Your school’s data is not our advertising product.

This notice covers dojowizard.com, Dojo Wizard accounts, public school pages and forms, authenticated school tools, the invited member or guardian portal, support, professional services, Growth Autopilot, and Instructor Exchange inquiries. A third-party service linked from Dojo Wizard has its own notice.

For account registration, website operations, security, support, APPWZRD LLC billing, product administration, and Instructor Exchange review, APPWZRD LLC determines why and how information is used and acts as a business or controller where those terms apply. For member, guardian, lead, attendance, rank, waiver, class, campaign, and similar data a school submits for its own purposes, the school generally controls the data and APPWZRD LLC acts as its service provider or processor.

• Account and authentication: name, email, role, password credential managed by the authentication system, legal-acceptance version and time, invitation and verification records, session token, session IP address, user agent, and timestamps.
• School and public profile: legal or public name, slug, contact details, phone, website, logo URL, address, timezone, locations, disciplines, programs, ranks, schedules, offers, plans, products, descriptions, announcements, and publication settings.
• Members, households, and guardians: names, contact details, birth date when supplied, status, household and guardian relationships, enrollment, attendance, check-in and reservation history, rank and promotion records, membership status, private lesson and event records, portal invitations, and QR-linked identifiers.
• Waiver evidence:the school's waiver text and version, signer name and email, stated relationship, typed-signature and consent evidence, status, method, recorder, and timestamps. Dojo Wizard does not determine whether a waiver is legally sufficient or enforceable.
• Leads and trials: student or guardian name, age group, email, phone, preferred contact method and time, program or offer interest, source, campaign, referring page, trial and pipeline history, assignments and follow-up tasks, direct-response consent, and optional separate email or SMS marketing consent.
• Communications: school sender settings and address, consent and revocation evidence, destination, email HTML or text and SMS content, schedule, provider identifier, delivery, bounce, complaint, unsubscribe, STOP or START, error, and webhook records. An inbound SMS command may be processed without retaining the full inbound body.
• Payments: Stripe connected-account and customer identifiers, member and plan references, subscription, invoice, payment and dispute status, operation and webhook records; source-system identifiers and source-reported historical invoice, payment, refund, credit, fee, dispute, adjustment, write-off, and balance-snapshot metadata; and—if APPWZRD LLC platform billing is later enabled—plan and active-student-count data. Imported history may include source status and dates, amounts, currency, invoice and plan references, paid-through date, broad payment-method category, descriptions, member mappings, deliberate exclusion reasons, source attribution, and upload or approval actor references. Payment credentials and full or partial card or bank numbers are not permitted in imports and are intended to remain with the payment processor.
• Growth workflows: rules-based priorities derived from attendance, lead, trial, membership, billing-status, capacity, event, and KPI records; evidence and context snapshots; estimated or recorded impact; tasks, assignees, due dates, notes, snoozes, dismissals, completions, and actor history.
• Staff Academy: lesson and version, progress, score, completion, application notes, evidence, and manager signoff. Managers may see team names, emails, roles, and course progress.
• Event campaigns: playbook and campaign drafts, audience, offer, brand, price, capacity and budget inputs, owner, approvals, scheduled dates, task status, and audit history. Current pilot workflows create internal drafts and do not prove external publishing, sending, or spending.
• Instructor Exchange: requesting school and staff contact, discipline, audience, date and timezone, location, budget, fee and travel inputs, instructor or offering snapshots, notes, proposed commission acknowledgement, status, cancellation, and audit history. Authorized APPWZRD LLC administrators review inquiries across schools for manual follow-up.
• ClassPass when enabled: school and venue name, address and contact details, class descriptions, schedules, capacity, reservation and cancellation identifiers, guest name and contact details, spot, status, and attendance.
• Support, migration, and professional services: messages, files, screenshots, project scope, source system and account reference, source file name, file size and one-way file hash, normalized imported rows, member mappings, reconciliation status, approvals, and troubleshooting information supplied by the customer. The signed-in standardized billing-history upload is parsed in memory; its original bytes are not retained by the import workflow.
• Technical and security data: requests, timestamps, routes, device and browser information, server and provider logs, errors, security events, and a salted, one-way request fingerprint derived from network and browser data for public-form abuse prevention. It enforces a 15-minute submission limit, becomes eligible for cleanup after 24 hours, and is not used for advertising, identification, or cross-site tracking.

We receive information directly from account holders, schools, public-form visitors, members, guardians, staff, support contacts, and professional-services customers; from authorized users acting for those people; automatically from browsers, devices, and the Service; from a referring page or campaign link; and from enabled providers such as Stripe, ClassPass, AWS SES, Twilio, and Inngest; and from prior-platform exports or archives that an authorized school user provides for migration.

• Provide, authenticate, configure, support, and improve the Service.
• Keep each school’s records scoped to authorized users and portal relationships.
• Run schedules, attendance, ranks, leads, events, payments, and customer instructions.
• Create internal growth priorities, training progress, campaign drafts, and manual Instructor Exchange review with human approval boundaries.
• Deliver enabled communications, reservations, and integration events and record consent, delivery, cancellation, suppression, or attendance status.
• Prevent abuse, troubleshoot errors, protect data, and investigate security incidents.
• Administer subscriptions and professional services if separately activated.
• Comply with law, enforce agreements, resolve disputes, and protect legal rights.

