Privacy Policy

1. Introduction

Kmura Inc. ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our software platform. By accessing our website or using the Kmura platform, you agree to the collection and use of information in accordance with this Privacy Policy. All visitors to the Kmura website and all users of the Kmura SaaS platform are also subject to our Terms of Use, available at https://kmura.com/terms, which together with this Privacy Policy govern your use of our website and Services.

2. Information We Collect

We collect information in two categories:

2.1. Account Information (Academy Owners)

When you register, we collect:

• Name, email address, phone number, and physical address.
• Payment Information: We utilize Finix Payments, Inc. ("Finix") for all payment processing. We do not store full credit card numbers; we only store authentication tokens provided by Finix. All payment data is processed and stored by Finix in accordance with PCI DSS standards and Finix's own Privacy Policy (https://finix.com/terms-and-policies). Kmura does not control, access, or retain cardholder data beyond the tokens necessary for platform functionality.

2.2. Client Data (Students & Instructors)

You, as the Academy Owner, input data regarding your students and staff. We process this data on your behalf. This includes:

• Names, photos, email addresses, phone numbers, and physical addresses.
• BJJ training history (attendance, rank, class logs).
• Signed legal waivers.
• Membership details, payment history, and payroll information.

Electronic Waivers. Kmura integrates with Documenso, a third-party electronic signature platform, to enable Academy Owners to create, send, and manage digital waivers. Waiver documents and associated electronic signature data are processed and stored by Documenso in accordance with Documenso's own Terms of Service (https://documenso.com/terms) and Privacy Policy (https://documenso.com/privacy). Kmura does not independently verify the legal enforceability of any electronic waiver in any particular jurisdiction. Academy Owners remain solely responsible for ensuring that their waivers comply with all applicable law.

3. How We Use Information

We use the collected information to:

• Provide Services: To operate the platform, process billing via Finix Connect, and manage academy schedules.
• AI & Analytics: To generate business insights for your academy using Artificial Intelligence. We may use anonymized and aggregated data to train our AI models and improve system accuracy.
• Communication: To send you technical notices, updates, and security alerts.

4. Academy Communications (Email & SMS)

Kmura provides Academy Owners with tools to send email and SMS/text messages to their students, leads, and other contacts through third-party communication providers, including Twilio and SendGrid. When you use these communication features:

Data Controller Role. You, the Academy Owner, act as the data controller for all communications sent through the platform. Kmura acts solely as a data processor, transmitting messages on your behalf according to your instructions. Kmura does not independently determine the content, recipients, timing, or purpose of any messages you send.

Consent and Compliance. You are solely responsible for ensuring that you have obtained all required consents from recipients before sending any email or SMS/text communications through Kmura. This includes compliance with all applicable laws and regulations, including but not limited to the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, state-level consumer protection and privacy laws, and any applicable regulations governing commercial electronic messages. Kmura does not verify or validate that you have obtained proper consent prior to sending communications.

Opt-Out Obligations. You are responsible for honoring opt-out and unsubscribe requests from your recipients in a timely manner consistent with applicable law. Kmura may provide tools to assist with opt-out management, but ultimate compliance remains your responsibility.

Communication Data. Message metadata (such as delivery status, timestamps, and recipient phone numbers or email addresses) may be processed and stored by our third-party communication providers subject to their respective privacy policies. Kmura retains communication logs to support platform functionality and troubleshooting.

Third-Party Provider Terms. The email and SMS communication services available through Kmura are powered by Twilio (SMS) and SendGrid (email), both operated by Twilio Inc. Your use of these features is subject to Twilio's Terms of Service (https://www.twilio.com/en-us/legal/tos), Twilio's Acceptable Use Policy (https://www.twilio.com/en-us/legal/aup), and the Twilio SendGrid Email Policy (https://www.twilio.com/en-us/legal/service-country-specific-terms/email). Message content and metadata processed through these services are subject to the respective privacy policies of Twilio and SendGrid. Kmura does not control how Twilio or SendGrid process, store, or retain message data beyond what is described in their published policies.

5. SMS Communications from Kmura

This section describes text messages Kmura Inc. sends directly to you, the Kmura account holder (academy owner or instructor). It is separate from messages your academy may send to its students or leads through the Kmura platform, which are covered in the "Academy Communications (Email & SMS)" section above.

Opt-in. Kmura sends SMS only to users who have opted in inside their Kmura account at Account Settings > Notifications. Opt-in requires both toggling SMS Notifications on and checking the consent box presented on that screen. Consent, the consent language version, the phone number provided, and a timestamp are recorded on your account.

Messages you may receive. Billing receipts and invoices, payment reminders, account and security alerts, login verification codes, product and feature announcements, customer support replies, and occasional informational messages about new Kmura offerings. Kmura does not send SMS to the general public and does not rent or share its SMS channel with other businesses.

Message frequency and cost. Frequency varies based on your activity and the notifications you enable, typically 0 to 15 messages per month. Message and data rates may apply through your mobile carrier. Kmura does not charge you for SMS.

Help and opt-out. Reply HELP to any message for assistance. Reply STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to opt out at any time. You can also disable SMS in Account Settings > Notifications. After opting out, you will receive a single confirmation message and no further SMS unless you opt in again.

No third-party sharing for marketing. Your mobile phone number and SMS opt-in data will not be sold, rented, or shared with third parties for their own marketing or promotional purposes. Kmura shares this information only with service providers necessary to deliver SMS (for example, Twilio as the messaging carrier), under contractual confidentiality obligations.

Carriers. Kmura uses licensed aggregators and carriers. Carriers are not liable for delayed or undelivered messages.

Full program terms. See https://kmura.com/sms-terms.

6. Sharing of Information

We do not sell your personal information. We disclose information only to:

• Service Providers: Third-party vendors who help us operate the Services, such as Finix (payments), AWS/Replit (hosting), Twilio (SMS communications), SendGrid (email communications), and Documenso (electronic waivers and e-signatures).
• Legal Compliance: If required by law, subpoena, or valid legal process, or to protect the rights and safety of Kmura or others.
• Business Transfers: In connection with a merger, sale of assets, or financing of our business.

7. Cookies and Tracking Technologies

When you use the Kmura platform and visit our website, we and our service providers may use cookies, web beacons, pixels, and similar technologies to collect information about your browsing activity.

Types of Cookies We Use.

• Essential Cookies: Required for basic platform functionality, such as authentication, session management, and security. These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the platform so we can improve performance and usability. These may include third-party analytics services.
• Preference Cookies: Store your settings and preferences (such as language selection) to provide a more personalized experience.

Managing Cookies. Most web browsers allow you to control cookies through their settings. You may choose to block or delete cookies, but doing so may affect your ability to use certain features of the platform.

Do Not Track. Some browsers offer a "Do Not Track" (DNT) signal. Kmura does not currently respond to DNT signals, as there is no industry-wide standard for compliance.

8. Data Security

We implement industry-standard security measures, including encryption and secure tokenization of payment data, to protect your information. However, no method of transmission over the Internet is 100% secure.

9. Limitation of Liability and Disclaimer

To the fullest extent permitted by applicable law, Kmura Inc. shall not be liable for any unauthorized access to, alteration of, or loss or destruction of any personal data stored or processed through the Services, to the extent caused by factors outside of Kmura's reasonable control, including but not limited to the acts or omissions of third-party service providers (such as Finix, Twilio, SendGrid, and Documenso), cyberattacks, or force majeure events. Kmura implements industry-standard security measures as described in this Privacy Policy, but does not guarantee absolute security of any data.

Academy Owner Responsibility. As the data controller for your students' and instructors' personal information, you acknowledge and agree that you are responsible for your own compliance with all applicable privacy laws and regulations, including obtaining necessary consents, providing required privacy notices to your students and instructors, and responding to data subject requests. Kmura acts as a data processor on your behalf and is not responsible for your compliance obligations as a data controller.

10. Data Breach Notification

In the event that we become aware of a security breach that results in unauthorized access to, or disclosure of, personal information stored on our systems, Kmura will notify affected Academy Owners without unreasonable delay and in accordance with applicable state and federal breach notification laws.

Academy Owner Responsibility. As the data controller for your students' and instructors' personal information, you are responsible for determining whether and how to notify your own students, instructors, and other individuals whose data may have been affected, in compliance with applicable law.

Cooperation. Kmura will provide reasonable assistance and information to help you fulfill your own notification and remediation obligations.

11. Children's Privacy (COPPA Compliance)

Kmura is a B2B platform intended for Academy Owners. We do not knowingly collect personal information directly from children under 13.

Role of Academy Owner: If you use Kmura to manage data of students under 13, you represent that you have obtained verifiable parental consent to collect and process such information.

12. Your Rights (California & Other States)

Depending on your location (including residents of California, Virginia, Colorado, Connecticut, and other states with consumer privacy laws), you may have specific rights regarding your personal information, including:

• The right to know what personal information we collect, use, disclose, and sell.
• The right to access and receive a copy of your data in a portable format.
• The right to correct inaccurate data.
• The right to request deletion of your data.
• The right to opt-out of the sale or sharing of personal information (Note: Kmura does not sell or share personal information for cross-context behavioral advertising).
• The right to non-discrimination for exercising your privacy rights.

California Residents (CCPA/CPRA). In the preceding 12 months, Kmura has collected the categories of personal information described in Section 2 of this policy. We collect this information for the business purposes described in Section 3. We do not sell personal information as defined by the CCPA. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

Authorized Agents. You may designate an authorized agent to submit a privacy request on your behalf, provided the agent has your written permission and can verify your identity.

To exercise these rights, please contact us at support@kmura.com. We will respond to verifiable requests within the timeframe required by applicable law.

13. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Services. We may retain specific financial data for a longer period as required by tax laws.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.