Privacy policy — Libreta de Gym

International sales · Version 2 · effective from November 6, 2026

Text prepared with artificial intelligence tools and cross-checked with others on October 30, 2026. This is not legal advice. It does not claim compliance with any law: it describes what we do.

This policy covers anyone who buys outside Argentina, through Creem, in US dollars, anyone in Argentina who buys in dollars on this site, and anyone who visits this sales page. Anyone who buys in Argentina, on the Argentine site, has their own policy.

1. Who is responsible

The controller for the license, support, emails and this page is Ignacio Juaquin, Argentine tax ID (CUIT) 20-44629697-4, Falucho 927, Rafaela, Santa Fe, Argentina ("we", "us"). Privacy contact: privacidad@libretadegym.com, which reaches the same mailbox as soporte@libretadegym.com. The support address is on this site, on the purchase receipt and inside the app. There is no phone number.

The buyer database has its registration in progress before the National Database Registry of the Argentine Agency for Access to Public Information. No number has been assigned yet.

Armitage Labs OÜ (registry code 16977866), Rotermanni 14, Tallinn 10111, Estonia, under the name Creem, is responsible for the payment: as merchant of record it decides on its own how it processes payment data and tells you so in its own notice (https://www.creem.io/privacy). That is not us.

We do not have a data protection officer. The privacy contact above handles requests from every country. We do not have a representative in the European Union or the United Kingdom, and that is why we do not sell in those markets today: the enabled countries are listed in the legal notice. If either market is opened, this policy will publish the representative's name and address before the first sale.

2. What you log in the app does not reach us

The app and support on how to use it are in Spanish only. These legal texts are in Spanish and in English.

Exercises, weights in kilos, sessions, measurements and your notes stay only on your device, in the browser's local storage. We do not see them, we do not receive them, and we cannot recover or delete them. Backups are files you download yourself. Do not send them to us. The app has no advertising and does not measure what you do inside it.

The app works with the files already downloaded and does not send your workouts anywhere. The only thing it checks online is that your browser is activated (section 3); after that check the app opens offline for 14 days.

If you enter other people's data in the app, it stays on your phone and that is your responsibility. The app is not designed to hold the data of students or other people.

3. What data we process and why

We do not ask you for identity documents to buy through this channel. We do not receive or store your card details: Creem does.

Why we may process it. We process purchase, delivery and access data because it is necessary to perform the contract you accept when you buy. We process tax data because the law requires us to keep it. We process the IP hash in the attempts table because we have a legitimate interest in preventing abuse of the service, and it is deleted in under a day. There is no processing for advertising and no profiling. If a processing activity that needs your consent were ever added, we would ask you for it separately and you could withdraw it.

4. Who else processes it

Creem processes payment data on its own account, under its own notice (https://www.creem.io/privacy). It passes us your name, email, country and the amount so that we can deliver access. From the moment it reaches us, we process it.

These process data on our behalf, and only what each of them needs:

• Cloudflare, Inc. Hosts this sales page, the app and the Access Gate that verifies your access, and stores your activation data. United States and other countries where its network operates.
• Resend, Inc. Sends the email with your personal link and the service emails for this purchase. United States.
• Zoho Corporation. Hosts the soporte@libretadegym.com mailbox, where the emails you send us remain. United States.

Each of these providers is bound by its own data processing agreement. You can ask us for a copy by writing to privacidad@libretadegym.com.

We do not sell your personal data for money, we do not share it for advertising, and we run no advertising on this page.

5. Which countries it goes to

Data leaves the country where you buy and travels to Argentina, where we are, and to the countries where the providers in section 4 operate: the United States (Cloudflare, Resend and Zoho) and Estonia (Rotermanni 14, Tallinn 10111, the registered address of Armitage Labs OÜ, which operates Creem).

For data travelling to the United States and Estonia we rely on the safeguards each provider publishes: the European Commission's standard contractual clauses and, where the provider has joined it, the EU-US Data Privacy Framework. For the transfer to Argentina we rely on the European Commission's adequacy decision on the Argentine Republic and, for other countries, on your consent when you buy and on the terms of the agreements with each provider.

If you want a copy of those safeguards, write to privacidad@libretadegym.com.

