Privacy Policy

KombatDesk LLC · Last updated: July 27, 2026

This Privacy Policy for KombatDesk LLC ("KombatDesk," "we," "us," or "our"), a Colorado limited liability company doing business as KombatDesk, describes how and why we collect, use, store, and share ("process") personal information when you use our services (the "Services"), including when you:

• Visit our website at www.kombatdesk.com or any of our pages that link to this Privacy Policy;
• Create an account for, subscribe to, or use the KombatDesk platform — a gym management platform for independent MMA and BJJ gym owners that provides member management, class scheduling and attendance tracking, a check-in kiosk, SMS messaging related to membership and attendance, and subscription billing; or
• Engage with us in other related ways, including sales calls, demos, and customer support.

This Privacy Policy applies to two groups of people: gym owners (our customers, who create accounts and subscribe to the Services) and gym members (individuals whose information is entered into the Services by their gym). If you are a gym member, please also read Section 4, "Member Information and the Member Opt-In Page," which explains how your information reaches us and who is responsible for it.

Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us at kombatdesk@outlook.com.

Summary of Key Points

• What we collect: Account and contact information from gym owners; member roster information (such as names, phone numbers, and attendance) entered by gym owners; the name, phone number, IP address, and browser user agent of a member who opts in to text messages through our member opt-in page; billing information processed by Stripe; and a small amount of technical data collected automatically to keep the Services secure.
• We do not sell personal information. We do not sell or share personal information for targeted or cross-context behavioral advertising, and we have not done so in the preceding 12 months.
• We do not use analytics or advertising trackers. We do not run a product analytics service, we do not use advertising or targeting cookies, and we do not track you across other websites. See Sections 2 and 7.
• We do not collect sensitive personal information such as health data, biometric identifiers, government ID numbers, or precise geolocation.
• Service providers only: We disclose personal information only to service providers that process it on our behalf to run the Services (listed by name in Section 6), and as required by law.
• SMS messages: The Services send text messages related to membership and attendance. Automatic messages are limited to one per member per 7-day period. Reply STOP at any time to opt out. See Section 9.
• Your rights: Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information. See Sections 13 and 14.

1. What Information Do We Collect?

Personal information you provide to us

We collect personal information that you voluntarily provide when you register for the Services, subscribe to a plan, or contact us. This includes:

• Contact and account information: your name, email address, and account credentials managed through our authentication provider (we do not store raw passwords ourselves — see Section 6);
• Gym/business information: your gym's name and related account details;
• Billing information: your billing address and payment card details, which are collected and processed directly by our payment processor, Stripe. KombatDesk does not receive or store full payment card numbers;
• Communications: information you provide when you contact support, participate in a demo, or otherwise correspond with us.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to it.

2. Information Collected Automatically

We do not use a product analytics service, an advertising network, or any cross-site tracking technology. The information collected automatically when you use the Services is limited to what is needed to deliver and protect them:

• IP address: the network address a request comes from. We use it in two ways. First, to apply rate limits that protect our checkout, account-recovery, check-in, and member opt-in pages from automated abuse; these rate-limit counters are stored keyed to the IP address and are not linked to an account. Second, where a gym member opts in to text messages through our member opt-in page, we record the IP address the opt-in was submitted from as part of that member's consent record (see Section 4).
• Browser user agent: the identifying string your browser sends with a request. Where a gym member opts in to text messages through our member opt-in page, we record it as part of that member's consent record (see Section 4).
• Request and server logs: our hosting and backend providers (Vercel and Convex — see Section 6) process standard request metadata, including IP address, timestamp, and the page or endpoint requested, in order to route traffic, keep the Services available, and investigate errors and abuse.

We do not infer your location from your IP address, we do not collect precise geolocation (such as GPS coordinates), and we never request access to your device's location services. See Section 7 for information about cookies and similar technologies.

3. Information from Google Sign-In

Our Services allow you to register and sign in using your Google account. When you choose to sign in with Google, we receive basic profile information from Google, such as your name and email address, which we use solely to create and authenticate your KombatDesk account.

KombatDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use information received from Google APIs for advertising, and we do not sell it or transfer it to third parties except as necessary to provide and improve the sign-in functionality described here.

4. Member Information and the Member Opt-In Page

Information your gym gives us. Most personal information we hold about gym members is entered by the gym or academy account holder ("Customer"). It may include names, phone numbers, email addresses, membership plan and status, belt rank and promotion history, class enrollments, attendance and check-in records, and records of SMS consent and opt-out status. We also derive, from a member's attendance record, whether that member appears to have stopped attending, so that their gym can follow up with them; where a member returns after receiving a message, we record that return.

Information you give us directly through the member opt-in page. KombatDesk hosts an opt-in page for each gym, at a web address of the form kombatdesk.com/consent/<your-gym>, which gyms share with their members. If you use that page, you submit your name and phone number to KombatDesk directly. When you do, we also record the date and time of your submission, the exact consent wording that was displayed to you and the version of that wording, the IP address the submission came from, and your browser's user agent string. We keep that record as evidence that an opt-in took place. It is stored by KombatDesk on our own systems, and we will provide a copy of it to your gym, or to you, on request.

The Customer is responsible for providing members with any privacy notices required under applicable law and for obtaining any consents necessary before submitting member information to KombatDesk — including express consent to receive text messages, as described in Section 9 and in our Terms of Service. KombatDesk processes member information solely on the Customer's behalf and at the Customer's direction, consistent with the Terms of Service. Members with questions about how their information is used should contact their gym directly; KombatDesk will assist Customers in responding to member requests where required by law.

5. How Do We Use Your Information?

We process personal information for the following purposes:

• To deliver and facilitate delivery of the Services — including managing accounts, member rosters, class schedules, attendance and check-ins, and sending membership- and attendance-related text messages on Customers' behalf;
• To fulfill and manage orders and subscriptions — including processing payments and managing billing through Stripe;
• To send administrative information — such as account notices, billing receipts, security alerts, and notices of changes to our terms and policies;
• To respond to inquiries and offer support;
• To request feedback about the Services;
• To evaluate and improve our Services — using the feedback you give us and our own review of how the Services are performing, not analytics tracking;
• To protect our Services — including fraud monitoring, abuse prevention, rate limiting, and security operations;
• To comply with our legal obligations — including tax, accounting, telecommunications-consent, and lawful-request obligations.

We do not use personal information to send third-party marketing, to build advertising profiles, to make automated decisions that produce legal or similarly significant effects about individuals, or for any form of targeted advertising.

6. When and With Whom Do We Share Your Information?

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We do not share personal information for cross-context behavioral or targeted advertising.

We disclose personal information only in the following circumstances:

Service providers

We share personal information with third-party vendors and service providers that perform services on our behalf and are permitted to use it only as necessary to provide those services to us:

Some of these providers use their own infrastructure suppliers to deliver their service to us — for example, the bot-protection and fraud-detection systems that run on Clerk's sign-in pages and Stripe's checkout pages. Those suppliers are named in our Cookie Policy where they set a cookie you would encounter.

Other disclosures

• Business transfers: in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business, in which case the recipient will be bound by this Privacy Policy or one that is at least as protective;
• Legal obligations: where required to comply with applicable law, governmental requests, judicial proceedings, or court orders, or to protect the rights, property, or safety of KombatDesk, our users, or others.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for one limited purpose: essential cookies that keep you signed in and secure your session, set by our authentication provider, Clerk, together with the security and bot-protection cookies that Clerk's and Stripe's own infrastructure sets on the sign-in and checkout pages they serve. We do not use analytics cookies, and we do not use advertising, targeting, or social media cookies, pixels, or plugins.

For more detail about the specific technologies we use and how to manage them, see our Cookie Policy. Most browsers also allow you to remove or reject cookies through browser settings; doing so may affect the availability and functionality of the Services (for example, you may not be able to stay signed in).

8. Payments

All payments are processed by Stripe. When you subscribe to a plan, your payment card details and billing address are provided directly to Stripe through its secure checkout; KombatDesk receives confirmation of the transaction, your subscription status, and limited billing metadata, but never receives or stores full payment card numbers. Stripe's handling of your information is governed by the Stripe Privacy Policy.

