Privacy Policy

1. Who is responsible for your data

The data controller for leanoncarbs.com and the companion app at app.leanoncarbs.com is Jeanina Vlad, trading as “Lean on Carbs”, Camino El Lance 117, 38438 Icod de los Vinos, Santa Cruz de Tenerife, Spain. Contact for privacy matters: [email protected].

2. What we collect

• Identity and contact data — your name (if provided) and email address, when you buy the program or sign in to the app.
• Transaction data — what you bought, when, the amount and currency. Payments are processed by Stripe; we never see or store your card number.
• App usage data — your reading position, bookmarks, highlights, and listening progress, so your library syncs across devices.
• Technical data — IP address, approximate country (used to show prices in your currency), browser type, and server logs kept for security.

We do not collect special-category health data. Your reading and listening activity stays inside your account and is not shared or sold.

3. Why we use it (and the legal bases under the GDPR)

• To deliver your purchase — create your account, unlock your library, send the welcome and sign-in emails (legal basis: performance of a contract).
• To run and secure the Services — logs, fraud prevention, backups (legal basis: legitimate interests).
• To meet legal obligations — tax and accounting records (legal basis: legal obligation).
• To measure our advertising — to know whether an ad we paid for (for example on Google) led to a visit or a purchase (legal basis: consent where required).
• Marketing emails — only with your consent, and every email has an unsubscribe link (legal basis: consent).

4. Who we share it with

We share personal data only with service providers who help us run the Services:

• Stripe — payment processing;
• Resend — transactional email delivery;
• Google — advertising measurement (Google Ads conversion tracking), governed by your cookie choices;
• Hosting providers — servers and database hosting in the EU;
• Cloudflare — content delivery and security.

These providers act under contracts that restrict their use of your data. We do not sell or rent personal data. Advertising-measurement data is shared with Google only as described in section 8, and you can opt out at any time.

5. International transfers

Our servers are located in the European Union. Some providers (for example Stripe, Google and Cloudflare) may process data in the United States; where they do, transfers rely on recognised safeguards such as the EU Standard Contractual Clauses or an adequacy framework.

6. How long we keep it

• Account and library data — for as long as your account exists;
• Purchase records — as long as tax and accounting law requires (typically 7–10 years);
• Server logs — up to 12 months;
• Marketing consents — until you withdraw them.

7. Your rights

European Union / EEA / United Kingdom (GDPR & UK GDPR)

You can ask for access to, correction of, or deletion of your data; ask for a copy in a portable format; object to or restrict certain processing; and withdraw consent at any time. You may lodge a complaint with your local supervisory authority (or the ICO in the UK).

United States (California CCPA/CPRA and similar state laws)

You have the right to know what personal information we collect, to request its deletion or correction, and to non-discrimination for exercising these rights. Our use of Google Ads conversion cookies on leanoncarbs.com may count as “sharing” personal information for cross-context behavioural advertising under some state laws. You can opt out at any time via the cookie banner on leanoncarbs.com (or its “Manage consent” link), and we honour your choice, including the Global Privacy Control signal.

Canada (PIPEDA)

You may request access to and correction of your personal information and withdraw consent, and you may complain to the Office of the Privacy Commissioner of Canada.

Australia (Privacy Act 1988 & APPs)

You may request access to and correction of your personal information. Complaints can be made to us first, and then to the Office of the Australian Information Commissioner (OAIC).

To exercise any right, email [email protected]. We respond within the timeframe required by the applicable law (one month under the GDPR, 45 days under the CCPA).

8. Cookies

Our sales site, leanoncarbs.com, uses the following categories:

• Strictly necessary cookies — sign-in, cart and checkout (SureCart/Stripe). Always on.
• Statistics — our analytics (Umami, self-hosted) are cookieless and anonymous.
• Advertising measurement (Google Ads) — set only according to your choices in the cookie banner; these cookies tell us whether an ad click led to a purchase. Google tags use Google Consent Mode v2 and respect your consent status.

The companion app at app.leanoncarbs.com uses only strictly necessary cookies to keep you signed in. You can change your choices at any time via the cookie banner (“Manage consent”) on leanoncarbs.com, and its Cookie Policy lists every cookie in use.

9. Children

The Services are intended for adults and are not directed at children under 16. We do not knowingly collect data from children.

10. Security

All traffic is encrypted (HTTPS/TLS), passwords are never used (sign-in is via one-time email links), access to production data is restricted, and payment data never touches our servers.

11. Changes to this policy

We will post any changes on this page and update the date above. For material changes, we will notify you by email.

12. Contact

Privacy questions and requests: [email protected].