Who is responsible
MaxiGarami OÜ (registry code 14874837, Sepapaja tn 6, 15551 Tallinn, Estonia) is responsible for your personal data in the app (“we”). For any question about your data, write to max@bjjflowcharts.com.
What we collect
- Your account: your email address, your first name if you give it, and your password, which is stored encrypted and which we cannot read. If you sign in with Google or Apple, they send us your email address and, if you allow it, your name.
- Your progress: the status you give each technique (Not known, Learning, Mastered) and its history, your favourites, the videos you mark as watched, and your settings, such as your language and the courses shown.
- Your subscription: your plan, its status and its dates, and the reference of your customer record at Stripe. Your payment details (card number, PayPal account) are collected by Stripe and PayPal, never by us.
- Your messages: what you write to us on the Contact page.
- Your email choices: whether you agreed to receive the newsletter, and when.
- Former subscribers: if you subscribed to the earlier BJJFlowCharts app, we kept your email address from it, to recognise you and apply your discount.
- Technical data: the cookies described below, and the technical logs our providers keep for security, such as your IP address.
We do not collect sensitive data, and we use no advertising or audience-measurement tools.
Why we use it
- To provide the app: your account, your progress and your access (to perform our contract with you).
- To manage your subscription and payments, and keep accounting records (contract, and our legal obligations).
- To answer your messages (contract).
- To send emails about your account: confirmation, a new password, important news about your subscription (contract).
- To send the newsletter, only if you agreed (your consent, which you can withdraw at any time).
- To recognise former subscribers and give them their discount, and to keep the app secure (our legitimate interest).
Who receives it
We never sell your data. It is shared only with the providers that run the app for us, each bound by a data-processing agreement, and only for what they do:
- Supabase: database and sign-in, on servers in the United States.
- Vercel: hosts the app, on servers in the United States.
- Stripe: payments and invoices. Stripe also handles payment data under its own responsibility, for example to prevent fraud.
- PayPal, if you choose to pay with it, under its own responsibility.
- Resend: sends the app’s emails.
- Klaviyo: keeps your email address, first name, language, plan and sign-up date, to send emails about your account and, if you agreed, the newsletter.
- Vimeo: plays the videos. The player is set not to track you.
- Google and Apple, if you choose to sign in with them, under their own responsibility.
Your messages on the Contact page are also sent by email to Max’s mailbox, so he can answer them. We may also disclose data when the law requires it.
Transfers outside Europe
Some of these providers are based in the United States or keep data there. These transfers are protected by the European Commission’s adequacy decision for the EU-US Data Privacy Framework when the provider is certified, or otherwise by the Commission’s standard contractual clauses.
How long we keep it
- Your account, progress and messages: until you delete your account, which erases them.
- Your email choices: until you withdraw your consent or delete your account.
- Invoices and payment records: 7 years, as Estonian accounting law requires. Stripe keeps them.
- Former subscribers’ email addresses: until the discount is used, or until we stop offering it.
- Technical logs: for the short time our providers keep them for security.
Your rights
You can at any time:
- see and correct your data, or get a copy of it;
- delete your account and its data, from your profile;
- stop the newsletter, from your profile or with the link in every email;
- object to a use based on our legitimate interest, or ask us to limit it.
Write to max@bjjflowcharts.com for anything you cannot do in the app; we answer within one month. You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or to the data-protection authority of the country where you live.
Security
Data travels encrypted, access to it is restricted, and each student can reach only their own data. Passwords are stored encrypted. No system is completely safe: if a breach put your data at risk, we would tell you and the authorities as the law requires.
Children
The app is not meant for children under 16 on their own. A younger student may use it with an account created and managed by a parent or guardian, who is then responsible for it.
Changes
We may update this policy. The date at the top shows the latest version; if a change matters, we will tell you by email or in the app. This policy exists in four languages; if they differ, the English version prevails.