Privacy Policy

Last updated: October 22, 2026

1. Who is responsible for your data

The data controller for the website gabrielevianello.fit, the 3x3 No Gym Protocol web app (the "App") and related services is:

• Gabriele Vianello, trading as "Coach Gabriel" / GabrieleVianello.fit
• Paseo Las Canteras 31, Las Palmas de Grancanaria, Spain
• Email: gabriele@gabrielevianello.fit

This policy applies to visitors and customers worldwide. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and comparable laws in other countries, including US state privacy laws.

2. What data we collect

Data you give us

• Contact and purchase data: name, email address, country, billing details, products bought, amount, date and order number.
• Account data: your email and password. Passwords are stored only in encrypted (hashed) form; we can't read them.
• Training data: your level test answers (max pull-ups, training frequency), current and unlocked levels, logged sessions, effort ratings, guide progress and badges.
• Communications: messages you send us by email, and posts in the community if you join it.

Data collected automatically

• Technical data: IP address, browser and device type, pages visited, and date and time of access, recorded in server and security logs.
• Cookies and similar technologies: see section 8.

Payment card data is entered directly with the payment provider (such as Stripe or PayPal). We only receive confirmation of payment and limited details such as the card type and last four digits.

We don't ask for health records, body measurements or photos. Please don't send us sensitive information we haven't asked for.

3. Why we use it and our legal basis

4. Who we share it with

We don't sell your personal data. We share it only with service providers who help us run the business, under contracts that require them to protect it:

• Systeme.io (France): website, checkout, email marketing and transactional emails.
• Stripe and PayPal: payment processing and fraud prevention.
• Supabase, Inc. (USA): App login and database for your account and training data.
• Netlify, Inc. (USA): hosting of the App.
• Make (Celonis, Czech Republic): automation that creates your App account after purchase.
• Meta Platforms Ireland Ltd.: advertising measurement via the Meta Pixel, only with your consent.
• Google: web fonts loaded on our pages (your IP address is visible to Google when fonts load).
• Skool (USA): the bonus community, only if you choose to join. Skool's own privacy policy applies there.

We may also disclose data if required by law, to protect our rights, or to a buyer if our business is sold, in which case this policy continues to apply.

5. International transfers

Some providers are located, or store data, outside the EU/EEA and UK, especially in the USA. When that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified.

6. How long we keep it

• Account and training data: for as long as your account is active. If you ask us to delete your account, or after a refund, we delete it within 30 days.
• Purchase and invoice records: for as long as tax and accounting laws require (up to 10 years).
• Marketing data: until you unsubscribe or withdraw consent.
• Technical logs: usually for up to 12 months.

7. Your rights

Depending on where you live, you have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• delete your data ("right to be forgotten"), except where we must keep it by law;
• restrict or object to processing, including direct marketing at any time;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• complain to your data protection authority (for example in your EU country, or the ICO in the UK).

US residents: depending on your state (for example California), you can ask to know, access, correct or delete your personal information, and to opt out of "sale" or "sharing" for targeted advertising. We don't sell personal information for money. You can opt out of advertising cookies through the cookie banner or by emailing us. We won't discriminate against you for using these rights.

To use any of these rights, email gabriele@gabrielevianello.fit from the address linked to your account. We reply within 30 days and may ask you to confirm your identity.

8. Cookies and local storage

• Essential: needed for checkout, login and security. These don't require consent.
• App storage: the App saves your session and settings in your browser's local storage so it works smoothly and offline. This is essential to the service you requested.
• Advertising and analytics: the Meta Pixel helps us measure ad performance and reach people interested in our programme. It runs only after you accept it in the cookie banner, and you can change your choice at any time.

You can also block or delete cookies in your browser settings; some features may then stop working.

9. Security

We use encrypted connections (HTTPS), hashed passwords, access controls that keep each user's data separate, and reputable providers. No system is 100% secure. If a breach affects your data, we will notify you and the authorities as the law requires.

10. Children

Our services are intended for adults aged 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as our services or the law change. The current version is always on this page, with its "last updated" date. For significant changes we will notify customers by email.

12. Contact

For any privacy question or request: gabriele@gabrielevianello.fit
Gabriele Vianello · Paseo Las Canteras 31, Las Palmas de Grancanaria, Spain