Privacy Policy

Last updated 16 July 2026. ABJJF India is the Agrya Brazilian Jiu-Jitsu Federation of India, a Section 8 non-profit company incorporated under the Companies Act, 2013 (CIN U85410DL2026NPL464365), with its registered office at A-269, Second Floor, Defence Colony, New Delhi 110024. Email info@abjjfi.com · Phone +91 99908 54548.

This policy explains how we handle personal data on abjjfi.com. We have written it in plain language on purpose. If anything here is unclear, write to us and a human will explain it.

What this website does

This website is the federation itself, online. You can sign up, log in, keep a federation profile, ask us to verify your identity and your belt rank, buy a membership, book a seminar seat, and enter an event. Each of those touches different data, and each is dealt with separately below.

Paying us

When you buy a membership, a seminar seat, an event entry or merchandise, your payment is handled by our payment gateway — a regulated provider — on their own secure page.

• WE NEVER SEE, AND NEVER STORE, YOUR CARD NUMBER, CVV, PIN, OTP, UPI PIN OR NET-BANKING PASSWORD. Those go to the gateway and its banks, not to us. Nobody at ABJJF can ask you for them, and nobody legitimate ever will.
• What we keep is the receipt: what you bought, the amount, the date, whether it succeeded, and the gateway’s reference number. That is what an invoice, a refund and our auditor need.
• Your billing name, email and address, where a purchase requires them, so we can issue a valid invoice.
• We keep transaction records for as long as tax and company law requires us to — currently 8 years — because we are legally obliged to, even if you close your account.

Verification documents — and how we destroy them

To compete, we need to know you are who you say you are, and that your belt is real. That means you send us a document. This is the most sensitive thing we will ever ask of you, so here is exactly what happens to it.

What we accept:

• Identity and age: a birth certificate, a PAN card, or a passport.
• Belt rank: your rank certificate — or, if you have none, we email a professor at your academy and ask them to confirm it.

What we refuse:

• We do NOT accept Aadhaar, and we ask you not to send one. Storing Aadhaar copies falls under the Aadhaar Act and UIDAI’s rules, and a jiu-jitsu federation has no business holding them. A birth certificate, PAN or passport proves your age and identity perfectly well.

What happens to the document:

• It is stored in a private, locked bucket. It is never public. There is no link to it, and we do not hand one out.
• Only a member of federation staff can open it. Not other members, not your academy, not even you — you already have your own passport, and every way of reading a file is a way of leaking it.
• The moment we approve or reject, THE DOCUMENT IS DELETED. Not hidden, not archived — deleted from storage. The system refuses to record a decision if it cannot delete the file.
• If we have not reviewed it within 60 days, it is deleted anyway, automatically, and we ask you to send it again. Our slowness is not a reason to keep your passport.
• What we keep is the answer: that you are verified, when, and by whom. Not the document.

This is not a promise about our intentions. It is how the software behaves, and we tested it before writing this paragraph.

Your account

You can create an account with an email address and a password, or by signing in with Google. Signing up is free, and no documents are required.

Your login is handled by Supabase, our authentication provider. They hold:

• Your email address.
• Your password — stored as a one-way hash, never as readable text. Nobody at ABJJF can see your password, and neither can Supabase.
• If you use Google: the email address and name Google gives us. We do not receive your Google password, and we get no access to your Gmail, Drive, contacts, or anything else in your Google account.

Your ABJJF profile holds what you choose to tell us:

• Your name, which appears on your federation record.
• Your date of birth, used to work out age categories.
• The academy where you train.
• Your belt rank as you have stated it. This is recorded as CLAIMED and is not verified. We do not present it as verified anywhere.
• Your phone number, if you give one. It is optional and never shown publicly.

You can change any of this yourself at any time, from your account page. You can ask us to delete the whole account and we will.

What we collect, and why

When you send a message through the contact form, we collect:

• Your name.
• The email address or phone number you ask us to reply on.
• The message itself.

We use this only to answer you. We do not sell it, we do not share it with advertisers, and we do not add you to a mailing list without you asking.

