This Privacy Policy is issued pursuant to articles 13 and 14 of EU Regulation 2016/679 (GDPR) and describes how 8 PER TE collects, uses, and protects the personal data of users of the progressive web app (PWA) accessible at https://app.8perte.com.
1. Data Controller
Marco Mazzanti, self-employed professional
VAT (P.IVA): 01781320385
Address: Via Amilcare Ponchielli 7, 40141 Bologna (BO), Italy
Email: info@8perte.com
For any questions or to exercise the rights granted by the GDPR, write to info@8perte.com.
2. Service description
8 PER TE is a digital postural exercise program of 8 weeks delivered through a PWA installable on iOS, Android, and desktop browsers. The service includes a free trial (Week 1), an option to purchase a single week (€19), and a complete Pack (€88). Details are in the Terms and Conditions of Use.
3. Categories of personal data collected
3.1 Data provided by the user upon registration
- first name and last name;
- email address;
- password (stored in encrypted form with bcrypt 10-round algorithm);
- (optional) phone number.
3.2 Data collected automatically during use
- exercise logs: video identifier, viewing percentage, start and end timestamps, device used (e.g. “iPhone Safari”);
- routine completion dates, for the purpose of calculating program adherence;
- VAS feedback (Visual Analog Scale 1-5) and free text notes voluntarily entered by the user at the end of a session;
- technical session logs (IP address, user-agent, last access date) for security purposes.
3.3 Payment data
In case of purchase, Stripe Payments Europe Ltd (Ireland) collects and processes the payment card data as an autonomous controller. The 8 PER TE controller receives from Stripe only: transaction identifier, amount, currency, buyer's email, billing address and, where applicable, tax code (codice fiscale) or VAT number. These billing data are also processed to fulfil Italian tax obligations (issuing an invoice or receipt).
3.4 Push notification subscriptions
If the user activates push reminders, the browser generates a “subscription” (endpoint URL + cryptographic keys) that is stored on our servers to enable sending. No additional personal information is linked to this endpoint.
3.5 Marketing measurement data (only with consent to marketing cookies)
If the user grants consent to marketing cookies via the dedicated banner, the App uses the Meta Pixel and Meta's Conversions API to measure advertising campaign effectiveness. In that case the following are processed:
- Meta Pixel identifiers stored in cookies (
_fbp,_fbc); - pages visited and conversion events (registration, checkout initiation, purchase);
- IP address and user-agent.
Some identifying data (email, first name, user identifier) are transmitted to Meta in SHA-256 hashed (pseudonymized) form, solely to match conversions to campaigns. Without consent, no marketing cookie or event is activated.
3.6 Usage statistics data (only with consent to statistics cookies)
If the user grants consent to statistics cookies, we use Microsoft Clarity for anonymous session recordings and heatmaps (pages viewed, clicks, scrolling). Input fields are automatically masked. It is used only to understand how the app is used and improve it. Without consent, Clarity is not loaded.
3.7 Data NOT collected
8 PER TE does NOT collect:
- health data, medical diagnoses, clinical anamnesis;
- biometric data (steps, heart rate, sleep, etc.);
- photos, videos, or recordings of the user;
- precise geographical location;
- contacts from the device's address book.
4. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Service delivery (account, content access, adherence calculation) | Performance of the contract — art. 6(1)(b) GDPR |
| Payment and invoicing management | Performance of the contract + legal tax obligations — art. 6(1)(b)(c) GDPR |
| Service communications (verification email, password reset, program-related notifications) | Performance of the contract — art. 6(1)(b) GDPR |
| Push reminders of the program (8:00 AM, 9:00 PM) | Explicit user consent — art. 6(1)(a) GDPR, revocable at any time |
| Nurturing emails for free trial users (4 emails in the first 8 days) | User's explicit consent — art. 6(1)(a) GDPR, given via an optional checkbox at registration and revocable at any time. Without consent these emails are not sent |
| Method Guarantee (verification of adherence in case of refund request) | Performance of the contract — art. 6(1)(b) GDPR |
| Advertising campaign measurement (Meta Pixel and Conversions API) | Explicit user consent — art. 6(1)(a) GDPR, revocable at any time |
| App usage statistics (Microsoft Clarity) | Explicit user consent — art. 6(1)(a) GDPR, revocable at any time |
| System security (IP logs, fraud prevention, rate limiting) | Legitimate interest — art. 6(1)(f) GDPR |
5. Data recipients
Data may be communicated to:
- Vercel Inc. (USA, with standard SCC DPA): hosting the App frontend;
- Railway Corp. (USA, SCC + data hosted in Europe-West): hosting the backend and PostgreSQL database;
- Stripe Payments Europe Ltd (Ireland): payment processor, autonomous controller;
- Resend (Resend.com Inc., USA, SCC): transactional email delivery (account verification, password reset, purchase notifications, trial nurturing emails);
- Vimeo Inc. (USA, SCC): streaming infrastructure for routine and insight videos. Users who play a video directly access Vimeo servers (no proxy);
- Spreaker (iHeartMedia Inc., USA, SCC): streaming infrastructure for meditation podcasts;
- Google Inc. (USA, SCC): if the user opens the App via Chrome browser, Google receives technical traffic data like any website;
- Meta Platforms Ireland Ltd. (Ireland, with possible transfer to the USA): advertising campaign measurement via Meta Pixel and Conversions API, solely upon consent to marketing cookies. Identifying data is transmitted in hashed (SHA-256) form;
- Microsoft Corporation (USA, SCC): anonymous usage statistics via Microsoft Clarity (session recordings and heatmaps), solely upon consent to statistics cookies;
- Marco Mazzanti, Controller: for operational consultation and refund management under the Method Guarantee.
