Privacy Policy

5280 Karate Academy Foundation Inc ("Westy 5280," "we," "us," or "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our student mobile app, or access the student portal (collectively, the "Services").

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Services.

Contact form submissions: When you submit a contact or free class inquiry form, we collect your first name, last name, phone number, email address, and any additional information you voluntarily include in the message field.

Student portal and mobile app: When a student account is created, we collect and maintain the following records:

• Student name and display name
• Parent or guardian email address (used for passwordless login)
• Belt level and promotion history
• Class attendance records (dates, class type, check-in method)
• Program participation (Leadership, SWAT)
• Belt size (for uniform ordering purposes)
• Any instructor notes associated with the student's account

Automatically collected information: When you visit the Site, we may automatically collect certain technical information, including your IP address, browser type, operating system, referring URLs, and pages viewed. This is used for security and performance and does not identify you personally.

Free-class measurement choice: When you submit a free-class booking, we retain the campaign parameters in the booking URL (such as UTM parameters and a Meta click ID), the booking adult's request IP address and browser user agent, and your advertising-measurement preference. We do not collect browser advertising cookies or install a Meta browser Pixel.

Cookies: This Site may use session cookies to maintain your login state in the admin panel. You can instruct your browser to refuse cookies, though some features may not function correctly without them. The student mobile app uses device-secure storage (not cookies) to retain login tokens.

We use the information we collect to:

• Respond to your inquiry or free class request
• Operate the student portal and mobile app (attendance tracking, belt progression, curriculum access)
• Send login verification codes via email (OTP)
• Allow instructors to manage and certify attendance records
• Communicate information about program schedules, events, and belt testing
• Process and acknowledge charitable donations
• Improve the content and functionality of our Services
• Measure whether advertising led to a completed free-class booking, unless the booking adult opts out
• Comply with applicable legal obligations

We do not sell, trade, rent, or transfer your personal information to outside parties for marketing purposes.

Advertising measurement opt-out: The free-class form includes a practical opt-out control. Selecting it stops future server-side advertising measurement for that booking. You can also contact us using the details below to request an opt-out or deletion. An opt-out does not affect your class booking, confirmations, or other school communications you request.

Many of our students are minors. We take our obligations under the Children's Online Privacy Protection Act (COPPA) seriously.

How student accounts are created — invite-based onboarding: Access to our student portal is invite-only. Instructors or administrators create a student record in our system and then send a time-limited invite link to the parent or guardian email address on file (or to the student directly, if they are 18 or older). The portal account is not activated until the recipient clicks the invite link, provides a verified email address, and explicitly agrees to this Privacy Policy. Students or parents cannot self-register without first receiving an instructor-issued invite. As an alternative, a parent or adult student may submit an access request through the app or website; this notifies our staff, who review it and—if approved—manually issue an invite.

Parental consent for minors: For students under 18, the invite is sent to the parent or guardian email address on file. By accepting the invite and agreeing to this Privacy Policy, the parent or guardian provides verifiable parental consent on behalf of the minor student, as required by COPPA. We record the email address and timestamp of that consent. We do not knowingly allow a minor to create an account without prior parental consent obtained through this process.

Parent / guardian email: We associate a parent or guardian email address with each minor student account. This email is used to deliver the invite link and, subsequently, one-time login verification codes when accessing the portal or mobile app. We do not use this address for marketing without explicit consent.

Data collected on students under 13: We collect and retain the information listed in Section 2 (Student portal and mobile app) for students of all ages, including children under 13, as part of operating the school's enrollment and training records. This data is entered and managed by school staff. No child under 13 can create an account or submit information to us directly — all records for children are created by staff and activated only after a parent or guardian accepts an instructor-issued invite.

Parental rights: Parents and guardians may review their child's records, request corrections, or request deletion of their child's account by contacting us using the information in Section 11. We will fulfill deletion requests within 30 days, subject to any legal obligation to retain records.

If you believe your child's information has been collected or used improperly, please contact us immediately.

Westy 5280 is a private martial arts school and does not receive federal education funding. As such, the Family Educational Rights and Privacy Act (FERPA) does not directly govern our records. However, we apply FERPA's core principles as a matter of policy:

• Access: Student records (attendance, belt level, promotion history) are accessible only to the student's parent or guardian, the student themselves (if age-appropriate), and authorized school staff (instructors and administrators).
• No third-party disclosure: We do not disclose individual student records to third parties without written consent from a parent or guardian, except as required by law.
• Correction: Parents and guardians may request corrections to inaccurate records at any time.

Aggregate, de-identified attendance or program statistics may be used internally or in public communications about the school's programs without identifying individual students.

Our Services integrate the following third-party providers that may independently process data:

• Neon (database hosting) — Student records and attendance data are stored in a PostgreSQL database hosted by Neon, Inc. Neon operates US-based data centers. See neon.tech/privacy.
• Vercel — Our website and API are hosted on Vercel's infrastructure. See vercel.com/legal/privacy-policy.
• Google Drive — Curriculum video resources are hosted in a Google Drive folder managed by Westy 5280 staff and streamed through our API. Student accounts are used only to authenticate access; no student data is sent to Google Drive.
• Google (OAuth) — Admin panel login uses Google OAuth. This applies to school staff only, not students or parents.
• Gmail — Login verification codes and contact form notifications are sent via Gmail. Email addresses used for OTP are transmitted to Google's servers for delivery only.
• Vimeo — We embed video content on the public website. When you interact with embedded videos, Vimeo may collect information per their own privacy policy (vimeo.com/privacy).
• Facebook / Instagram / YouTube — Links to our social media pages are provided. Clicking these links will take you to third-party platforms subject to their own privacy policies.
• Meta Conversions API (optional server-side measurement) — If the booking adult does not opt out, we may send a completed free-class booking event directly from our server to Meta. We use only the booking adult's name, email address (if provided), and phone number after normalization and SHA-256 hashing, plus limited campaign/request context for the original booking. We never send a child's name, age, school records, or free-text notes. No Meta browser Pixel or Meta advertising cookie is used on our Services.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt out of the sale of your personal information. We do not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us using the information in Section 11. We will respond to verifiable consumer requests within 45 days.

We retain personal information for as long as a student is enrolled at the academy, plus a reasonable period afterward for record-keeping purposes (typically 3 years post-enrollment). Contact form submissions are retained only as long as needed to respond to your inquiry.

Parents, guardians, or adult students may request deletion of their records at any time. We will fulfill deletion requests within 30 days except where retention is required by law or legitimate operational need (e.g., donation acknowledgment records).

We implement reasonable administrative, technical, and physical safeguards to protect your personal information:

• All data is transmitted over HTTPS (TLS)
• Database access is restricted to the API server via authenticated connections
• Mobile app login tokens are stored in device-secure storage (iOS Keychain / Android Keystore)
• Admin access requires Google OAuth authentication; student access uses time-limited one-time codes
• Rate limiting is applied to login and contact endpoints to prevent abuse

No method of electronic storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law.

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically to stay informed about how we are protecting your information.

Your continued use of the Services after any modifications constitutes your acknowledgment of the modified policy.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices — including requests to access, correct, or delete student records — please contact us: