Privacy Policy

1. Who We Are

Renzo Gracie Laval operates this member portal to manage class scheduling, billing, and memberships for its students. This policy describes how your personal information is collected, used, and protected.

2. Information We Collect

When you register as a member or book a trial class, we collect:

• Name, email address, phone number, date of birth
• Payment information (processed by Stripe - we store only the last 4 digits of your card)
• Check-in history and class attendance
• Belt rank and training history
• For minors: parent/guardian name and consent

3. How We Use Your Information

• Managing your membership and billing
• Sending class reminders, payment notices, and academy communications
• Processing check-ins and tracking attendance
• Keeping your training record (belt rank, promotions, attendance history)

4. Data Sharing

Your personal information is shared only with the service providers needed to run the member portal:

• Stripe - for payment processing (Stripe's own privacy policy applies)
• Amazon Web Services - our cloud hosting provider (data stored in the Canada Central region, Montreal)
• Amazon SES - for sending emails (may route through non-Canadian AWS regions)

We do not sell your personal information to third parties.

5. Data Retention

• Active member data: retained while your membership is active
• Financial records: retained for 7 years (Quebec tax law)
• Check-in and attendance data: retained for 3 years
• Cancelled member data: anonymized upon request (see Section 8)

6. Cookies and Tracking

We use only essential cookies for session authentication. We do not use tracking cookies, analytics pixels, or third-party advertising trackers.

7. Your Rights (Quebec Law 25 / PIPEDA)

Under Quebec's Act Respecting the Protection of Personal Information and PIPEDA, you have the right to:

• Access your personal information held by us
• Correct inaccurate information
• Delete your account and have your data anonymized
• Withdraw consent for marketing communications at any time
• Port your data - request a copy of your information

To exercise any of these rights, write to the privacy contact in Section 12.

8. Data Deletion

You may request deletion of your personal data at any time. Upon deletion:

• Your name, email, phone, and photo are permanently anonymized
• Your login credentials are deleted
• Payment records are retained in anonymized form for tax compliance (7 years)

9. Unsubscribe from Communications

Every marketing email includes an unsubscribe link. You can opt out of marketing emails at any time. Essential notifications (payment receipts, account security) will continue.

10. Minors (Under 18)

For members under 14, a parent or guardian must consent before any personal information is collected. For members aged 14 to 17, a parent or guardian must consent to the registration, in accordance with Quebec law.

11. Security

We protect your data with:

• Encrypted connections (HTTPS/TLS)
• Bcrypt password hashing
• Data stored in the Canada Central region (Montreal) with encryption at rest
• Role-based access control for staff

12. Privacy Contact

For any question about this policy, to exercise your rights, or to raise a privacy concern, email support@gracielaval.com. Messages sent to this address reach the person in charge of the protection of personal information at Renzo Gracie Laval.

13. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the member portal after changes constitutes acceptance.

14. Commission d'acces a l'information du Quebec

If you believe your privacy rights have been violated, you may file a complaint with the Commission d'acces a l'information du Quebec (CAI) at www.cai.gouv.qc.ca.