No data is sold, transferred, or shared with third parties for the marketing purposes of parties other than the Controller.
6. Extra-EU transfers
Some of the providers listed above (Vercel, Railway, Resend, Vimeo, Spreaker, Google, Meta, Microsoft) are based in or process data in the United States. The extra-EU transfer takes place on one of these bases: for providers certified under the EU-USA Data Privacy Framework (DPF) (including Google, Meta, Microsoft, Stripe) the transfer is covered by the European Commission's adequacy decision of 10 July 2023; for the other providers, the Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914/EU) apply.
7. Retention periods
| Category | Duration |
|---|---|
| Account data (name, email, password) | Until cancellation requested by user, or maximum 24 months from last access; inactive accounts are then automatically deleted with prior email warning |
| Exercise logs and VAS feedback | Until account deletion or for a maximum of 24 months from the user's last access, after which irreversibly anonymized for statistical purposes |
| Payment and billing data | 10 years as required by Italian tax obligation (art. 2220 Civil Code, DPR 633/72) |
| Push subscriptions | Until user opt-in revocation or account deletion |
| Technical logs (IP, sessions) | 12 months |
| Email logs (Resend) | 30 days as per provider policy |
8. Rights of the data subject
In compliance with the GDPR, the user has the right to:
- access their personal data (art. 15);
- obtain rectification (art. 16);
- obtain erasure (art. 17 — “right to be forgotten”), subject to tax obligations for payment data;
- obtain restriction of processing (art. 18);
- obtain portability in structured format (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw the consent given at any time (art. 7), for example for push notifications or nurturing emails;
- lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Rights are exercised by writing to info@8perte.com. The response is provided within 30 days.
9. Cookies and similar technologies
The App uses technical cookies necessary for functioning (e.g. NextAuth session cookie, consent cookie), always active as they are indispensable. Upon the user's optional consent, the App also uses Meta marketing cookies and technologies (Meta Pixel: _fbp, _fbc) to measure advertising campaign effectiveness; the related events may also be sent server-side via the Conversions API, with identifying data in hashed form. Also upon optional consent, it uses statistics cookies (Microsoft Clarity) for anonymous session recordings and heatmaps, with input fields masked. Without consent, no marketing or statistics cookie is installed.
On first access a banner is shown to choose preferences; the user can change or withdraw them at any time via the “Cookie preferences” button in the App. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. A separate cookie policy applies to the 8perte.com showcase site.
10. Data security
The Controller adopts appropriate technical and organizational measures, including:
- mandatory HTTPS/TLS on all connections;
- user passwords encrypted with bcrypt;
- database environment isolated from the showcase site (dedicated schema);
- daily encrypted backups;
- rate-limiting on sensitive endpoints (login, password reset) to prevent automated attacks;
- access to the administrative panel protected by strong credentials and IP verification.
11. Minors
The service is intended for adults (≥ 18 years). We do not intentionally collect data from minors. Should the Controller become aware of a minor's registration, the account will be immediately deleted.
12. Changes to the policy
Any changes will be communicated via email to registered users and through a visible notice in the App. The “Last updated” date at the bottom indicates the current version.
Contact: info@8perte.com — Marco Mazzanti — VAT 01781320385 — Bologna, Italy.
See also: Terms and Conditions of Use.