Privacy information

Xuari is run by an independent martial arts enthusiast, not by a company. It is not currently an incorporated business, so there is no company name or commercial registration to publish. The person responsible for the directory acts as the controller for your personal data.

The contact form is the direct route to them for any privacy question.

Xuari distinguishes information supplied directly from information found in public sources. The source type and available source link appear on public profiles.

• Direct sources: representatives, senseis, school staff, account holders, and people who contact Xuari.
• Public sources: official school or instructor websites and social pages, public association or federation listings, and other public pages reviewed for directory accuracy. Public availability does not remove data-protection duties.

The current service is intentionally narrow. It handles information needed to publish profiles, operate accounts, review management access, verify school interest, secure changes, and maintain a content-minimised audit history.

• Public school and sensei information, including names, professional contact details, locations, schedules, martial arts, credentials, relationships, links, media, source references, and review dates.
• Self-registered or invited account information such as email address, display name, preferred language, access requests, evidence links and text, item decisions, access grants, account status, and sign-in records.
• Contact-form information such as name, email address, topic, message, preferred language, profile context, and delivery reference. Message content is sent by email and is not stored in the Xuari application database.
• Optional school-interest name, email, consent and verification state; HMAC-derived rate-limit keys instead of raw IP or email addresses; operational timestamps; authentication events; and a necessary local consent-preference record.

Xuari uses data only to provide and protect the directory and profile-management service.

Where consent is the basis, you can withdraw it at any time for future processing. Where legitimate interests are the basis, Xuari keeps a balancing assessment and honours valid objections.

• Directory accuracy and discovery — legitimate interests in accurate professional listings and community access to useful public information.
• Accounts, access requests, and approved editing — steps requested by the user, performance of these terms, and legitimate interests in access control.
• Questions, corrections, removals, claims, and school-interest verification — steps requested by the sender, consent where expressly requested, and legitimate interests in responding.
• Security, abuse prevention, audit records, and legal requests — legitimate interests and compliance with legal obligations.
• Aggregated audience and performance measurement — legitimate interests in knowing whether the directory works, which you can object to at any time in cookie preferences.

Those interests are keeping the directory accurate, allowing schools and senseis to be found, protecting accounts and content, preventing impersonation or abuse, and resolving complaints. Xuari minimises the data used, prefers professional rather than personal contacts, respects objections, and does not publish information where a person's rights outweigh those interests.

A profile subject or authorised representative can ask to claim a profile, correct inaccurate information, object to processing, request restriction while a dispute is reviewed, or ask for removal. Xuari will verify only what is necessary and will not treat a management grant as proof of legal ownership.

• Read the profile request process
• Start a correction request

Xuari currently uses authentication storage needed for signed-in sessions, a necessary preference record, optional language preference when enabled, and session storage for rounded finder location. Cookieless analytics (Vercel Analytics and Speed Insights) runs by default and can be switched off in cookie preferences. No marketing trackers were found in the reviewed application. Anything that stores data on your device remains blocked until you allow it.

• Read the cookie policy

Xuari relies on Supabase for database, authentication, Auth email and media storage; Vercel for hosting and, with your consent, analytics; Resend for application notifications, interest verification, and contact delivery; Google, when you choose to sign in with it, to verify your identity and confirm your email address; the designated recipient's Google email service for replies; and Google Maps Platform for editor address suggestions and selected place details. Selected addresses, place IDs, and coordinates may be stored and published as directory content. Each provider acts as a processor under its data-processing agreement, and transfers outside the EEA rely on the European Commission's standard contractual clauses or an adequacy decision. Xuari does not sell personal data.

• Google Privacy Policy

Xuari keeps personal data only as long as it is needed for the purpose it was collected for. Public profiles can be hidden and access can be revoked or suspended at any time. Contact messages are not stored in the application database; copies may remain with Resend and in the recipient mailbox while a question and any follow-up are handled.

• Public profiles: kept while the listing remains relevant to the directory, reviewed at least once a year.
• Accounts: deleted 24 months after the last sign-in.
• Management grants: deleted 12 months after they are revoked.
• Audit history: kept 24 months to investigate abuse and rights disputes.
• School interest: deleted after 7 days if unverified, and after 180 days once verified.
• Rate-limit records: deleted after no more than 2 days.

Depending on the circumstances, you can exercise the following rights. Xuari may request proportionate identity evidence and responds within one month, which can be extended by two further months for complex requests.

• Access personal data and receive information about how it is used.
• Correct inaccurate or incomplete personal data.
• Request deletion where the legal conditions apply.
• Restrict processing while accuracy, an objection, or another dispute is assessed.
• Object to processing based on legitimate interests or direct marketing.
• Receive portable data where processing is automated and based on consent or contract.

You can contact Xuari first, but you also have the right to complain to Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

• Submit a complaint to the CNPD

Use the privacy contact above or the contact form for any privacy or profile request. Include the relevant profile link and enough detail to identify the request, but do not send identity documents unless Xuari asks for proportionate evidence through a suitable channel.

• Contact Xuari