Privacy Policy
Last updated 24 August 2026
This policy explains what personal information [Legal entity name], trading as Train with Gabi, collects when you use this site, why we collect it, who else sees it, and what you can ask us to do with it.
The short version: we collect your name and email, and nothing more than we need. We don't run ads, we don't track you across the web, and we don't sell your data to anyone.
1. Who is responsible for your data
The data controller is [Legal entity name], [Registered business address]. For anything in this policy, contact gabi@trainwithgabi.com.
2. What we collect
If you join the coaching waitlist
The name and email address you type into the form. That's it — there are no other fields.
If you buy a program
Checkout happens on Stripe's hosted payment page, not ours. Your card number never reaches our servers and we never see or store it. From the completed order we receive your name, email address, the product bought and the amount paid. Stripe may also collect billing address and tax-location details to process the payment and meet its own legal duties.
To send you your downloads we create a signed link containing the product you bought and your email address. That link is valid for 7 days and then stops working.
Automatically, when you visit
Our host keeps standard server logs — IP address, browser and device type, the page requested, the time. These exist to keep the site running and secure, not to profile you.
We also count visits with Vercel Web Analytics, a privacy-friendly measurement tool. It records the page you viewed, the site that referred you, and your device type, browser and country. It sets no cookies, does not store your IP address, and identifies a visitor only by a temporary anonymous hash, so it cannot recognise you personally or follow you to other websites.
What we never collect
- Card, bank or payment details (Stripe handles those)
- Passwords — there are no accounts on this site
- Health data, weight, measurements or photographs of you
- Anything from anyone we know to be under 18
3. Why we use it, and our legal basis
| What we do | Why | Legal basis (UK/EU) |
|---|---|---|
| Deliver your purchase and download links | You bought something and we owe you it | Performance of a contract |
| Answer your emails and handle refunds | Customer support | Contract / legitimate interests |
| Keep you on the coaching waitlist and contact you when a place opens | You asked to be told | Consent |
| Keep records of sales | Tax and accounting obligations | Legal obligation |
| Keep the site online and prevent fraud or abuse | Security | Legitimate interests |
| Count page views and see where visitors come from | Understand what's useful and improve the site | Legitimate interests |
Where we rely on consent — the waitlist — you can withdraw it at any time, and that doesn't affect anything done beforehand.
Marketing: joining the waitlist signs you up to hear about 1-on-1 coaching. If we ever start sending broader marketing emails, every one will carry a one-click unsubscribe link.
4. Who else sees your data
We don't sell your personal information, and we don't share it for anyone else's advertising. We do use a small number of service providers to run the business. Each processes data on our instructions:
| Provider | What it does | What it sees |
|---|---|---|
| Stripe | Payment processing | Name, email, card and billing details, purchase |
| Resend | Sends your download and waitlist emails; stores the waitlist | Name, email, message contents |
| Vercel | Hosts the site and the download system; provides our cookieless visitor counts | IP address, server logs, anonymised page view data |
| Google Fonts | Serves the site's typeface | Your IP address, when the font loads |
| jsDelivr / Tailwind CDN | Serves the site's stylesheet | Your IP address, when the page loads |
Google Fonts and the stylesheet CDN load from their own servers, which means your IP address is visible to them whenever you open a page here. That happens on a very large share of the web, but you're entitled to know it happens here.
We may also disclose information if the law requires it, or to establish or defend a legal claim.
5. Cookies
This site sets no cookies of its own. Our visitor counting (Vercel Web Analytics) is cookieless: it stores nothing on your device and cannot follow you to other websites. There is no advertising pixel, no Meta or TikTok tracking, and no cross-site profiling, which is why you won't see a cookie banner here.
When you click through to pay, Stripe sets cookies on its own checkout pages to process the payment and prevent fraud. Those are governed by Stripe's privacy policy.
6. How long we keep it
- Download links — expire 7 days after purchase.
- Waitlist entries — until you ask to be removed, or until the list is closed.
- Order and payment records — as long as tax and accounting law requires, typically 6–7 years, held mainly by Stripe.
- Support emails — normally up to 2 years after your last message.
- Server logs — short-term, per our host's retention settings.
7. Your rights
Wherever you live, you can email us to see what we hold about you, correct it, or have it deleted. We'll respond as quickly as we can and within any deadline the law sets.
If you're in the UK or EU (UK GDPR / GDPR)
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first.
If you're in California or another US state with a privacy law
You have the right to know what personal information we collect and why, to request deletion, to request correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.
8. Where your data goes
Our providers are largely US-based, so your information may be processed in the United States and other countries. Where data moves out of the UK or European Economic Area, our providers rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
9. Children
This site and these programs are for adults aged 18 and over. We don't knowingly collect information from children. If you believe a child has given us their details, email us and we'll delete them.
10. How we protect it
The site is served over HTTPS. Payments are handled entirely by Stripe, so card data never touches our systems. Download links are cryptographically signed, tied to a single purchase, and expire after 7 days. Access to the systems holding customer data is limited to Gabi.
No method of transmission or storage is completely secure, and we can't guarantee absolute security — but if a breach ever affects your rights, we'll notify you and the relevant regulator as the law requires.
11. Changes to this policy
If we change how we handle your data — for example by adding analytics — we'll update this page and move the "last updated" date at the top. Material changes affecting your rights will be flagged more prominently.
12. Contact us
Questions, or want to exercise any of the rights above? Email gabi@trainwithgabi.com.
[Legal entity name]
[Registered business address]