PRIVACY POLICY

1. Introduction

This Privacy Policy describes how Combat Studio ("we", "us", or "our") collects, uses, stores, and protects personal information when you visit combatstudio.lk or use the Combat Studio management platform.

By using our website or service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Information you provide to us:

• Contact form submissions: full name, email address, phone number, academy name, country, number of students, plan preference, and any message you include
• Account setup: studio name, login credentials (password is hashed and never stored in plain text), email address

Information collected automatically:

• Standard server access logs (IP address, browser type, page visited, timestamp) — retained for a maximum of 30 days
• Session cookies necessary for login functionality — no tracking cookies

Studio member data: Data that studio owners enter into the platform about their students (names, contact details, attendance, fee records) is entered and owned by the studio. We process this data solely to provide the service.

3. How We Use Your Information

• To respond to your enquiry, typically within 24 business hours
• To create and manage your Combat Studio account
• To send account-related communications (login credentials, billing, service updates)
• To provide and maintain the Combat Studio service
• To monitor and improve platform performance and security

We do not use your information for advertising, profiling, or any purpose unrelated to delivering the Combat Studio service.

4. Data Storage and Security

Isolation architecture: Each studio account operates on its own completely isolated database. It is technically impossible for one studio to access another studio's member records, fee data, or attendance history.

• All data is transmitted over HTTPS (TLS encryption)
• Passwords are hashed using industry-standard bcrypt — no plain-text passwords are stored
• Database files are stored on the hosting server and blocked from direct web access via server configuration
• Contact form submissions are handled by FormSubmit.co, an encrypted email forwarding service

5. Data Sharing and Disclosure

Limited disclosure may occur only in the following circumstances:

• FormSubmit.co: Our contact form uses FormSubmit.co to deliver form submissions to our email inbox. They process the submission data for delivery purposes only and do not store it beyond temporary transmission caching. See FormSubmit.co's privacy policy.
• Legal requirements: If required by applicable law, court order, or government authority, we may disclose information as necessary. We will notify you where legally permitted to do so.
• Business transfer: In the event of a merger, acquisition, or sale of business assets, user data may be transferred as part of that transaction. You will be notified in advance.

6. Studio Member Data (Data Processor Role)

When a studio owner enters data about their students into Combat Studio, the studio owner acts as the data controller and Combat Studio acts as the data processor. This means:

• The studio owns and is responsible for the student data they collect
• We process that data only on the studio's behalf, solely to deliver the software service
• We never access, analyse, sell, or use studio member data for any purpose outside of providing and maintaining the service
• Studios may export or delete their data at any time

7. Cookies

We use only essential session cookies required for login functionality. These cookies:

• Are deleted when you close your browser (session cookies)
• Do not track your activity across websites
• Are not used for advertising or analytics
• Are not shared with third parties

We do not use Google Analytics, Facebook Pixel, or any other tracking or advertising technology.

8. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated personal data
• Portability: Export your studio data (members, fees, attendance) at any time in CSV format directly from the platform
• Objection: Object to processing of your data in specific circumstances

To exercise any of these rights, contact us at hello@combatstudio.lk. We will respond within 5 business days.

9. Data Retention

We retain your account data for as long as your subscription is active. Upon account cancellation, you will have 30 days to export your data. After 30 days, data is securely deleted from our servers. Server access logs are deleted after 30 days. Contact form submissions are retained in your email inbox only.

10. Children's Privacy

The Combat Studio platform is intended for use by studio owners and staff aged 18 or older. We do not knowingly collect personal information from individuals under 18. If you believe a minor has submitted personal data to us, please contact hello@combatstudio.lk and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions, data requests, or concerns, please contact:

• Email: hello@combatstudio.lk
• Website: combatstudio.lk