Short version: we collect what we need to sell you a program, deliver it, and support you. We do not sell your data to anyone.
1. Who controls your data
Hanna Paluoja, trading as Hanna Workouts, is the data controller. Questions or requests go to support@hannaworkouts.com.
2. What we collect
- Account and order, name, email, what you bought, when, and the amount.
- Payment, handled by Stripe. We receive a token, the card brand, the last four digits and the expiry date. We never see or store the full card number.
- Training, whatever you enter in the app: workouts logged, weights, body stats, progress photos if you upload them, check-in answers.
- Messages, emails and in-app messages between us.
- Technical, IP address, browser, pages visited, kept briefly for security and to keep the site working.
Progress photos and body measurements are more sensitive than the rest. They are optional, they are only ever used to coach you, and you can delete them at any time.
3. Why we are allowed to use it
- To perform our contract, taking payment, giving you access, coaching you, supporting you.
- Legal obligation, keeping invoices and tax records.
- Legitimate interests, keeping the service secure and preventing fraud.
- Consent, marketing emails, and any use of your photo or words as a testimonial. Both are opt-in, and both can be withdrawn.
We will never publish your before-and-after photos, name or words without asking you first and getting a clear yes.
4. Who else touches it
Only the services needed to run this, each under contract and only for our purposes:
- Stripe, payments, fraud checks, invoices
- Everfit, the training app your program is delivered in
- Recurify, subscription billing and your account portal
- Zapier, passes your name and email between the above when you buy
- Resend, sends our emails
- Vercel, hosts this website
Some of these are outside the EU. Where that happens, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.
We do not sell your data and we do not share it for advertising.
5. Marketing
If you join the early list or opt in, we email you about programs and launches. Every email has an unsubscribe link and it works immediately. Emails about something you have actually bought, receipts, access, payment problems, are not marketing and are sent regardless.
6. How long we keep it
- Order and tax records: as long as tax law requires.
- Account and training data: while your account is active, then up to 12 months, unless you ask us to delete it sooner.
- Marketing list: until you unsubscribe.
- Technical logs: a short period, then discarded.
7. Your rights
Under GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable format, and withdraw consent at any time.
Email support@hannaworkouts.com and we will respond within one month. If you think we have handled your data badly you can complain to your national data protection authority.
8. Cookies
This site uses only what it needs to function and to remember your session. If we ever add analytics or advertising cookies we will ask first, and refusing will be as easy as accepting.
9. Children
This is not for under-16s. We do not knowingly collect their data, if we learn we have, we delete it.
10. Changes
If we change this materially we will email anyone on the list and update the date at the top.