Legal
Privacy Notice
1. Who we are
Euler Functions Ltd, trading as StanFit, is the controller of your personal data. Company number 13076385, registered in England and Wales. Registered office: Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicestershire, LE2 2FL.
For anything about how we handle your data, contact enquiries@stanfit.uk.
2. What data we collect, and why
| Category | Examples | Why |
|---|---|---|
| Contact & account | Name, email, phone/WhatsApp number, billing address | To set you up as a client and communicate with you |
| Health & injury | Medical conditions, medication, injuries, physical limitations, pregnancy status where disclosed | To design a safe training programme — special category data, see section 4 |
| Training & nutrition data | Training history, equipment, schedule, exercise preferences, food diary, goals, check-in responses | To build and adjust your programme and nutrition plan |
| Progress data | Body measurements, weight, body composition, progress photos, and data from a phone or watch you connect to the app (such as steps and heart rate), where you choose to share them | To track your progress with you |
| Payment data | Subscription status, payment history | Card details are handled by Stripe — we never see or store them |
| Communications | WhatsApp and email messages with your coach | To deliver coaching and keep a record if there's ever a dispute |
| Sign-up records | The wording you agreed to when you signed up, the date and time, your IP address and browser | To show what you agreed to, if it's ever questioned — see section 4 |
We do not use cookies or website analytics. This site makes no requests to third parties when you browse it — even our fonts are hosted by us, not by a third-party font service.
3. Where this data comes from
Directly from you — through this website, our checkout, WhatsApp, and the coaching app (Everfit) we use to deliver your programme. If you connect a phone or watch to the app, it may share things like your steps and heart rate with us. That's your choice, and you can disconnect it at any time.
4. Our lawful basis for processing
Most of what we collect is ordinary personal data, which we process because it's necessary to perform our contract with you (UK GDPR Article 6(1)(b)).
Health-related information is "special category data" under Article 9, and needs an extra layer of justification on top of Article 6. We rely on your explicit consent (Article 9(2)(a)).
At checkout, and before we collect any health information from you, we ask you to give a clear, standalone statement of consent — separate from any other box you tick — naming the kind of data involved: health conditions, injuries, medication, body measurements, weight, body composition, progress photos, and data from a phone or watch you choose to connect.
You can withdraw that consent at any time by telling us. Because we can't safely or lawfully design your programme without this information, withdrawing it means we can't continue coaching you, and your subscription would end.
When you sign up, we keep a record of what you agreed to: the wording, the date and time, your IP address and your browser. The law expects us to be able to prove what you agreed to, so we rely on our legitimate interest in being able to show it (Article 6(1)(f)).
5. Who we share your data with
We use the following companies to deliver the service. Except where we say otherwise below, each one processes your data only on our instructions, under a data processing agreement.
| Company | What they do for us | Where |
|---|---|---|
| Everfit | The coaching app that delivers your programme, nutrition plan and check-ins, and holds anything you log or sync in it | United States |
| WhatsApp (Meta) | Coaching messages between you and your coach | United States |
| Stripe | Card payments and subscriptions. Stripe holds your card details; we don't | Ireland and the United States |
| Our email, the inbox where your coach reads your messages, and the secure backup of our coaching records | United States | |
| Hetzner | Hosts the server that runs our coaching system and holds your records | European Union |
| Cloudflare | The secure connection that carries messages and payment notifications to our server | United States |
| Anthropic | AI tools we use to build and run our coaching system | Ireland and the United States |
Stripe is also a controller in its own right for some purposes, such as preventing fraud and meeting its legal duties as a payment provider; its own privacy policy covers that. Your WhatsApp account itself is covered by WhatsApp's privacy policy.
We use Claude, Anthropic's AI assistant, under Anthropic's standard terms to help build and run our systems. It can see your name and training records but never your health information, and we have switched off its use of our conversations for training. We rely on our legitimate interest in running the service efficiently for this.
We do not sell your data, and we do not share it for anyone else's marketing.
6. International transfers
Some of these companies are outside the UK. Here is how each transfer is protected:
- Hetzner (European Union): UK law recognises the EU as giving adequate protection, so no further safeguard is needed.
- Google, Cloudflare and Stripe (United States): each is certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as giving adequate protection. Stripe contracts with us through its Irish company, which the EU recognition above also covers.
- WhatsApp (Meta) (United States): the WhatsApp Business UK Data Transfer Addendum, which forms part of WhatsApp's business terms.
- Anthropic (Ireland and the United States): we deal with Anthropic's Irish company, which UK law recognises as giving adequate protection. For our business account, its processing in the United States is also covered by the UK Addendum to the EU Standard Contractual Clauses, in Anthropic's data processing addendum.
- Everfit (United States): Everfit's data processing agreement, which includes the EU Standard Contractual Clauses, and encryption in transit and at rest.
You can ask for a copy of the safeguard that covers any of these companies by emailing enquiries@stanfit.uk.
7. How long we keep your data
We keep your data for as long as you are a StanFit client, and for 6 years after your subscription ends, to meet our legal, accounting and insurance obligations and to defend or bring a claim if we ever need to. After that, it is securely deleted. If you'd like your data deleted sooner, contact us — see section 9 on your right to erasure, which we will honour unless we have a legal reason to keep it for the period above.
Progress photos are the exception: we delete them 12 months after your subscription ends, unless a complaint or claim involving you is still open, in which case we keep them until it is resolved.
If you get in touch but don't become a client, we delete what you sent us 12 months after our last exchange.
8. Automated processing
We use software to help design and adjust training programmes from the information you give us. Your coach directs and reviews this process — it is not used to make a decision about you with legal or similarly significant effect, and you can always ask your coach about how your programme was built.
9. Your rights
Under UK data protection law, you have the right to:
- Ask us what personal data we hold about you, and get a copy of it
- Ask us to correct data that's inaccurate or incomplete
- Ask us to delete your data, subject to section 7
- Ask us to restrict how we use your data in certain circumstances
- Ask us to move your data to another provider, where technically possible
- Object to processing based on our legitimate interests — though most of our processing is based on contract or your explicit consent, not this
- Withdraw your consent to health-data processing at any time — see section 4
To exercise any of these, email enquiries@stanfit.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put things right first.
10. Children
StanFit is for adults. We don't knowingly collect data from anyone under 18, and our service isn't available to under-18s — see our Terms of Service.
11. Security
We use appropriate technical and organisational measures to protect your data, including the processors listed in section 5, all of whom are required to protect your data to a comparable standard.
12. Changes to this notice
We may update this notice from time to time, for example if we start using a new processor or a law changes. We will post the update here and change the date at the top of this page.
13. Contact
Euler Functions Ltd, trading as StanFit. Registered office: Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicestershire, LE2 2FL. Email: enquiries@stanfit.uk.