Privacy Policy

SYG Registry ("we", "us", "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and protect your data when you use the SYG Registry platform, website, and associated services.

SYG Registry is operated from the United Kingdom and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For international users, we apply equivalent protections consistent with applicable privacy laws in your jurisdiction.

By creating an account, registering as an athlete, or using any SYG Registry service, you acknowledge this Privacy Policy. If you disagree with any part of this policy, please discontinue use of the platform.

We collect information you provide directly and information generated through your use of the platform:

Account & Identity Information

• Full name, email address, and password (hashed)
• Profile photo (optional)
• Country, city, and academy affiliation
• BJJ belt rank and stripe count
• SYG ID (auto-generated unique identifier)
• Username (public-facing)

Instructor Verification Data

• Instructor name and email address (submitted by athlete)
• Belt award date and training history
• Verification decision (approved or denied) and timestamp
• IP address of instructor at time of decision
• Secure verification token used for confirmation link

Academy Information

• Academy name, address, city, country
• Owner/instructor contact details
• Website and social media profiles
• Membership tier and subscription status

Payment Information

• Transaction records including amount, currency, and status
• Stripe customer ID and session ID (no raw card data is stored)
• Payment type and date
• All payment processing is handled securely by Stripe, Inc.

QR Code & Technical Data

• Uniqode QR code ID, image URL, and short redirect URL
• QR code active/inactive status
• IP address, browser type, and device type when visiting the platform
• Cookies and usage analytics (see Section 9)

We use your personal data for the following purposes:

• Creating and managing your SYG athlete or academy account
• Generating your unique SYG ID and QR code for profile verification
• Sending instructor verification requests and confirmation emails
• Processing payments for membership registration, renewals, and apparel
• Maintaining audit logs for security and fraud prevention
• Sending system emails such as payment receipts, membership expiry reminders, and verification outcomes
• Allowing administrators to approve, suspend, or manage profiles
• Improving the platform based on anonymised usage analytics
• Complying with legal obligations and resolving disputes

SYG Registry is a public verification platform. Certain profile information is intentionally made publicly visible:

Publicly Visible (when admin approved)

• Full name, profile photo, belt rank, and stripe count
• SYG ID and verification status
• Academy name, city, and country
• QR code (links to your public profile)
• Bio and social media links (if provided)
• Competition history (if approved by admin)

Never Publicly Visible

• Email address and phone number
• Payment records or financial information
• Instructor IP address or verification token
• Admin notes or internal approval details
• Access codes or promotional codes used

Profiles are only publicly visible once approved by the SYG Registry admin team. You may request your profile be set to private or removed entirely by contacting us.

When an athlete submits a verification request, we send an email to the instructor they have named. This email contains:

• The athlete's name, belt rank claimed, and profile photo
• A unique secure verification link (token-based, single-use)
• A request to confirm or deny the belt award

Instructors are not required to create an account. Their email is used solely for the purpose of verification. We record their decision, timestamp, and IP address as part of our anti-fraud audit trail. Instructor data is retained as part of the athlete\'s permanent verification record.

All payments are processed through Stripe, Inc., a PCI-DSS-compliant payment processor. SYG Registry does not store, transmit, or have access to your full card number, CVV, or bank account details.

We retain the following payment metadata:

• Stripe session ID and payment intent ID
• Stripe customer ID (linked to your email)
• Payment amount, currency, and status
• Date and type of payment

For Stripe\'s own privacy practices, see: stripe.com/privacy

Each verified SYG member receives a dynamic QR code powered by Uniqode. This QR code permanently redirects to your public SYG profile. The QR code is embedded in physical apparel and displayed digitally on your profile.

• The QR code is linked to your SYG ID, not your personal email
• If your profile is suspended, the QR code will redirect to a suspended profile page
• QR code scan data (anonymous analytics) may be collected by Uniqode
• You may not reproduce, duplicate, or transfer your QR code to another person

SYG Registry uses cookies and similar tracking technologies to operate the platform and understand how users interact with it.

Essential Cookies — required for login sessions, authentication, and security. Cannot be disabled.

Analytics Cookies — used to understand platform usage, page performance, and feature adoption. Anonymised where possible.

By continuing to use the SYG Registry platform, you consent to the use of essential cookies. You may manage non-essential cookies through your browser settings. For full details see our Cookie Policy.

Your data is stored on secure cloud infrastructure operated by Base44. We implement the following protections:

• Encrypted data transmission (HTTPS/TLS)
• Hashed passwords — plain-text passwords are never stored
• Role-based access controls — only authorised admins can view sensitive records
• Audit logs for all administrative actions
• Rate limiting on sensitive endpoints to prevent abuse
• Server-side data filtering — private fields are never exposed to frontend clients

While we take reasonable precautions, no system is completely secure. In the event of a data breach that affects your rights, we will notify you as required under UK GDPR within 72 hours of becoming aware.

If you register an academy on SYG Registry, the following applies:

• Academy name, location, and contact details may be publicly visible once approved
• The academy owner's email is stored and used for communications
• Academy subscription and payment data is retained as per Section 6
• Academy accounts may be suspended or removed for policy violations
• Student profiles linked to an academy remain active even if the academy account is suspended

SYG Registry uses AI-assisted verification and manual review processes to prevent fraudulent profiles and fake belt claims. This includes:

• AI cross-referencing of claimed instructor names and lineage against public databases (IBJJF, BJJ Heroes, Smoothcomp)
• Traffic light confidence scoring and risk flag generation
• IP address recording for instructor verification decisions
• Admin oversight of all verification outcomes
• Access code usage tracking to prevent abuse

Data processed by our AI verification system is used solely for fraud prevention and is not shared with third parties for marketing purposes.

If you are located in the UK or European Economic Area, you have the following rights:

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — correct inaccurate or incomplete data
• Right to Erasure — request deletion of your account and associated data
• Right to Restriction — limit how we process your data in certain circumstances
• Right to Data Portability — receive your data in a structured, machine-readable format
• Right to Object — object to processing based on legitimate interests
• Right to withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at: admin@sygregistry.com

You also have the right to lodge a complaint with the UK Information Commissioner\'s Office (ICO) at ico.org.uk.

You may request deletion of your SYG Registry account at any time. Upon deletion:

• Your public profile will be removed and QR code deactivated
• Personal data will be deleted within 30 days
• Payment transaction records may be retained for up to 7 years for legal and accounting obligations
• Verification records linked to other athletes' profiles (e.g. instructor decisions) may be retained in anonymised form

To delete your account, contact: admin@sygregistry.com

SYG Registry is operated from the United Kingdom. If you are accessing the platform from outside the UK, your data may be transferred to and processed in the UK. We ensure appropriate safeguards are in place for such transfers in accordance with UK GDPR Chapter V.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent changes. Continued use of SYG Registry after changes constitutes acceptance of the updated policy.

For privacy-related enquiries, data access requests, or to report a concern:

SYG Registry — Privacy
Email: admin@sygregistry.com
Founded by Kevin Mooney