Privacy Notice

1. DMs and setting conversations. What you write me on Instagram or TikTok (your goal, your situation, what you have tried) so I can answer you and work out whether coaching fits. Legal basis: legitimate interest (Article 6(1)(f)) in responding to people who contact me. Health details do not belong in DMs; the screening happens later in signed documents, and health information volunteered in a DM is not used for coaching decisions.

2. Booking and the discovery call. Your name, email, and calendar booking (via Calendly), and a recording of the call for my own script review, made only if you agree at the top of the call. Legal basis: steps taken before entering a contract (Article 6(1)(b)) for the booking; consent (Article 6(1)(a)) for the recording. If you do not sign up, recordings and my notes about you are deleted after the review pass, at the latest 90 days after our last contact.

3. Delivering the coaching. Your contact details, schedule, and food preferences (Article 6(1)(b), the contract), and your health data: injuries and medications, daily weight, food and training logs, and progress photos used for coaching (Article 9(2)(a), your explicit consent).

4. Payments and bookkeeping. Your name, address, and payment records, processed through Stripe, kept because Danish bookkeeping law requires it (Article 6(1)(c)).

5. The website (bruceworld.xyz). When you give your email to get the free guide, I store it and send you the guide plus a short series of follow-up emails about training, nutrition, and the paid Complete Guide. Legal basis: your consent (Article 6(1)(a)); every email carries a one-click unsubscribe and you can opt out at any time. The guide files are hosted on Vercel Blob and the emails are sent through Resend. If you buy the Complete Guide, your email and payment run through Stripe to deliver the download (Article 6(1)(b), the contract, and Article 6(1)(c), bookkeeping). Page views are counted with Plausible and Vercel Analytics, both cookieless and aggregate, with nothing that identifies you personally.

• Everfit (the coaching app): screening answers referenced in tasks, weight, logs, photos, messages. Everfit acts partly as my processor and partly as an independent controller under its own terms, and stores data on US servers under the standard contractual clauses in its data-processing agreement.
• Stripe (payments): your payment details, as an independent controller and processor under its own terms; Stripe is certified under the EU-US Data Privacy Framework.
• Resend (email delivery for the website list and the coaching emails): your email address, as a processor under its terms.
• Vercel (website hosting, file storage for the guides, and cookieless analytics), as a processor under its terms.
• Plausible (cookieless page-view analytics): aggregate data only, as a processor under its terms.
• Calendly (booking) and Google Meet (the discovery and onboarding calls), as processors under their terms.
• DocuSeal(document signing): the onboarding documents you sign, including the health screen's answers, as a processor under its terms, with the data hosted in the EU.
• Meta (Instagram) and TikTok, when you message me there: independent controllers under their own policies.
• Dinero, for invoices and accounts.

• Signed agreements, invoices, and payment records: 5 years from the end of the financial year, per Danish bookkeeping law.
• Health and coaching data (logs, weight, coaching photos): deleted or anonymized no later than 24 months after the program ends.
• Leads who never sign up: DM threads stay on the platforms; my notes and call recordings are deleted at the latest 90 days after last contact.
• Website email-list contacts: kept until you unsubscribe, after which you are removed from the list.

You can ask for access to your data, correction, deletion, restriction, a portable copy, or object to processing, by writing to contact@bruceworld.xyz. Where processing rests on consent you can withdraw it at any time; withdrawing the health-data consent ends the coaching (it cannot run without that data), and withdrawing the marketing consent stops future marketing use. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).