9. SMS Text Messaging

The Services send SMS text messages to gym members on behalf of their gym. These messages are membership and attendance-related notices and replies to messages a member sends us — for example, a check-in message when a member has not attended class recently. We do not send marketing or promotional text messages.

• Consent: A member's number is only messaged once consent has been recorded, by one of two routes: the member opts in themselves through the member opt-in page described in Section 4, or the gym confirms to us that it has already obtained that member's consent directly. Where the gym confirms it, the gym is responsible for having obtained that consent, as described in Section 4 and in our Terms of Service.
• Frequency: Automatic retention messages are limited to one per 7-day period per member. Up to 5 automated msgs/month. Messages a gym owner sends manually are delivered through the same automated retention system and are subject to the same per-member limits, so they are included in that total rather than added to it.
• The number messages are sent from: KombatDesk currently sends messages for every gym on its platform from a single shared phone number. There is a practical consequence you should know about. Because opting out is tied to that phone number, replying STOP stops messages from every gym that uses KombatDesk, not only the gym whose message you received — and replying START resumes them for every such gym. If you train at more than one gym that uses KombatDesk and want to stop messages from only one of them, contact that gym directly.
• Opt-out: Members may opt out at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any message, and may opt back in by replying START, YES, or UNSTOP. Opt-out status is recorded and honored across the Services. Members can reply HELP for assistance, or contact us using the details in Section 18.
• Rates: Message and data rates may apply, depending on the member's mobile carrier and plan.

Phone numbers and SMS consent status are shared with Twilio solely to deliver messages, and are not used for any other purpose or shared with any other party for their own use.

10. How Long Do We Keep Your Information?

We keep personal information for as long as the associated account remains open with us, and thereafter only as long as necessary to comply with our legal obligations (for example, tax and accounting requirements and records of SMS consent and opt-outs), resolve disputes, and enforce our agreements.

SMS consent and opt-out records. Where a member opts in through the member opt-in page, the consent record described in Section 4 — including the wording shown, the date and time, the IP address, and the browser user agent — is kept for as long as we may need it to show that the opt-in took place. Opt-out records are kept indefinitely, so that an opt-out continues to be honored even if the underlying member record is deleted.

Rate-limiting records. The abuse-prevention counters described in Section 2 are keyed to an IP address and are not linked to an account. They are kept on our backend for security purposes only.

You may request deletion of your personal information at any time as described in Section 19. When a gym's account is closed, the gym may request deletion of its data, including its members' records; we will honor such requests except where retention is required by law (for example, we retain SMS opt-out records so that opt-outs continue to be honored).

11. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process, proportionate to our size and the nature of the data. These measures include:

• Access controls: every gym's data is isolated to that gym's account, and access rules are enforced on our servers — not just in the user interface. There is one deliberate exception, described in Section 9: an SMS opt-out is applied to every record holding that phone number, across gyms, so that an opt-out is never missed;
• Authentication: account credentials are managed by our dedicated authentication provider (Clerk); KombatDesk does not store raw passwords;
• Verified integrations: inbound requests from our payment and messaging providers are cryptographically verified before being processed;
• Abuse prevention: rate limiting and input validation on our application endpoints;
• Infrastructure: the Services run on established managed platforms that encrypt data in transit and at rest;
• Payment isolation: full payment card numbers are handled exclusively by Stripe and never touch our systems.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will never be able to defeat our security. Transmission of personal information to and from our Services is at your own risk; you should access the Services only within a secure environment.

12. Do We Collect Information from Minors?

The Services are a business tool intended for use by gym owners who are at least 18 years old. We do not knowingly collect personal information directly from, and the Services are not directed to, children.

Gyms may enter roster information about members who are minors (for example, youth program participants). In that case, the gym — as the party with the direct relationship with the member and their family — is responsible for obtaining any parental or guardian consent required under applicable law, including laws that protect minors under 18 such as Colorado law, before submitting a minor's information or enrolling a minor's phone number for text messages.

