Privacy Policy
Last updated: September 2026
1. Controller
The controller responsible for data processing under the GDPR is:
Grow Inside LLC
30 N Gould St
Sheridan, WY 82801
USA
Email: info@grow-inside.de
Represented by: Stefanie Lackas. Offered under the brand Grow Fit Academy.
2. Data we collect
We collect the following personal data:
- Name and email address (on registration / magic link)
- Payment data (processed by Stripe or HitPay; we do not store full credit card details)
- Learning progress and quiz/exam results
- Practice exam videos (technique, teaching sample, test video), if you upload them
- Technical data (IP address, browser, device type)
3. Purpose of processing
We process data to provide the e-learning platform, process payments, improve learning content, and communicate with users.
4. Legal basis
Processing is based on Art. 6(1)(b) GDPR (performance of a contract), (c) (legal obligation), and (f) (legitimate interest in secure operations and abuse prevention).
5. Retention
We store personal data only as long as needed to perform the contract or as required by statutory retention rules (depending on document type, up to 10 years).
6. Video exam
For the practice video requirement (Fitness Trainer B/A) you may upload exam videos. Legal basis is your consent (Art. 6(1)(a) GDPR); no upload without the checkbox. Purpose is exam marking only – no advertising and no AI training on your videos.
Videos are deleted: (a) when the video part is passed, (b) otherwise at latest 90 days after upload, (c) anytime via “Delete video” or withdrawal of consent. Scores and written reasons without the media file may remain in the exam record. Contact and withdrawal: info@grow-inside.de.
7. Your rights
Users have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Contact info@grow-inside.de.
8. Cookies & tracking
We use cookies and similar technologies. Necessary cookies are required for operation, login, and security (Art. 6(1)(b)/(f) GDPR). Analytics and marketing cookies (e.g. Google Analytics / Google Ads tag and Meta / Facebook Pixel) are used only with your consent (Art. 6(1)(a) GDPR). Without consent these services are not loaded.
You can change or withdraw your choice anytime via “Cookie settings” in the footer. After withdrawal, future loads of the respective tags are blocked.
9. Third parties
We use, among others: Supabase (auth, database, storage), Stripe (payments), HitPay (payments on our Philippine pages), Vercel (hosting). Additionally – only with consent – Google (analytics / ads) and Meta Platforms (Facebook Pixel) may be used. Each provider processes data under its own privacy terms and, where required, with appropriate safeguards (e.g. DPAs / Standard Contractual Clauses).
10. International transfers
The controller is based in the USA. Personal data may therefore be transferred to the USA and possibly other third countries. Where the GDPR applies, transfers only take place with an appropriate legal basis (e.g. Standard Contractual Clauses, adequacy decision, or explicit consent).
11. Payment processing via HitPay
For payments on our Philippine pages we use HitPay Payment Solutions Pte. Ltd., 88 Market Street, #40-01, CapitaSpring, Singapore 048948 (UEN 201605883W). Data processed: name, email address, amount, currency and product, payment method and payment data (e.g. GCash/Maya account, card data – processed by HitPay and its payment partners, not stored by us), transaction ID, IP address and device/browser data. Purpose: processing your payment, fraud prevention and legal obligations. Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and secure payments). HitPay may process data in Singapore and the Philippines (including local payment partners such as GCash or Maya). There is no EU adequacy decision for these countries; where the GDPR applies, transfers are based on suitable safeguards, in particular EU standard contractual clauses (Art. 46(2)(c) GDPR), or otherwise on Art. 49(1)(b) GDPR (necessary for the contract). For its own legal obligations (e.g. anti-money laundering) HitPay acts as an independent controller. More: https://hitpayapp.com/privacy-policy