Privacy Policy

1. Controller

The person named above is the controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation.

2. Overview of Processing

The following overview summarises the types of data we process, the purposes of processing, and the categories of people affected.

Types of Data Processed

• Contact data (e.g. your email address when you request a free plan)
• Usage data (e.g. pages visited, time of access)
• Meta and communication data (e.g. IP addresses, device information)

Categories of Data Subjects

• Website visitors
• Prospective customers (free plan and waiting list)
• Users of the service

Purposes of Processing

• Providing and operating our website
• Contact and communication
• Delivering the free plan you requested and related emails
• Security measures and abuse prevention
• Audience measurement (Vercel Analytics, anonymised and cookie-free; Google Analytics 4 only with your consent)

3. Legal Bases

Below are the legal bases under the GDPR on which we process personal data:

• Consent (Art. 6(1)(a) GDPR) — the data subject has given consent to the processing (e.g. requesting a free plan, or accepting analytics cookies).
• Performance of a contract (Art. 6(1)(b) GDPR) — processing necessary to perform a contract or take pre-contractual steps.
• Legitimate interests (Art. 6(1)(f) GDPR) — processing to pursue legitimate interests (e.g. security, technical operation).

4. Hosting: Vercel

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you access our website, Vercel automatically processes access data, in particular:

• IP address of the accessing device
• Date and time of access
• URL requested, referrer URL
• Browser type and operating system
• Amount of data transferred, HTTP status code

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). The data is deleted once the respective connection ends, unless a statutory retention obligation applies.

Vercel is a recipient of your personal data and acts as our processor. A data processing agreement under Art. 28 GDPR is in place. As Vercel is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. More information: vercel.com/legal/privacy-policy

5. Free Plans, Account Emails and Email Service (Resend)

When you request a free training plan or join our waiting list, we process your email address in order to send you the plan and to keep you informed about Pilates Plans.

We use a double opt-in procedure: after you submit the form, you first receive a confirmation email containing a confirmation link. Your email address is only added to our list once you click that link. Confirmation links are valid for 24 hours.

The legal basis is Art. 6(1)(a) GDPR (explicit consent given by clicking the confirmation link). You can withdraw your consent at any time with effect for the future, either via the unsubscribe link in every email we send or by contacting us at hello@pilatesplans.com.

If you do not confirm your request, we store your email address for a maximum of seven days for one purpose only: to send you a single reminder after about 24 hours — confirmation emails occasionally end up in spam. If that reminder also goes unconfirmed, the address is deleted and is not added to our list. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivering a document you requested yourself).

Our emails use click tracking: links are routed through a counting server operated by Resend so that we can see which content is being read. The time of the click and the link clicked are recorded. We do not measure opens via tracking pixels. You can object to click tracking at any time, informally, at hello@pilatesplans.com; you will continue to receive all emails, just without counted links.

Registered users also receive account emails, in particular the sign-in link for passwordless login (magic link) as well as emails relating to account and subscription management. The legal basis for these is Art. 6(1)(b) GDPR (performance of a contract) rather than consent, which applies only to the mailing list.

We use Resend (Resend Inc., 2261 Market Street STE 5860, San Francisco, CA 94114, USA) to send all of the emails described above. Resend processes your email address solely for the purpose of providing the email service. A data processing agreement is in place. As Resend is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. More information: resend.com/legal/privacy-policy

Your email address is not passed on to third parties for advertising purposes. List data is deleted on your request; account emails continue for as long as your user account exists.

6. Audience Measurement (Vercel Analytics)

We use Vercel Analytics for anonymised measurement of website usage. Vercel Analytics uses no cookies and creates no individual user profiles. Only aggregated, non-personal metrics are collected (e.g. page views, referrer information). Individual people cannot be identified.

Because no personal data within the meaning of the GDPR is processed, no consent is required for the use of Vercel Analytics. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in optimising and securely operating our website).

As Vercel Analytics is operated as part of our hosting provider (Vercel Inc.), the information on data transfers to the USA in section 4 applies accordingly. More information: vercel.com/docs/analytics/privacy-policy

6a. Audience Measurement (Google Analytics 4)

With your consent, we additionally use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Unlike Vercel Analytics, Google Analytics places cookies on your device and processes personal data (e.g. truncated IP address, device and browser information, interactions with the website).

On your first visit, Google Analytics is loaded only after your explicit consent via the cookie banner. The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future:

Change cookie settings

The IP address is truncated before processing (IP anonymisation). As Google LLC is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. More information: policies.google.com/privacy

7. Payment Processing (Stripe)

Subscription payments are processed via Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). The data required for payment processing (e.g. name, payment details) is transmitted directly to Stripe and processed there. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). More information: stripe.com/privacy

7a. User Accounts and Database (Supabase)

For sign-in (passwordless login via magic link) and account management we use Supabase (Supabase, Inc., USA) as our database and authentication service. The data processed includes in particular:

• Email address and sign-in timestamps
• Subscription status and related contract data (tier, billing interval, term)
• A randomly generated identifier needed to uniquely assign your account

The legal basis is Art. 6(1)(b) GDPR (performance of a contract, i.e. providing the user account and unlocking purchased content). The database is hosted in the EU (Frankfurt). As Supabase, Inc. is based in the USA, data is transferred within the scope of processing on the basis of the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR. A data processing agreement under Art. 28 GDPR is in place. More information: supabase.com/privacy

8. Your Rights as a Data Subject

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR): you have the right to request information about the personal data we process about you.
• Right to rectification (Art. 16 GDPR): you have the right to have inaccurate data corrected.
• Right to erasure (Art. 17 GDPR): you have the right to request the deletion of your personal data.
• Right to restriction of processing (Art. 18 GDPR): you have the right to request that processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): you have the right to receive your data in a common, machine-readable format.
• Right to object (Art. 21 GDPR): you have the right to object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent you have given at any time with effect for the future.

To exercise your rights, please contact: hello@pilatesplans.com

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent authority for Berlin is:

10. Validity and Changes to This Privacy Policy

This privacy policy is currently valid. As our website and offering develop, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed on our website at any time.