Privacy policy

1. Controller

Simon Berriman
Sole trader (freelance)
Karl-Rothe-Str. 4
04105 Leipzig, Germany
Email: hello@banked.fit
Phone: +49 15207075439

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This website (banked.fit) presents the BANKED fitness app. You can read it without an account and without providing any personal data. We process personal data in four cases only: as technically necessary when you open the page (server logs), when you send us a message through the contact form, when you join the waitlist, and — only with your explicit consent — for usage statistics. There is no advertising, no social media plugins, no embedded videos and no fonts from third-party servers.

The app itself (app.banked.fit) has its own privacy policy: https://app.banked.fit/datenschutz.

3. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open the page, Vercel processes your IP address, time of access, requested URL, browser and device type and referrer in server logs, as technically necessary to deliver the page and to defend against attacks. Vercel is certified under the EU-US Data Privacy Framework; the EU Commission’s standard contractual clauses apply in addition. [TO VERIFY: data processing agreement with Vercel, log retention period]

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable provision).

Fonts (Inter) are served from our own server. No connection is made to Google Fonts or any other font service.

4. Storage on your device

The website itself sets no cookies. We store your privacy decision in your browser’s local storage (localStorage, key “banked.consent”: version, time, chosen categories) so we don’t ask again. Legal basis: § 25(2) no. 2 TDDDG. Details under Cookies & tracking.

5. Usage statistics with Google Analytics 4 (only with consent)

Only if you enable the “Statistics” category in the consent dialog do we load Google Analytics 4 (GA4) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before your consent no Google script is loaded and no data is sent to Google; “Google Consent Mode v2” is set to “denied” for all purposes by default.

After consent GA4 receives: the page view (path only, no query parameters), technical details such as browser, operating system, screen size, language and approximate region (Google truncates the IP address before storing it), and a pseudonymous client ID in the “_ga” / “_ga_…” cookie. Google Signals, ad personalisation and advertising cookies are disabled.

Purpose: understanding how many people visit the page and whether they go on to the app. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Retention: cookies up to 2 years; event data at Google 2 months [TO VERIFY: GA4 “data retention” setting]. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. [TO VERIFY: Google data processing terms accepted]

Withdrawal: at any time via “Cookie settings” in the footer of every page or under Cookies & tracking. On withdrawal we revoke consent towards Google, remove the script and delete the “_ga” cookies we can reach. The lawfulness of processing carried out before withdrawal is unaffected.

6. Waitlist (“Notify me”)

If you enter your email address in the form “Want to know when Plus is ready?”, a server function we operate on Vercel stores that address together with the time, the source (banked.fit) and your browser’s user-agent string in our database at Supabase (table “marketing_waitlist”), solely to inform you once when Banked Plus becomes available. Duplicate addresses are ignored. There is no newsletter and no sharing. Legal basis: Art. 6(1)(a) GDPR (consent by submitting). Retention: until the notification has been sent or you request deletion.

Deletion at any time via the contact form or by email to hello@banked.fit.

7. Contact form

If you send us a message through the contact form, a server function we operate on Vercel stores your message, your email address, the name you optionally give and your browser’s user-agent string in our database at Supabase (table “marketing_contact”) so that we can read and answer it. We use your address only to reply. Legal basis: Art. 6(1)(b) GDPR where the request concerns using BANKED, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Retention: we delete messages once the request is resolved and no retention obligations apply. The forms contain a hidden honeypot field to filter automated spam; no CAPTCHA service is used.

If you email us directly, the same applies to the details you send.

8. Recipients and transfers to third countries

• Vercel Inc. (USA) — hosting and the server functions behind the contact and waitlist forms
• Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992 — database storing contact messages and waitlist entries (server location [TO VERIFY]; data processing agreement [TO VERIFY])
• Google Ireland Limited / Google LLC (Ireland/USA) — usage statistics, only with consent

Where service providers in the USA process data, we base the transfer on the adequacy decision for the EU-US Data Privacy Framework (for certified companies) and/or the EU Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Data is passed to other third parties only where we are legally obliged to do so.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on Art. 6(1)(f) GDPR (Art. 21) and to withdraw consent with effect for the future (Art. 7(3)).

To exercise them, use the contact form or write to hello@banked.fit. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany, www.datenschutz.sachsen.de. [TO VERIFY: competence]

10. Obligation to provide data, minors, security

Using the website does not require any personal data; the contact form and the waitlist are voluntary. The website is intended for adults. The connection is TLS-encrypted throughout; we use security headers and minimise the data we process.

11. Changes

We update this policy when the website or the law changes. The current version, with its date, is always available here. If the information about services requiring consent changes materially, we will ask for your consent again.