Privacy policy

1. Who is responsible

DojoTally is a service provided from Argentina. You can reach us at admin@dojotally.com.

Our role depends on the data:

• We are the controller of the data of people who use this site, contact us or create an academy (owners, administrators and staff), and of subscription billing data.
• We are a processor of the data each academy enters about its students, parents and contacts, and of the messages the agent handles on the academy's behalf. There the academy is the controller: we process the data only to provide the service and following its instructions.

2. What data we process

Academy owners, administrators and staff

• Name, email, phone or WhatsApp, role and permissions within the academy.
• Academy details: name, city, disciplines, schedules, plans and prices; and, if you use electronic invoicing, tax details.
• App usage data: logins, actions taken, IP address, browser and device, for security and support.

Students and contacts entered by the academy

• Name, ID number, date of birth, phone, email, parent or guardian contact details, plan, belt or rank, attendance, dues, payments and balances.
• Other data the academy chooses to record, such as notes or health information relevant to training (for example, allergies or injuries). This is sensitive data: the academy should enter it only when necessary and with the person's explicit consent.

WhatsApp, Instagram and Messenger messages

• When the academy turns on the agent, we process the messages it receives and sends on those channels: profile name, phone number or username, message content (text and, where applicable, audio or images) and date and time.
• With those messages the agent answers questions, books trial classes and records payments for the academy to review.

MercadoPago payments

• Subscription payments to DojoTally and the academy's dues are processed by MercadoPago. We don't store card numbers or full payment method details.
• We receive from MercadoPago the payment status, amount, date, a transaction ID and basic payer details.

Visitors to this site

• The data you enter in the contact form (name, email, WhatsApp, academy, number of students and your message).
• Technical data your browser sends when loading a page (IP address, browser), processed by our hosting, web font and anti-spam providers.

3. What we use it for

• Providing the service: creating and running the academy, managing students, dues, attendance, trial classes, shop and events.
• Running the AI agent on the channels the academy connects.
• Billing the subscription and, if the academy turns it on, issuing electronic invoices through ARCA (Argentina).
• Sending essential service emails: sign-ups, payment notices, reminders and important changes.
• Answering questions, providing support and helping migrate data from another system.
• Protecting the service: preventing fraud, spam and unauthorized access.
• Improving DojoTally using aggregated usage data.
• Meeting legal, accounting and tax obligations.

We don't sell personal data or use it for third-party advertising.

4. Legal basis

• Performance of the contract with the academy (the Terms of service), to provide and bill the service.
• Consent, when you write to us through the form, or when the academy obtains its students' consent to enter their data and message them on WhatsApp or Instagram.
• Legal obligations, such as accounting and tax rules.
• Legitimate interest, for service security, fraud prevention and product improvement, provided your rights don't override it.

For student data, the academy, as controller, must have the appropriate legal basis.

5. Providers (sub-processors)

We share data only with the providers we need to run the service, who process it on our behalf under confidentiality and security obligations:

Meta and MercadoPago also process data as independent controllers under their own privacy policies. We may also disclose data when required by law or a competent authority.

6. International transfers

Several of our providers are outside Argentina, mainly in the United States, so data is transferred to those countries. To protect it we use providers with contractual data protection commitments and recognized security measures and, where required, international transfer clauses under Argentine law (Law 25,326 and AAIP regulations), Brazil's LGPD and other applicable rules.

7. How long we keep it

• Academy and student data: while the account is active. If the academy cancels or asks to close the account, we keep it for 30 days so it can request an export, and then delete it. Backups are overwritten within the following 30 days.
• Messages processed by the agent: while the account is active, so the academy can see the history, unless the academy or the person asks for earlier deletion.
• Contact form enquiries: up to 24 months from the last contact, unless you ask for earlier deletion.
• Subscription billing and payment records: as long as accounting and tax rules require (in Argentina, up to 10 years).
• Technical and security logs: up to 12 months.

8. Your rights

You can ask for access to your data, its correction or update, its deletion, object to processing or withdraw your consent. To do so, email admin@dojotally.com from the associated address or tell us how we can verify your identity.

• Argentina (Law 25,326): access is free if exercised at intervals of no less than six months, unless a legitimate interest is shown. We answer access requests within 10 calendar days and correction or deletion requests within 5 business days.
• Brazil (LGPD, Law 13,709/2018): you can also request confirmation of processing, portability, anonymization, information about who we share data with and review of automated decisions. You can complain to the ANPD.
• Other countries: we recognize rights equivalent to those of the EU General Data Protection Regulation (access, rectification, erasure, restriction, portability and objection) and respond within one month.

If you are a student of an academy, the academy is the controller of your data: it's best to ask it first. You can also write to us and we will resolve it together with the academy.

9. Children's data

DojoTally is not directed at minors and minors cannot create an academy. Many academies have students under 18: their data is entered by the academy, which must have consent from a parent or guardian. We recommend messaging minors through the responsible adult. If you are the responsible adult and want to access or delete a minor's data, write to the academy or to us.

10. Security

• Encrypted connections (HTTPS) and data stored on servers with access controls.
• Separation of each academy's data and role-based permissions for staff.
• Regular backups.
• Internal access limited to the people who need it, under confidentiality obligations.
• Anti-spam checks on public forms.

No system is 100% secure. If an incident affects your data, we notify the academy, the people affected and the authorities where required.

11. Cookies and local storage

This site does not use advertising or analytics cookies and does not track you across sites. It only stores these preferences in your browser (local storage):

• dt_lang: the language you chose, so we don't redirect you to another one.
• dt_currency: the currency you prefer for prices.
• dt_nf_from (only during the visit): the address that wasn't found, to suggest the right page.

The contact form uses Cloudflare Turnstile to check that you're not a robot; Cloudflare may process technical browser and connection data for that. Typefaces are loaded from Google Fonts. The app (app.dojotally.com) uses the cookies or technical storage needed to keep you logged in.

You can delete this data from your browser settings; the site keeps working without it.

12. Changes to this policy

We may update this policy. If a change is significant, we notify academies by email or in the app before it applies. The date of the last update is shown at the top of this page.

13. Contact and supervisory authority

For questions or to exercise your rights, email admin@dojotally.com or use the contact form.

In Argentina, the data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, under article 14(3) of Law 25,326. The Agency for Access to Public Information (AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA), as the supervisory authority under Law 25,326, handles complaints from anyone whose rights are affected by a breach of personal data protection rules.