Privacy Policy

1. Controller

The person named above is the controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation.

2. Overview of Processing

The following overview summarises the types of data we process, the purposes of processing, and the categories of people affected.

Types of Data Processed

• Contact data (e.g. your email address when you request a free plan)
• Usage data (e.g. pages visited, time of access)
• Meta and communication data (e.g. IP addresses, device information)

Categories of Data Subjects

• Website visitors
• Prospective customers (free plan and waiting list)
• Users of the service

Purposes of Processing

• Providing and operating our website
• Contact and communication
• Delivering the free plan you requested and related emails
• Security measures and abuse prevention
• Audience measurement (Vercel Analytics, anonymised and cookie-free; Google Analytics 4 only with your consent to the “Statistics” category)
• Marketing and conversion measurement (Pinterest tag only with your consent to the “Marketing” category)
• Referral program (assigning a referral and crediting bonus credits)

3. Legal Bases

Below are the legal bases under the GDPR on which we process personal data:

• Consent (Art. 6(1)(a) GDPR) — the data subject has given consent to the processing (e.g. requesting a free plan, or accepting analytics cookies).
• Performance of a contract (Art. 6(1)(b) GDPR) — processing necessary to perform a contract or take pre-contractual steps.
• Legitimate interests (Art. 6(1)(f) GDPR) — processing to pursue legitimate interests (e.g. security, technical operation).

4. Hosting: Vercel

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you access our website, Vercel automatically processes access data, in particular:

• IP address of the accessing device
• Date and time of access
• URL requested, referrer URL
• Browser type and operating system
• Amount of data transferred, HTTP status code

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). The data is deleted once the respective connection ends, unless a statutory retention obligation applies.

Vercel is a recipient of your personal data and acts as our processor. A data processing agreement under Art. 28 GDPR is in place. As Vercel is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. More information: vercel.com/legal/privacy-policy

5. Free Plans, Account Emails and Email Service (Resend)

When you request a free training plan or join our waiting list, we process your email address in order to send you the plan and to keep you informed about Pilates Plans.

We use a double opt-in procedure: after you submit the form, you first receive a confirmation email containing a confirmation link. Your email address is only added to our list once you click that link. Confirmation links are valid for 24 hours.

The legal basis is Art. 6(1)(a) GDPR (explicit consent given by clicking the confirmation link). You can withdraw your consent at any time with effect for the future, either via the unsubscribe link in every email we send or by contacting us at hello@pilatesplans.com.

If you do not confirm your request, we store your email address for a maximum of seven days for one purpose only: to send you a single reminder after about 24 hours — confirmation emails occasionally end up in spam. If that reminder also goes unconfirmed, the address is deleted and is not added to our list. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivering a document you requested yourself).

Our emails use click tracking: links are routed through a counting server operated by Resend so that we can see which content is being read. The time of the click and the link clicked are recorded. We do not measure opens via tracking pixels. You can object to click tracking at any time, informally, at hello@pilatesplans.com; you will continue to receive all emails, just without counted links.

Registered users also receive account emails, in particular the sign-in link for passwordless login (magic link) as well as emails relating to account and subscription management. The legal basis for these is Art. 6(1)(b) GDPR (performance of a contract) rather than consent, which applies only to the mailing list.

We use Resend (Resend Inc., 2261 Market Street STE 5860, San Francisco, CA 94114, USA) to send all of the emails described above. Resend processes your email address solely for the purpose of providing the email service. A data processing agreement is in place. As Resend is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. More information: resend.com/legal/privacy-policy

Your email address is not passed on to third parties for advertising purposes. List data is deleted on your request; account emails continue for as long as your user account exists.

6. Audience Measurement (Vercel Analytics)

We use Vercel Analytics for anonymised measurement of website usage. Vercel Analytics uses no cookies and creates no individual user profiles. Only aggregated, non-personal metrics are collected (e.g. page views, referrer information). Individual people cannot be identified.

Because no personal data within the meaning of the GDPR is processed, no consent is required for the use of Vercel Analytics. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in optimising and securely operating our website).

As Vercel Analytics is operated as part of our hosting provider (Vercel Inc.), the information on data transfers to the USA in section 4 applies accordingly. More information: vercel.com/docs/analytics/privacy-policy

6a. Audience Measurement (Google Analytics 4)

With your consent, we additionally use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Unlike Vercel Analytics, Google Analytics places cookies on your device and processes personal data (e.g. truncated IP address, device and browser information, interactions with the website).

Google Analytics is loaded only after your explicit consent to the “Statistics” category in the cookie banner, separately from the “Marketing” category (see 6b). The legal basis is Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG. You can withdraw or change your consent at any time with effect for the future:

Change cookie settings

The IP address is truncated before processing (IP anonymisation). As Google LLC is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. More information: policies.google.com/privacy

6b. Marketing and Conversion Measurement (Pinterest Tag)

With your consent, we additionally use the Pinterest tag of Pinterest Europe Ltd. (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). It sets cookies and sends data about your visit (e.g. pages viewed, IP address, device and browser information) to Pinterest. We use it to measure how our Pinterest content and ads perform. When you make a purchase, we additionally send Pinterest, server-side, the order value, the product name, the Pinterest click ID and your email address as an irreversible hash (SHA-256), so the purchase can be attributed to a Pinterest ad. This only happens if you agreed in the cookie banner beforehand. We do not pass on any other account data.