When you submit an article through “Write for us”, we collect:

• Your name, which becomes the byline if we publish the article.
• Your email address, so we can reply to you about the piece.
• The article itself.

If we publish your article, your name appears publicly as the byline. Your email address never appears on the public site.

Our hosting and database providers keep standard technical logs — IP address, browser type, pages requested — for security and to keep the site running. We do not use these to build a profile of you, and we do not run advertising trackers.

Spam protection, and what we do with your IP address

When you use either form, we store a one-way cryptographic hash of your IP address alongside your message. We do this to stop automated spam: it lets us count how many times the same visitor has submitted in the last hour, without keeping the address itself.

A hash is not an address. It cannot be reversed, and we cannot turn it back into your IP or use it to identify you. We do not store your IP address in readable form, and we do not share it.

How long we keep it

• Your account and profile: kept while your account exists. Delete your account and it goes.
• Contact messages: kept while we deal with your query and for up to 12 months afterwards, then deleted.
• Article submissions we publish: kept for as long as the article is on the site.
• Article submissions we decline: the draft and your email are deleted within 6 months.
• Technical logs: kept by our hosting providers for a short period as part of their normal operation.

Who else touches your data

We use a small number of companies to run this website. They are processors acting on our instructions, not owners of your data, and none of them may sell it or use it for their own purposes.

• Supabase — the database and your login. Hosted in Mumbai (ap-south-1).
• Vercel — runs the website itself.
• Resend — sends our email, such as the confirmation link when you sign up.
• Our payment gateway — takes your payment on its own secure page and tells us only whether it succeeded. It is regulated by the Reserve Bank of India and holds the card details we never see.

That is the whole list. We have no group companies, no affiliates and no marketing partners, so there is nobody else for your data to be passed to. We do not sell it, we do not trade it, and we do not let anyone advertise to you with it. We may disclose data if a law or a court in India requires us to — and only then.

Some technical logging by these providers may be processed outside India. We do not sell your data to anyone, and we do not run advertising trackers.

Your rights under the DPDP Act 2023

You have the right to:

• Ask what personal data of yours we hold, and get a copy of it.
• Ask us to correct anything that is wrong or incomplete.
• Ask us to delete it.
• Withdraw consent you previously gave.
• Complain to us, and — if we do not resolve it — to the Data Protection Board of India.

To exercise any of these, write to info@abjjfi.com. We will respond within 30 days. There is no charge.

Children

You must be 18 or over to hold your own account. A child under 18 is registered by their parent or guardian, from the guardian’s own account. This is how it works, and we built it this way on purpose:

• A child’s profile has NO login. The child cannot sign in, and nobody can sign in as them.
• It is never shown publicly. Only the guardian, the child’s academy and the federation can see it.
• Only that guardian can change or delete it. No other guardian can reach it, even knowing its address.
• We hold the child’s name, date of birth, academy and claimed belt — nothing more. We do not ask for a child’s email or phone number.
• We contact the guardian, never the child.
• The guardian can delete their child’s profile at any time, themselves, and it is gone.

If you are under 18, please do not use the contact or submission forms without a parent or guardian. If you believe a child’s data is here without a guardian’s knowledge, write to us and we will remove it. See also our Child Protection & Safe Sport policy.

Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023, the name and contact details of the Grievance Officer are:

• Name: Ms. Karneet Kaur
• Designation: Grievance Officer
• Agrya Brazilian Jiu-Jitsu Federation of India
• Address: A-269, Second Floor, Defence Colony, New Delhi 110024
• Email: grievances@abjjfi.com
• Phone: +91 99908 54548
• Hours: Mon–Sat, 10:00–19:00 IST

We acknowledge a grievance within 24 hours and resolve it within 15 days of receipt. See the Grievance Redressal policy for how complaints are handled and how quickly.

Changes

When we change this policy we will change the date at the top. If the change is significant, we will say so prominently rather than quietly editing this page.

Contact us

Agrya Brazilian Jiu-Jitsu Federation of India · A-269, Second Floor, Defence Colony, New Delhi 110024 · Email info@abjjfi.com · Phone +91 99908 54548 · Mon–Sat, 10:00–19:00 IST.