Privacy Policy

The data controller is Gymnalyzer, reachable at [email protected]. This policy will be updated with full legal entity details upon formal incorporation.

This policy is issued pursuant to Article 13 of EU Regulation 2016/679 (GDPR) and Article 13 of Legislative Decree No. 196/2003 (Italian Privacy Code), as amended by Legislative Decree No. 101/2018.

No Data Protection Officer (DPO) has been appointed, as the processing activities carried out do not meet the thresholds set out in Article 37 GDPR.

When you join our waitlist, we collect only your email address. We do not collect names, payment details, or any special categories of personal data.

Our hosting infrastructure (Vercel Inc., acting as our data processor under Article 28 GDPR) may automatically log your IP address in server access logs for security and abuse-prevention purposes. These logs are retained for a maximum of 30 days and are not used to identify individual users.

We use Vercel Analytics to measure aggregate site traffic. Vercel Analytics does not use cookies, does not assign persistent identifiers to individual users, and does not collect personal data within the meaning of the GDPR.

We additionally use PostHog (PostHog Inc., eu.posthog.com) to measure aggregate site traffic, campaign performance (UTM parameters), and product analytics. PostHog is configured to use the EU-region cloud and does not use third-party cookies. Data is stored on EU-region servers.

Your email address is collected solely to send you a launch notification when Gymnalyzer becomes available. The legal basis for this processing is your freely given, specific, informed and unambiguous consent pursuant to Article 6(1)(a) GDPR.

We will never use your email address for any other purpose without obtaining separate, fresh consent.

The waitlist is intended for users aged 14 or over. Under Article 2-quinquies of Legislative Decree No. 196/2003, in Italy the minimum age for consent-based processing of personal data is 14 years. If you are under 14, please do not submit your email address without the consent of your parent or legal guardian.

We retain your email address until whichever of the following occurs first: (a) you unsubscribe via the link in any email we send or at gymnalyzer.com/unsubscribe; (b) we have sent the launch notification following the product going live; or (c) two years from the date of sign-up.

After the applicable retention period expires, your email address is securely and permanently deleted.

As a data subject you have the right to: (i) access your personal data (Art. 15); (ii) rectify inaccurate or incomplete data (Art. 16); (iii) erasure ('right to be forgotten') (Art. 17); (iv) restriction of processing (Art. 18); (v) data portability (Art. 20); (vi) object to processing (Art. 21); (vii) withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)).

To exercise any of these rights, send a written request to [email protected]. We will respond without undue delay and at the latest within 30 days of receipt. The exercise of these rights is free of charge.

You have the right to lodge a complaint with the Italian Data Protection Authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma www.garanteprivacy.it. You may also contact the supervisory authority of your EU member state of habitual residence.

We implement appropriate technical and organisational measures (including encryption in transit and access controls) to protect your personal data against accidental loss, unauthorised access, disclosure, alteration or destruction.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by Article 34 GDPR.

We do not sell, rent or share your personal data with third parties for their own marketing purposes.

We engage the following data processors under Article 28 GDPR data processing agreements: Vercel Inc. (hosting and analytics infrastructure), Cloudflare Inc. (CDN, DDoS protection and DNS), Neon Inc. (serverless PostgreSQL database, EU Frankfurt region), and PostHog Inc. (product analytics, EU region servers). All processors operate under adequate safeguards; where servers are located outside the EEA, Standard Contractual Clauses (SCCs) apply. No transfers to third countries outside the EEA are carried out without adequate safeguards.

An up-to-date list of sub-processors is available on request at [email protected].

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects, within the meaning of Article 22 GDPR.

This website does not use tracking, profiling or marketing cookies. The hosting infrastructure may set strictly necessary session cookies. No cookie consent banner is required under the Italian implementation of the ePrivacy Directive for technically essential cookies.

We may update this Privacy Policy from time to time. If the changes are material, we will notify you by email before they take effect. The 'Last updated' date at the top of this page always reflects the most recent revision.

For any privacy-related questions, requests or complaints, contact us at [email protected].