Privacy Policy

This Privacy Policy explains how Silk Road Merchants LLC ("we", "us", "our") handles information through the martialcrm.com website (the "Website") and the MartialCRM school management service at app.martialcrm.com (the "Service"). MartialCRM is a product of Silk Road Merchants LLC.

The short version: we collect only what we need to run the Website and the Service, we never sell personal information, and we never use it for advertising.

1. Our role and the school's role

Martial arts schools ("Schools") use the Service to manage information about their students, prospective students, parents and guardians, and staff ("School Data"). The School decides what School Data to collect and how to use it. We store and process School Data only to provide the Service to that School and as the School instructs. If you are a student or parent and have a question about your information, please contact your School first. We will help the School respond.

For information we collect through the Website, such as contact form messages, we decide how that information is used, as described below.

2. Information we collect

When you visit the Website or contact us

• Contact form. Your name, email address and message, and any optional details you choose to give: phone number, school name, number of students, topic and plan of interest. The form is sent to us by email.
• Technical information. Like any website, our hosting and security provider receives your IP address, browser type and the pages you request. This information is used to deliver the site and protect it from abuse.
• Spam protection. The contact form uses Cloudflare Turnstile, which checks signals from your browser to tell people from bots.

When a School uses the Service

• Staff accounts. Name, username, email address, role, branch and an optional photo for each staff member. Passwords are stored only as one-way hashes.
• School Data. Information a School enters about its contacts, which may include names, dates of birth, phone numbers, email and mailing addresses, occupation, guardian and emergency contacts, medical notes, photos, attached files, notes and call logs, ranks, test results, attendance, and membership agreements with their payment terms and payment method. If a School sends email through the Service, School Data also includes those messages and their recipients. The Service does not process payments and does not store card or bank account numbers.
• Kiosk check-ins. The phone number or student ID entered at a School's check-in kiosk, and the time and place of the check-in. If a School turns on the kiosk's optional camera motion-wake, the camera image is analyzed only on the tablet itself to wake the screen. No images are sent to us or stored.
• Security and activity records. Each user's most recent sign-in time, the IP addresses of failed sign-in attempts (used to block repeated attempts), and a record of changes to contact records showing which fields changed and who changed them. When our support staff use "View As" to see the Service as a School user in order to help them, the start and end of that session are recorded.
• Billing information. The plan, number of user accounts and storage a School uses, so that we can invoice the School.

3. Gmail and Outlook mailbox connection

A School manager may choose to connect a branch's Gmail or Microsoft Outlook mailbox to the Service. This is optional, and only that manager's branch uses it.

• What we request. Permission to read email (Google's gmail.readonly scope or Microsoft's Mail.Read permission) and to send email (Google's gmail.send scope or Microsoft's Mail.Send permission) from the connected mailbox, plus the mailbox's email address. We never request permission to change or delete messages, or to change the mailbox's settings.
• What we read, and when. Only when a staff member opens a contact's record, the Service looks up the most recent messages (up to ten) to, from or copied to that contact's email addresses. It reads each message's date, subject and a short preview, and shows them to the staff member on that page.
• What we send, and when. The Service sends email from the connected mailbox only when a School staff member chooses to send it, for example a message to a student or family, or a newsletter to contacts the staff member selects. Messages go out from the School's own mailbox and appear in its Sent folder. The Service never sends email on its own, and we never use a School's mailbox to send our own messages.
• What we store. The connected email address and the access tokens the provider issues, which are encrypted before they are stored. Messages read from the mailbox are not stored: their subjects and previews are fetched for the page and then discarded. For email that staff send through the Service, the Service may keep the message, its recipients and the time it was sent as part of the School's records, so staff can see what was sent.
• What we never do. We do not use mailbox data for advertising, we do not sell it or transfer it to anyone else, and we do not use it to train artificial intelligence or machine learning models. No person at Silk Road Merchants LLC reads it, except with the School's permission for support, for security purposes, or where required by law.
• Disconnecting. A School manager can disconnect the mailbox at any time from the branch's profile in the Service. Disconnecting deletes the stored tokens, and for Gmail it also asks Google to revoke MartialCRM's access. You can also remove MartialCRM's access yourself from your Google Account or Microsoft account settings.

Google API Services: MartialCRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

• To provide, maintain and support the Service for each School.
• To send the email and newsletters that a School's staff choose to send through the Service.
• To answer messages you send us and tell you about MartialCRM when you ask.
• To keep the Website and the Service secure, prevent abuse and fix problems.
• To bill Schools for their subscriptions.
• To comply with the law and enforce our Terms of Service.

We do not sell personal information, share it for cross-context behavioral advertising, or use School Data for any purpose other than providing the Service to the School that entered it.

5. How we share information

We share information only with service providers that help us run the Website and the Service, and only as they need it to do that work:

• Amazon Web Services hosts the Service and its databases in the United States.
• Cloudflare delivers and protects the Website and the Service, runs the Turnstile spam check, and delivers contact form messages to us by email.
• jsDelivr delivers some open-source software components that the Service loads in your browser. It receives your IP address and browser information, but not School Data.
• Google and Microsoft, only if a School connects a mailbox, as described in section 3.

We may also disclose information if the law requires it, to protect the rights, safety or property of our users, the public or us, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the information transferred.

6. Cookies and analytics

The Website does not set its own cookies and does not use advertising or cross-site tracking. We may use Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you. The Service uses a strictly necessary session cookie to keep staff signed in, and the check-in kiosk stores a sign-in token on the kiosk tablet.

7. How we protect information

We use administrative, technical and physical safeguards appropriate to the information we hold. These include encryption of all traffic in transit, a separate database for each School, one-way hashing of passwords, automatic lockout after repeated failed sign-ins, role-based access for School staff, encryption of mailbox tokens, change logging and daily backups. No system is perfectly secure. If we learn of a security incident affecting School Data, we will notify the affected Schools without undue delay.

8. How long we keep information

We keep contact form messages for as long as we need them to respond to you and keep a record of our conversation. We keep School Data for as long as the School's subscription is active. When a subscription ends, we delete the School's data within 90 days unless the School asks us to delete it sooner or the law requires us to keep it. Copies in backups are overwritten on their regular schedule.

9. Children's information

Martial arts schools teach many children, so School Data often includes information about minors. The Service is used by School staff, not by children. Each School is responsible for having the right to collect and use its students' information, including obtaining parental consent where the law requires it. We use children's information only to provide the Service to the School. The Website is not directed to children under 13, and we do not knowingly collect personal information from them through it.

10. Your choices and rights

You can ask us to access, correct or delete personal information you sent us through the Website. Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act. We will not discriminate against you for exercising any of these rights. If your request concerns School Data, we will pass it to the School, which controls that information, and help it respond. If you receive email from your school through MartialCRM and no longer want it, contact your school, which decides whom it emails. You may also opt out of any marketing email from us at any time.

11. Changes to this policy

We may update this policy as the Website and the Service change. We will post the new version here with a new effective date, and if the changes are significant we will notify Schools before they take effect.

12. Contact us

For questions about this policy or your information, use our contact form and choose "Something else". Silk Road Merchants LLC is based in Massachusetts, United States.