Legal
Plain English summary: We collect only what we need to process your purchase and deliver your product. We do not sell your data. We do not use advertising trackers. The only third party that receives your payment information is Stripe, which processes it securely. You have full rights over your data under GDPR.
This Privacy Policy applies to SteFit, operating under the brand and website stefitmethod.com. SteFit is the data controller responsible for your personal data collected through this website and in connection with purchases of our digital products.
Contact: [email protected]
We collect the minimum data necessary to operate the website and process purchases. We do not collect data beyond what is listed below.
| Data type | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| Email address | To deliver your purchased product and send your receipt | Contract performance (Art. 6(1)(b)) |
| Name | To personalise your receipt and identify your order | Contract performance (Art. 6(1)(b)) |
| Payment data | To process your payment securely via Stripe | Contract performance (Art. 6(1)(b)) |
| Purchase history | To manage your order, resolve disputes, comply with tax obligations | Legal obligation (Art. 6(1)(c)) |
| Cookie preferences | To record your consent decision on the cookie banner | Consent (Art. 6(1)(a)) |
| Basic analytics (if accepted) | To understand how visitors use the site and improve it | Consent (Art. 6(1)(a)) |
We do not collect sensitive personal data (health, biometric, financial account data). We do not use advertising pixels, retargeting cookies, or social media tracking scripts.
Our website uses a minimal set of cookies:
We do not use cookies for advertising, profiling, or cross-site tracking.
You can withdraw your consent at any time by clearing your browser's local storage for this site, or by contacting us at [email protected] and we will reset your preference.
Your data is used exclusively for the following purposes:
We do not use your data for marketing emails unless you have separately and explicitly opted in. We do not build profiles, segment audiences, or sell your data to any third party.
We share your data only with the following third parties, strictly to the extent necessary:
| Third party | Purpose | Data shared | Their privacy policy |
|---|---|---|---|
| Stripe | Payment processing | Name, email, payment card data | stripe.com/privacy |
| Netlify | Website hosting | IP address (standard server logs) | netlify.com/privacy |
| Cloudflare | DNS, email routing | Email metadata (sender, subject) | cloudflare.com/privacypolicy |
| Google Fonts | Typography | IP address (font loading request) | policies.google.com/privacy |
No other third parties receive your personal data. We do not use Facebook Pixel, Google Ads, TikTok Pixel, or any other advertising or social media tracking technology.
Stripe and Netlify are US-based companies. Where data is transferred outside the European Economic Area, such transfers are covered by appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission. You can request details of these safeguards by contacting us.
We retain your personal data only for as long as necessary:
After the applicable retention period, data is permanently deleted.
As a data subject in the European Economic Area, you have the following rights:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before actioning your request.
You also have the right to lodge a complaint with your national supervisory authority. In Italy, this is the Garante per la protezione dei dati personali (garanteprivacy.it).
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is handled exclusively by Stripe, which is PCI DSS Level 1 certified — the highest level of payment security certification available. We do not store payment card details on our systems.
Email communications containing download links use time-limited, unique links where possible. If you believe your data has been compromised, contact us immediately at [email protected].
Our products and website are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the date at the top of this page and, where feasible, by email to affected customers. We encourage you to review this page periodically.
SteFit — Data Controller
Email: [email protected]
Website: stefitmethod.com
For GDPR-related requests, include "GDPR Request" in the subject line of your email.