6. Cookies and browser storage

• This sales page uses no cookies and no browser storage, carries no advertising and does not identify its visitors. It loads one code file of its own (pagina.js, which makes no network requests) and, to count visits and measure page-load speed in aggregate, the Cloudflare Web Analytics beacon. Cloudflare does not use it to follow you between sites.
• Cloudflare Web Analytics. This is aggregate visit and page-speed measurement; it is not advertising and there is no profiling. According to Cloudflare's public documentation (read on 1 November 2026), the beacon does not store anything in the browser or access stored data (cookies, local storage or browser databases), and the IP address is discarded at the nearest data centre without being stored in its core databases or logs. Cloudflare also states that it does not track individual end users across its customers' Internet properties. The app does not load it.
• The app uses a single technical cookie to verify that your browser is activated, and stores your workouts in the browser's local storage. That cookie cannot be read from the page's code, lasts up to 400 days and is deleted if you clear your browser data. Neither the cookie nor the local storage is used to measure you or to follow you between sites.

We do not respond to the browser's "Do Not Track" signal because we do not carry out tracking that signal could switch off.

7. Artificial intelligence

We do not send to any artificial intelligence tool what you log in the app, or your name, or your email, or your order number. If such a tool were ever used to draft support replies, a summary without identifying data would be read, no decision about your license would be taken automatically, and this policy would publish the provider's name and country before it was activated. Replies that affect your license, a refund or your data are reviewed by a person.

8. How long we keep it

• License, email hash, delivery record and activations: while the license is active and for 5 years after a cancellation. After that period the record is anonymised: the email, the link and the purchase identifiers are deleted and only the accounting trace remains, with nothing that identifies you.
• The truncated IP address within those records: up to 5 years after the license ends.
• IP hash in the attempts table: about 24 hours and 20 minutes at most.
• Support email: 24 months from the moment the case is closed.
• Your encrypted personal link and the email hint: while the license is active.
• Database backups: 30 days.
• Tax records: for as long as tax rules require, up to 10 years.

9. Your rights

You can write to privacidad@libretadegym.com, even from a different address; where there is reasonable doubt we verify your identity proportionately, without asking for documents by email. From there you can ask for access, a copy, rectification, erasure, portability and objection to processing, and withdraw your consent where the processing relies on it.

We answer within 10 calendar days and carry out rectification or erasure within 5 business days. Asking for information or rectification does not cancel your access.

If you ask for erasure, we explain what can be deleted, what must be kept and whether that request technically affects access. Deleting what identifies your license cancels access. We do not delete what a law obliges us to keep (receipts, an open claim): we block it and tell you until when. We cannot delete your workouts because we never had them: they are on your phone.

If you buy from the European Union or the United Kingdom, you also have the rights given to you by the General Data Protection Regulation and its UK equivalent, and you may complain to the data protection authority in your country. Even though we do not sell in those markets today, those rights are already recognised here.

If you reside in California, you have the right to know what personal information we collect, to ask us to delete it, to ask for a copy, and not to be treated differently for exercising those rights. We do not sell or share personal information within the meaning of that law, and we do not use behavioural advertising. You can exercise those rights by writing to privacidad@libretadegym.com.

10. Emails

We send you the email with your access and, if needed, service emails about the purchase: a security notice or the shutdown notice in section 11 of the terms.

We do not send marketing emails or newsletters, and we do not share your email with anyone to write to you. This page has no form where you can leave your email either.

11. Minors

The purchase is for people aged 18 or over and of the age of majority where they live. We do not seek data from minors. If you are a parent or guardian and believe a minor has given us data, write to privacidad@libretadegym.com and we will delete it.

12. Security

The site and the app are served over HTTPS. In the Access Gate database we keep a hash of your email and an encrypted copy of your personal link; your email in clear is kept, while needed, by the services in section 4, including the payment provider. Email is not an end-to-end encrypted channel. If an incident affects your data, we will tell you and tell the competent authority, within the periods that rule sets.

13. Where to complain

• Argentina: Agency for Access to Public Information, the supervisory body under Law 25.326.
• United States: the Federal Trade Commission and your state attorney general.
• European Union and United Kingdom: the data protection authority in your country, once those markets are enabled.
• Other countries: the data protection or consumer authority that applies to you.

14. Changes

If this policy changes, we publish the new version with its date. The change does not apply to the data of a purchase already made in any way that harms you, unless you accept it.

Argentina annex

The data subject has the right to exercise the right of access to their personal data free of charge at intervals of no less than six months, unless a legitimate interest is proven, as established in article 14, paragraph 3 of Law No. 25,326. THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, as the supervisory body of Law No. 25,326, has the power to handle the complaints and claims filed by those affected in their rights by non-compliance with the rules in force on personal data protection.