If we learn that we have collected personal information directly from a child in violation of this policy, we will delete it promptly. If you believe this has occurred, contact us at kombatdesk@outlook.com.

13. What Are Your Privacy Rights?

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• The right to know and access the personal information we process about you;
• The right to correct inaccuracies in your personal information;
• The right to delete your personal information;
• The right to obtain a portable copy of your personal information;
• The right to opt out of the sale of personal information, targeted advertising, and certain profiling — noting that we do not engage in any of these practices;
• The right not to receive discriminatory treatment for exercising your rights.

Exercising your rights

To exercise any of these rights, contact us using the details in Section 18 — email is the fastest route. We will need to verify your identity before acting on a request, which we typically do by matching the request to the email address or phone number associated with the account or member record. An authorized agent may submit a request on your behalf with proof of authorization; we may still need to verify your identity directly.

We will respond to verifiable requests within the timeframe required by applicable law (generally within 45 days, with a permitted extension where reasonably necessary, in which case we will tell you).

Members

If you are a gym member, we may refer your request to your gym or work with your gym to fulfill it, since your gym controls the roster in which your information appears. You may always opt out of text messages directly by replying STOP, without going through your gym.

Appeals

If we decline to take action on your request, you may appeal our decision by replying to our response or emailing kombatdesk@outlook.com with the subject line "Privacy Appeal." We will respond to appeals within the timeframe required by applicable law. If your appeal is denied and you are a Colorado resident, you may contact the Colorado Attorney General at coag.gov; residents of other states may contact their state Attorney General.

14. United States State Privacy Notices

This section supplements the rest of this Privacy Policy and applies to residents of U.S. states with comprehensive privacy laws (including California, Colorado, Connecticut, Texas, Virginia, Utah, and others). The rights described in Section 13 apply to you to the extent your state's law provides them.

Categories of personal information we collect

In the preceding 12 months, we have collected the following categories of personal information (as those categories are defined under California law and similar state laws):

Sources: directly from gym owners; from gyms (for member information); directly from gym members who use our member opt-in page; automatically from requests made to the Services; from Google when you use Google Sign-In; and from Stripe (transaction confirmations).

Purposes: as described in Section 5. Disclosures: to the service providers listed in Section 6, for business purposes only.

No sale or sharing: We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We do not use or disclose sensitive personal information. We do not process personal information for profiling in furtherance of decisions that produce legal or similarly significant effects, and we do not offer financial incentives in exchange for personal information.

15. Do-Not-Track and Opt-Out Preference Signals

Most web browsers include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing and implementing DNT signals has been finalized, and we do not currently respond to DNT browser signals.

Some browsers also transmit opt-out preference signals such as the Global Privacy Control ("GPC"). Because we do not sell personal information or process it for targeted advertising, there is no sale or targeted-advertising activity for such signals to opt you out of. If our practices ever change, we will update this Privacy Policy and honor applicable opt-out preference signals as required by law.

16. Data Breach Notification

If a security incident results in unauthorized access to personal information, we will investigate, take reasonable steps to mitigate harm, and notify affected individuals and regulators as required by applicable law — including Colorado's data breach notification statute (C.R.S. § 6-1-716) and the breach notification laws of other affected states — without unreasonable delay and within the timeframes those laws require.

17. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last updated" date at the top of this page. If we make material changes, we will notify account holders by email at least 14 days before the changes take effect. Changes required for security reasons or by law or court order may take effect immediately upon notice. We encourage you to review this Privacy Policy periodically.

18. How to Contact Us

If you have questions or comments about this Privacy Policy, or wish to exercise your privacy rights, you can reach us at:

KombatDesk LLC
Colorado Springs, Colorado, United States
Email: kombatdesk@outlook.com
Phone: (719) 229-8105

19. How to Review, Update, or Delete Your Data

Gym owners can review and update most account information directly in their account settings. To request access to, correction of, a copy of, or deletion of personal information we hold — whether you are a gym owner or a gym member — email kombatdesk@outlook.com with the subject line "Privacy Request," or call (719) 229-8105. We will verify and respond to your request as described in Section 13.