The Pinterest tag is loaded only after your explicit consent to the “Marketing” category in the cookie banner, separately from the “Statistics” category. The legal basis is Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG. As Pinterest may also transfer data to the USA, the transfer relies on the EU Standard Contractual Clauses (Art. 46 GDPR). You can withdraw or change your consent at any time with effect for the future (see 6c). More information: policy.pinterest.com/en/privacy-policy

6c. Cookies and Cookie Settings

On your first visit, the cookie banner asks which optional cookies you allow: Statistics (Google Analytics, 6a) and Marketing (Pinterest, 6b). Nothing of this is loaded without your consent. We store your choice for 12 months in a cookie of its own. You can change it at any time:

Change cookie settings

Regardless of your choice, we set these technically necessary cookies:

• pp_cookie_consent_v2 (12 months): stores your cookie choice.
• locale (12 months): remembers the language you picked.
• Supabase sign-in cookies (session): keep you signed in to the member area.
• pp_plan_access (180 days): unlocks the free plan on your device after you confirm your email.

The legal basis for these cookies is Section 25(2) no. 2 TDDDG (storage is necessary to provide a service you explicitly requested) and Art. 6(1)(b) and (f) GDPR.

With your consent to the “Marketing” category, we additionally store the cookie pp_ref (30 days). It contains the referral code when you arrive through a referral link, so we can assign the referral to a later booking (see 7b). Without this consent we do not store the code: it is then carried in the address bar (parameter “?ref=”) up to checkout and is lost as soon as you leave the site.

6d. Anonymous Counting on Our Website

In addition, we count on our own servers which public pages are viewed, which buttons (e.g. “Get 2 free classes”) are clicked and where visitors come from (the domain of the referring site or the campaign from a link, e.g. in one of our emails). We store only a counter per day, event and place, for example “page X was viewed 12 times today”.

No cookies are set, nothing is stored in your browser, and no IP address, identifier or device information is stored. The counters cannot be assigned to a person; the member area is excluded. It is therefore not personal data and no consent is required. As a precaution, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our service).

7. Payment Processing (Stripe)

Subscription payments are processed via Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). The data required for payment processing (e.g. name, payment details) is transmitted directly to Stripe and processed there. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). More information: stripe.com/privacy

7a. User Accounts and Database (Supabase)

For sign-in (passwordless login via magic link) and account management we use Supabase (Supabase, Inc., USA) as our database and authentication service. The data processed includes in particular:

• Email address and sign-in timestamps
• Subscription status and related contract data (tier, billing interval, term)
• A randomly generated identifier needed to uniquely assign your account

The legal basis is Art. 6(1)(b) GDPR (performance of a contract, i.e. providing the user account and unlocking purchased content). The database is hosted in the EU (Frankfurt). As Supabase, Inc. is based in the USA, data is transferred within the scope of processing on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. A data processing agreement under Art. 28 GDPR is in place. More information: supabase.com/privacy

7b. Referral Program

Members can recommend Pilates Plans. Every member gets a personal referral code and link. If someone arrives through this link and subscribes, we assign the referral after the first paid invoice and credit a reward to both sides (bonus credits; for a Studio membership, the referrer receives one free month as a Stripe balance).

The data processed is the referral code, the link between the two accounts, the booked tier and the reward credited. The referrer only sees how many referrals were redeemed and what they received for them, not who was referred. The legal basis is Art. 6(1)(b) GDPR (performing the referral program participation). The referral code from the address bar is sent to our server when you start checkout; we only set the pp_ref cookie with your consent (see 6c). To prevent abuse (e.g. referring yourself) we compare email address and payment account; the legal basis is Art. 6(1)(f) GDPR.

7c. Usage Analysis in the Member Area

While you are signed in, we log on our own servers which areas of the member area you open (e.g. calendar, exercise database, a particular plan) and whether you download a PDF. We store only your account identifier, the type of event, the area or plan identifier and the time. We store no IP address, set no cookies and do not pass this data on to third parties. Together with the data you create yourself (e.g. unlocked plans, calendar entries), we use it in aggregated form to understand which features are used and to improve the service.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in developing the service). You can object to this processing under Art. 21 GDPR (see section 8). The events are deleted together with your account.

8. Your Rights as a Data Subject

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR): you have the right to request information about the personal data we process about you.
• Right to rectification (Art. 16 GDPR): you have the right to have inaccurate data corrected.
• Right to erasure (Art. 17 GDPR): you have the right to request the deletion of your personal data.
• Right to restriction of processing (Art. 18 GDPR): you have the right to request that processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): you have the right to receive your data in a common, machine-readable format.
• Right to object (Art. 21 GDPR): you have the right to object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent you have given at any time with effect for the future.

To exercise your rights, please contact: hello@pilatesplans.com

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent authority for Berlin is:

10. Validity and Changes to This Privacy Policy

This privacy policy is currently valid. As our website and offering develop, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed on our website at any time.