COMBAT VAULT
COMBAT VAULT
Last updated: 2 June 2026
Combat Vault is a trading name of Combat Vault Limited, a company registered in England and Wales under company number 17075177. Our registered office is at 4 Riverside Avenue, Chorlton, Manchester, M21 7PU, United Kingdom. References to "we", "our", and "us" in this policy mean Combat Vault Limited.
This policy applies to the platform we operate at combatvault.io, including any subdomains we host on behalf of gyms.
Combat Vault is a business-to-business platform sold to gyms. Different parts of this policy apply depending on how you use the Service.
If you are a gym, gym owner, coach, or other member of gym staff who has signed up for Combat Vault directly, we are the data controller for the personal data you give us when you sign up and use the platform.
If you are a gym member or lead whose information has been added to Combat Vault by your gym, your gym is the data controller for that information. Combat Vault is the data processor, which means we hold and process the data on the gym's behalf and only on its instructions. If you want to know how your gym uses or shares your data, contact your gym directly.
The data on the platform falls into a few buckets.
We use the data to operate the platform and meet our obligations to gyms that have signed up. In practice that means:
We share data with the following providers, each of which processes data only on our instructions and under a written agreement:
Each provider has its own privacy policy. We don't sell data to anyone.
Combat Vault is a UK business. Most of our processors operate in the UK, the EEA, or the United States. Where data leaves the UK we rely on the UK Addendum to the EU Standard Contractual Clauses, or on the UK adequacy framework, to keep the same level of protection.
We keep your data for as long as the gym's account is active. If a gym closes its account we delete the gym's data, including its members' records, after a reasonable wind-down period unless we're required to keep it for accounting or legal reasons (typically up to 6 years for financial records under UK tax law).
Gym staff can delete individual member records from inside the platform at any time. If you want your data removed sooner, email us using the contact details below.
We use a small number of cookies. Some are strictly necessary for the platform to work, like the session cookie that keeps you signed in. We don't use third-party advertising cookies. The cookie banner on the website asks you to accept or reject non-essential cookies before any are set.
Under UK GDPR you have the right to:
If your data is on Combat Vault because of a gym you're a member of, the gym handles these requests in the first instance. If we're the controller of your data, email us and we'll respond within one calendar month.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
All traffic is served over HTTPS. Passwords are stored as salted bcrypt hashes. Sensitive third-party access tokens are encrypted at rest. Database backups and access logs are maintained by our hosting providers. No system is perfectly secure, but if we find evidence of a breach affecting your personal data we will notify the ICO and, where required, you within 72 hours.
The Combat Vault platform is intended for gym staff aged 16 and over. Gym members under 16 may have their information stored on the platform by their gym. In that case the gym is the data controller and is responsible for any consent required from a parent or guardian.
We'll update this policy when the platform changes or when the law requires it. The "Last updated" date at the top of this page reflects the most recent change. If a change is material we'll email account holders.
For data protection questions, requests, or complaints: