through the Platform, and messages you send us through our contact form.
• Technical and usage data: log data, device and browser information, IP address, cookie data and, if you accept analytics cookies on our public web pages, website usage statistics, and, if you accept advertising cookies on our own marketing pages, the pages you visited and the sign-up steps you completed there (see our Cookie Policy).

There are two situations:

• Data your Academy manages about you. When an Academy collects or enters data about its Members and staff (such as attendance, belts, medical notes, and membership records), the Academy is the controller: it decides why and how that data is used. We process that data as the Academy's processor, acting on its instructions to provide the Platform. If you want to access, correct, or delete that data, the best route is usually to contact your Academy.
• Data we control. For your individual account (including the history of Academies you belonged to that have left the Platform), the security and operation of the Platform, billing of academies, and the improvement of our service, we are the controller.

Where we are the controller, we rely on these lawful bases under UK data protection law:

• Contract: to create and run your account and to provide the Platform.
• Legitimate interests: to secure, maintain, and improve the Platform, to prevent fraud and abuse, and to keep records. We balance these interests against your rights.
• Consent: for optional analytics or marketing cookies, and where else we ask for it. You can withdraw consent at any time.
• Legal obligation: to keep financial and tax records and to comply with the law.

The Platform includes an optional AI Assistant. When it is used:

• We send the relevant request to an enterprise AI provider (currently Anthropic, or OpenAI where selected). We use these providers under their commercial API terms. Providers may retain request data for a limited period for security and abuse monitoring, in line with their own published policies.
• Medical notes are excluded from the AI Assistant by default.
• Member-entered text is treated by the system as data, not as instructions, to reduce the risk of misuse.

We also use the same AI providers, on the same terms, to help with support. When an Academy's owner or administrator raises a support ticket, we send the ticket's text and any screenshots attached to it to help us sort the ticket and suggest an answer from our help guides. Answers written by AI are labelled as such.

When an Academy imports a spreadsheet and selects Suggest matches, we use the same AI providers, on the same terms, to suggest how its columns match ours. We send only the column headings, a description of each column's format (such as "an email address" or "a number with 4 digits"), and the entries in columns that have a fixed set of answers, such as belt, plan or billing type. We never send what the cells say, so no names, email addresses, phone numbers, dates of birth, addresses or medical notes.

We use a small number of trusted providers to run the Platform. They process data on our instructions under appropriate agreements. They include:

• Payment processing: Stripe (and, where an Academy chooses, other payment providers).
• AI providers: Anthropic and OpenAI, for the AI Assistant, support tickets and import suggestions, under their commercial API terms.
• Hosting and infrastructure: DigitalOcean, with data hosted in the United Kingdom.
• Network and security: Cloudflare.
• Email delivery: our email provider (for example, Postmark or another mail relay).
• Text messages: Twilio, only where an Academy has turned text messages on and you have agreed to receive them.
• Notifications: a push-notification provider, where enabled.
• Website analytics: Google Analytics, on our public web pages (including academies' public pages), only if you accept analytics cookies.
• Advertising measurement: the Meta Pixel, on our own marketing pages only (never academies' pages), only if you accept advertising cookies.
• Monitoring: application logs and error reports are kept within our own hosting.

The Platform's data is hosted in the United Kingdom. Some of our service providers are based outside the UK, including in the United States. Where data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or addendum, or an adequacy decision.

We keep personal data only for as long as we need it for the purposes set out here, then delete or anonymise it. In practice:

• Your Jitsunami+ account is kept while it is active, and for a reasonable period afterwards. It is not deleted because an Academy you belonged to leaves the Platform: you keep your login and your Academy history.
• Membership data is kept while the membership is active and, after it ends, while the Academy still uses the Platform, unless the Academy deletes it sooner. When the Academy itself leaves, the next point applies.
• When an Academy leaves the Platform and we close (archive) its account, its data is kept for two years from that date, so that the Academy can come back or take a copy. During that time the Academy's owner can still sign in and download the Academy's data, unless we suspended the Academy's access before it was archived, and about two weeks before the two years end we email the owner to say what will happen and when. After two years, the data the Academy held is permanently deleted, including its Members' records, attendance, notes, medical information, bookings, payment records and uploaded files. We keep only the records about the Academy's own subscription with us (billing and tax records) and a minimal record that the Academy existed. The people who belonged to it keep their own Jitsunami+ accounts and a short history line for that Academy (see section 2).
• Financial and tax records are kept for as long as the law requires.
• Data exports are kept for about 7 days, and bulk-import source files for about 30 days, before being deleted.
• If an Academy invites someone to join as a Member and they do not join, or the Academy cancels the invitation, the invitation (the name and email address it was sent to) is deleted 90 days after it was last sent.
• AI Assistant conversations are deleted 12 months after their last message. The details of each lookup the assistant makes, what it looked up and what it found, are reduced to a hashed record after about 90 days.
• Backups are kept on a rolling basis (around 90 days), so data deleted from the Platform, including a departed Academy's data, leaves our backups as they roll over. Error logs are kept for about 30 days.

Where we act as a processor for an Academy, retention also follows the Academy's instructions and its own obligations.

Under UK data protection law you have rights to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, and to data portability. You can also withdraw any consent you have given.

How to exercise these rights:

• For data your Academy manages about you, contact your Academy, which is the controller. The Platform gives academies tools to handle data exports and erasure requests.
• For data we control, send us a message through the contact form at app.jitsunami.com/contact, which anyone can use without an account. If you run an Academy you can also raise a support ticket from within the Platform, and anyone can write to us by post (see "How to contact us").

We will respond within the time limits set by law. There is normally no charge.

Academies often train children. Where a Member is below the Academy's age threshold, they do not hold their own login: a parent or guardian manages their participation and provides any consent needed. We process children's data on the instructions of the Academy and the relevant parent or guardian. If you believe a child's data has been provided without proper authority, contact the Academy, or contact us through our contact form, so it can be addressed.

We use reasonable technical and organisational measures to protect personal data, including encryption of data in transit and at rest, a separate encryption key for medical notes, tenant isolation so one Academy's data is kept separate from another's, and access controls.

However, no online service can be guaranteed completely secure. While we work to protect your data, we cannot promise that it will never be lost or accessed without authorisation, and you acknowledge this residual risk. We will deal with any personal-data breach as the law requires.

We use essential cookies to run the Platform and optional analytics and advertising cookies you can decline. Our Cookie Policy explains this in more detail.

We may update this Privacy Policy from time to time. The current version is always on this page, with the date it was last updated at the top, and it applies from that date.

If you have a concern about how your personal data is handled, please contact us first so we can try to put it right. You also have the right to complain to the relevant data protection supervisory authority. Where your Academy is the controller, you may also raise your concern with the Academy.

You can reach us in any of these ways:

• Contact form. Anyone can send us a message through the contact form at app.jitsunami.com/contact, with or without an account. Use it for questions about your personal data.
• Support tickets. If you run an Academy on the Platform, as its owner or an administrator, open a support ticket from within the Platform. This lets us link your request to your Academy.
• By post. Write to us at Aptitude Agency Ltd, Bedford iLab, Stannard Way, Bedford, MK44 3RZ, United Kingdom.

We do not provide support by email. Please use the contact form, a support ticket or the post so that we can handle your request properly.