Privacy policy
1. Data controller
Hellen Christina Jesus e Silva, tax number 302354271, based at Rua Dr. Angelo Ferrari, n.º 3, 1.º Drt., Quinta dos Canários, 2500-113 Caldas da Rainha, Portugal. Privacy contact: support@gymzoneapp.com.
This policy explains what personal data we process, why, and what rights you have under Regulation (EU) 2016/679 (GDPR).
2. Data we process
- Order data: name, email address and billing details, collected by Stripe during payment.
- Contact data: whatever you send us by email.
- Technical data: IP address, device type, browser and pages visited, recorded in server logs for security and diagnostics.
We never collect or have access to payment card data. It is handled directly by Stripe.
We do not process special categories of data. The program collects no health data, body measurements or medical history.
3. Purposes and legal basis
- Processing your order and delivering the product — performance of the contract (Art. 6(1)(b) GDPR).
- Answering support requests — contract performance and legitimate interest (Art. 6(1)(b) and (f)).
- Tax and accounting obligations — legal obligation (Art. 6(1)(c)).
- Site security and fraud prevention — legitimate interest (Art. 6(1)(f)).
We do not send marketing without prior consent and we do not carry out profiling or automated decision-making.
4. Processors
- Stripe Payments Europe, Ltd. (Ireland) — payment processing.
- Resend — transactional delivery emails.
- Vercel Inc. — site hosting and serverless functions.
5. International transfers
Some providers may process data outside the European Economic Area, always under the standard contractual clauses approved by the European Commission or another valid mechanism.
6. Retention periods
- Billing data: 10 years, as required by tax law.
- Order and support records: 5 years after the last interaction.
- Technical logs: up to 12 months.
7. Your rights
You may request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent where consent is the legal basis.
Requests go to support@gymzoneapp.com and are answered within 30 days at the latest.
You also have the right to lodge a complaint with the Portuguese supervisory authority, CNPD (cnpd.pt), or with the authority in your country of residence.
8. Security
The site is served exclusively over an encrypted connection (HTTPS). Payment and email service keys exist only in server environment variables and are never exposed to the browser.
9. Minors
Our products are intended for people aged 18 or over. We do not knowingly collect data from minors.
10. Changes
This policy may be updated. The date of the latest update is shown at the top.