MF FIGHT CLUB

Privacy Policy

Effective date: 27 September 2026

MF Fight Club respects the privacy of people who use the MF FIGHT CLUB Member Portal. This Privacy Policy explains what information we collect, why we use it, when it may be disclosed, and how members can contact us about their information.

1. Who we are

The operator responsible for the Member Portal and related MF Fight Club services is MF Fight Club.

Business address:
Lorong Chew Siik Hiong 1
Pekan Sibu
96000 Sibu
Sarawak
Malaysia

2. Information we collect

Depending on the features you use, we may process:

your account name, email address, phone number, date of birth, emergency-contact details, training notes, and profile photo;
account, authentication-provider, email-verification, password-reset, session, account-status, and security information;
membership and package information, registration requests, approval status, package usage, selected PT coach, and member messages;
payment method information for Cash or DuitNow QR, payment receipt evidence and metadata, payment approval, reversal, and related audit records;
group-class reservations, PT bookings, PT session details, cancellations, attendance, and coach-related booking information;
health and waiver answers, acknowledgements, signature name, review status, and related notes when you submit a health and waiver form;
announcements, in-portal notifications, notification preferences, and Web Push subscription information when you choose to enable push notifications; and
technical and security information needed to operate the portal, including session cookies, login-attempt protection records, browser storage preferences, and request information processed by our infrastructure providers.

The portal does not request card numbers for its current Cash and DuitNow QR payment methods. Please do not send payment-card details in a member message.

3. How we collect information

We collect information when you:

create, sign in to, or update a Member Portal account;
use Google Sign-In;
submit a membership or package request, message, payment method, or DuitNow QR receipt;
book, cancel, or attend a group class or PT session;
complete a health and waiver form or provide emergency-contact information;
choose notification preferences or enable Web Push on a browser or device; or
use the portal, when session, security, and technical information is generated as part of providing and protecting the service.

4. Why we use information

We use information to:

create and secure accounts and authenticate members;
manage memberships, package eligibility, requests, approvals, payments, receipts, reversals, and package usage;
administer group classes, PT coach assignment, PT availability, bookings, cancellations, attendance, and reminders;
review health and waiver submissions and apply the portal's booking-readiness requirements;
send announcements, account updates, booking updates, membership and payment updates, and optional reminders or push notifications;
respond to questions, maintain business and audit records, prevent fraud or misuse, and protect members, staff, and the portal; and
meet applicable legal, financial, accounting, dispute-resolution, and regulatory obligations.

5. Authentication and service providers

If you choose Google Sign-In, Google provides basic identity information needed to authenticate or link your MF Fight Club account, such as your name, email address, profile information, and provider identifier. The portal requests the basic openid, email, andprofile scopes. MF Fight Club does not request or access Gmail, Google Drive, Google Contacts, Google Calendar, Google Photos, or unrelated Google APIs through Google Sign-In.

Cloudflare Workers hosts the application, Cloudflare D1 stores application database records, and Cloudflare R2 stores private profile-photo and payment- receipt objects. An email delivery provider may deliver account-verification and password-reset messages where that service is enabled. Browser and device push services may deliver notifications when you enable Web Push. These providers process information as needed to provide their services; they do not become the owner of your MF Fight Club account or membership records.

6. Disclosure of information

We may disclose information to authorized MF Fight Club owner, admin, and coach personnel who need it to operate the club, administer memberships and bookings, review attendance or health-waiver status, or provide support. We may also disclose information to the service providers described above, to professional advisers or authorities where reasonably required, or where necessary to protect people, property, rights, or the security of the portal.

We do not disclose more information than is reasonably needed for the relevant purpose, and we do not use member information for unrelated advertising purposes through the Member Portal.

7. Security

We use reasonable administrative, technical, and organizational safeguards, including password hashing, protected sessions, access controls, private object storage, security headers, and rate-limiting measures. No online service can guarantee absolute security. You should keep your sign-in details private and tell us promptly if you believe your account or a receipt has been accessed improperly.

8. Data retention

We retain information only for as long as reasonably needed for the purposes described in this Policy, subject to the following schedule:

Member profile and account: while active, then for 2 years after closure or inactivity.
Login, session, and security records: 12 months; expired credentials and tokens are deleted when no longer required.
Membership, package, payment, receipt, refund, and audit records: 7 years.
Bookings, attendance, and cancellations: 2 years after the relevant class, session, or event.
Notifications and Web Push data: 12 months where history is required; push subscription data is removed when disabled or the account is closed, when no longer needed.
Profile photos: while the account is active, with deletion targeted within approximately 30–90 days after closure or deletion unless legitimately required longer.
Health and waiver records: 7 years after membership ends or the last relevant covered activity, with restricted access.
Parent or legal-guardian consent for a member under 13: together with the associated waiver or membership record for the applicable retention period.

At the end of the applicable period, we securely delete the information or irreversibly anonymise it. We may retain information beyond the normal period only where there is a documented legal, financial, dispute-related, fraud-prevention, or regulatory reason, and restricted access will be applied where appropriate.

9. Access and correction

You may request access to, or correction of, personal information held about you by contacting trunkskid5439@gmail.com. We may need to verify your identity before responding. We will consider requests within a reasonable period and may retain information that must be kept for a legitimate legal, financial, security, or dispute-related purpose.

10. Account closure and deletion

You may contact us to request account closure. We may deactivate or archive an account, and an account with membership, payment, booking, attendance, waiver, or other business history may not be permanently deleted immediately. The applicable retention schedule continues to apply, after which information is securely deleted or irreversibly anonymised unless restricted retention is documented for a legitimate reason.

11. Cookies, sessions, and local storage

The portal uses a secure, HttpOnly session cookie to keep you signed in. It also uses limited browser storage for preferences such as language and theme and for limited member display information. These mechanisms are not used for third-party advertising tracking. Clearing browser storage or cookies may sign you out or reset local preferences.

12. Push notifications

Web Push is optional. If you enable it, the browser or device may provide a push endpoint and subscription keys so the portal can deliver enabled updates. You can turn push notifications off in the Member Portal or withdraw browser or device permission through its settings. In-portal notification preferences remain separately configurable.

13. Children and members under 13

A member under 13 may use the relevant services only with consent from a parent or legal guardian. We may request and retain evidence of that consent with the associated waiver or membership record for the applicable retention period. A parent or legal guardian may contact us about the child's information using the details below.

14. Changes to this Policy

We may update this Policy when the portal, services, or legal requirements change. The public page will show the revised effective date. Material changes may also be communicated through the Member Portal or another appropriate contact route.

15. Contact

For privacy, access, correction, or data questions, contact MF Fight Club attrunkskid5439@gmail.com or 013-567 8220.

Business address:
MF Fight Club
Lorong Chew Siik Hiong 1
Pekan Sibu
96000 Sibu
Sarawak
Malaysia