Legal
Privacy policy
Last updated October 01, 2026
This policy explains what personal data Dojoto handles, why, who else sees it, and what rights you have. We keep it short and specific to what the app actually does.
1. Who we are
Dojoto is run by Karminel Ltd, Sofia, Bulgaria, registration number 202120534. For anything about your data, write to info@dojoto.net.
2. Two roles: ours and your club's
- Data about senseis and visitors. For sensei accounts, the waiting list and the technical data of the website, we decide why and how the data is used. We are the controller.
- Data about a club's students. The names, contacts, photos, attendance and payments that a club enters about its students belong to the club. The club is the controller; we store and process that data on the club's behalf, only to run the service for it (see section 6 of the terms of use). If you are a student or a parent, your club is the first place to ask about your data. We will help the club answer.
3. What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Waiting list: email, and if you add them, your name, club name, phone and country | To tell you when Dojoto opens for your club | Your consent | Until we invite your club or you ask us to remove it |
| Sensei accounts: name, email, password (stored only as a one-way hash), language, role in the club | To give you access and send you invitations and password resets | Contract | While the account exists |
| Sign-in sessions: IP address and browser name | To keep you signed in and to spot misuse of an account | Legitimate interest in security | Until you sign out |
| Student records a club enters: name, sex, whether a child, group, phone and email, a parent's name and phone, photo, attendance, fees paid or skipped | To run attendance and fees for the club | Decided by the club, as controller | Until the club deletes them, or its account is closed |
| Files uploaded to import students: a spreadsheet or a photo of a list | To read the students out of it for the club to review | Decided by the club, as controller | Deleted when the import is finished or discarded |
We do not sell personal data or show ads. On the public pages, and only if you allow it in the cookie banner, Google Analytics counts visits, and advertising cookies tell us whether an advert of ours brought you here; the club's area is never measured. The details are in the cookie policy.
4. Who else sees the data
We use a few service providers, each only for the job below and bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | The server that runs Dojoto and stores its data and photos | European Union |
| Mailjet | Sending emails: invitations, password resets | European Union |
| OpenAI | Reading an uploaded list of students, and framing student photos around the face | USA |
| Google Fonts | Delivering the fonts the pages use; your browser sends it your IP address | USA |
| Google Analytics | Counting visits to the public pages, only with your permission, with your IP address shortened | USA |
Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. OpenAI does not use data sent through its API to train its models and keeps it for at most 30 days to monitor abuse.
5. Children
Many clubs train children. A club that adds a child to Dojoto is responsible for having the right to do so, including a parent's consent where the law requires it, and in particular before uploading a child's photo. Children do not get accounts and never sign in.
6. How we protect it
Connections are encrypted, passwords are stored only as one-way hashes, each sensei sees only their own club, and access to the server is limited to the people who run Dojoto. Database backups stay on the same server, and only the 30 most recent are kept.
7. Your rights
You can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or give it to you in a portable format. You can object to processing based on legitimate interest, and withdraw consent at any time. Write to info@dojoto.net; we answer within one month.
If you think we handle your data unlawfully, you can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the data protection authority where you live.
8. Changes
When this policy changes, the date at the top changes too. If a change matters for how we use your data, we will tell account holders by email before it takes effect.