Growth Autopilot currently uses deterministic business rules and customer records to prioritize possible actions; it is not a general-purpose AI decision-maker. Its estimates and recommendations require human review and are not used by APPWZRD LLC to make legal, employment, credit, insurance, housing, education, safety, or other similarly consequential eligibility decisions about a person.

We do not use school member data to train general-purpose AI models. Before enabling a feature that sends personal information to an AI provider or uses it for a materially new purpose, we will update the applicable notice, product status, provider review, and customer controls.

We may disclose information to:

• The school that controls the record and its authorized staff, members, or guardians.
• Infrastructure and service providers for hosting, database, authentication, payments, email, SMS, workflow execution, security, support, and professional services.
• Stripe, ClassPass, and another integration partner when an authorized customer enables the integration or requests the transaction.
• Prospective instructors, schools, or their representatives when reasonably needed to evaluate or coordinate an Instructor Exchange request and subject to manual review.
• Professional advisers, insurers, auditors, and transaction counterparties.
• Courts, regulators, law enforcement, or other parties when legally required or reasonably necessary to protect rights, safety, security, and the integrity of the Service.
• A successor in a merger, financing, acquisition, restructuring, or sale, subject to appropriate confidentiality and notice obligations.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not offer a financial incentive in exchange for personal information.

The current production service uses Vercel for web hosting and deployment and Supabase for managed Postgres infrastructure. Stripe processes connected payments when a school is approved and activates billing. AWS SES, Twilio, and Inngest support email, SMS, and background workflows only when their release gates are enabled. ClassPass receives and returns integration data only after platform certification and school activation. Email forwarding and professional advisers may process messages sent to published contact addresses. Provider scope and status can change; material additions that process school personal data are handled under the applicable agreement and notice process.

Dojo Wizard currently uses essential authentication and security cookies. A protected sales training area may set an HttpOnly, same-site access cookie for up to 30 days and store course progress locally in that browser until it is cleared. We do not currently use advertising cookies or third-party behavioral analytics, so a nonessential-cookie consent banner is not shown.

Browser Do Not Track signals do not change this essential processing because the current site does not perform cross-site behavioral tracking. Because we do not sell or share data for targeted advertising, a Global Privacy Control signal is not needed to opt out of those activities. If those practices change, we will add the required controls before launch.

The check-in scanner uses the device camera to read a QR identifier; Dojo Wizard does not intentionally retain the camera image or video. A school-selected logo or link may load from an external host, which can receive ordinary request information under its own privacy terms.

We retain school and account information while needed to provide the Service and afterward as reasonably necessary for an assisted export or offboarding process. We may retain transaction records, consent and suppression evidence, waiver and actor history, security logs, Instructor Exchange history, support records, disputes, and legally required records for longer because deletion could impair safety, auditability, rights, or compliance. Provider backups expire through ordinary protected backup cycles.

The signed-in standardized billing-history import does not retain the original uploaded CSV bytes. It retains normalized, whitelisted source-history rows plus provenance, mappings, reconciliation, and approval evidence so the school can review the import and preserve its source context. Files separately provided for an agreed professional service are handled under the applicable service order and retention instructions. The school should preserve its original source export or archive as the authoritative record.

School owners can export member and lead data in available CSV formats. Broader export and account-deletion requests are currently assisted rather than fully self-service. Retention depends on the record’s purpose, sensitivity, account status, contractual instructions, provider cycles, security need, and legal obligations; we do not claim that every category is deleted on one universal schedule. Requests may be sent to privacy@dojowizard.com.

Dojo Wizard is sold to schools and is not intended for a child under 13 to create or operate an independent account. Schools must configure guardian access, provide required notices, obtain appropriate authority, and avoid collecting more information about a minor than is needed. APPWZRD LLC remains responsible for obligations that applicable law places directly on the operator.

A parent or guardian asking about a school-controlled record should usually contact the school first. We will help the school respond to verified access, correction, deletion, or further-collection requests when required. If you believe a child supplied information without appropriate authorization, contact us so the account and record can be reviewed.

We use administrative, technical, and organizational safeguards appropriate to the current service, including tenant-scoped database controls, role-based access, encrypted transport, managed secrets, signed provider callbacks, and security testing. No system is perfectly secure, and we do not claim SOC 2, ISO 27001, HIPAA, or another certification that has not been completed. More detail is available on the security page.

Information is primarily processed in the United States. A provider may process limited information in another location where it operates. Additional transfer terms will be used when required for a customer or jurisdiction.

Account holders can update certain information in the Service, and schools can correct many school-controlled records. Depending on where you live and which law applies, you may have rights to know or access, correct, delete, or obtain a copy of personal information; restrict or object to processing; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain sensitive-data uses; use an authorized agent; appeal a decision; and receive equal service without unlawful discrimination.

Submit a request to privacy@dojowizard.com with enough information for us to identify the relevant account or school. We may verify identity, authority, and scope before acting. When a school controls the record, we may send the request to that school and assist with its response. We will explain a denial or appeal path when applicable law requires it.

Account and security notices may be necessary to provide the Service. Commercial email must include the required opt-out method, and enabled school messaging must honor applicable unsubscribe, STOP, and other reasonable revocation requests. A direct response to an inquiry and optional recurring marketing are treated as separate choices. Carrier message and data rates may apply to SMS.

Privacy questions, complaints, and verified requests may be sent to privacy@dojowizard.com. General support is available through the support page. Please do not email passwords, full card data, government identification, or unnecessary member information.

We will post a new effective date when this notice changes and provide additional notice or obtain consent when required by law. We review the notice at least annually and when a material product or data-practice change launches.