Privacy Policy

The Site is informational only. We do not sell gym memberships online, and the Site does not process payments or run any e-commerce checkout of any kind — every Atilis Gym membership is sold in person, at a staffed front desk. Because of that, the information we collect through the Site is limited to the following categories:

Information you voluntarily submit. If you use our contact or inquiry form, you may provide your name, email address, phone number (optional), and whatever message you choose to include. These forms do not submit data to us over the internet: they open a pre-filled message in your own email application, which you then choose to send (or not) from your own device — exactly the same as emailing us directly. As a result, the Site itself does not transmit or store any form data on Atilis's servers or with any third party. Once you send such an email, we hold it in our ordinary business email account, as described in Section 9. The Site does not currently offer a newsletter or email subscription; if we add one, we will update this Policy and its Effective Date before or at the time it goes live.

Standard hosting and server log data. Like virtually every website, the Site is hosted by a third-party infrastructure provider (Cloudflare Pages), which automatically records standard server log information for every visitor — such as IP address, browser type, device type, pages visited, and timestamps — for the ordinary purposes of serving the Site, monitoring performance, and protecting against abuse. We do not use this data to individually identify or track visitors.

Age-verification flag on the Peptides page. Our Peptides page is age-gated to visitors 21 and older. Confirming your age sets a flag in your browser's sessionStorage — a purely client-side mechanism that never transmits any data to Atilis or stores anything on our servers, and that is automatically cleared when your browser session ends.

We do not collect payment card numbers, government identification numbers, or biometric information through the Site.

We use the information described above to:

• Respond to inquiries and messages you send us;
• Operate, maintain, secure, and improve the Site, using aggregate or log-level hosting data; and
• Comply with applicable legal obligations.

We do not use information collected through the Site for automated decision-making that produces legal or similarly significant effects concerning you.

Atilis Gym does not sell personal information, as that term is defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”), or any other applicable state privacy law. Atilis Gym does not “share” personal information for cross-context behavioral advertising, as that term is defined under the CCPA/CPRA.

As of the Effective Date, the Site does not use advertising pixels, ad-tech cookies, or third-party advertising networks. If we later engage service providers — for example, an email marketing platform to operate the newsletter, a backend or form-processing vendor, or an analytics provider — we will require that they handle personal information only for the specific purposes we direct and, where applicable law requires it, under a written contract containing the restrictions necessary to preserve that status, so that such arrangements do not constitute a “sale” or “share” of personal information under applicable law.

Because we do not sell or share personal information, an opt-out preference signal — including the Global Privacy Control (“GPC”) — currently has no additional effect on our practices. If our practices change such that we do sell or share personal information, we will honor a properly transmitted opt-out preference signal as an opt-out request from California residents to the extent required by the CCPA/CPRA.

If you are a California resident, you have the following rights with respect to your personal information, subject to certain exceptions and verification requirements under the CCPA/CPRA:

• Right to Know / Access — the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used.
• Right to Delete — request deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to Correct — request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing — as noted in Section 3 above, Atilis Gym does not sell personal information or share it for cross-context behavioral advertising, so there is currently nothing to opt out of.
• Right to Limit Use of Sensitive Personal Information — we do not use or disclose sensitive personal information for any purpose beyond what is necessary to provide the information or service you have requested.
• Right to Non-Discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercised any of your privacy rights.

How to submit a request. You (or an authorized agent acting on your behalf) may submit a verifiable consumer request by emailing atilis777@comcast.net. To protect your information, we may ask you to verify your identity using information reasonably necessary to match you with records we hold before fulfilling your request.

Appeals.If we decline to act on your request, you may appeal our decision by replying to our response email and explaining the basis for your appeal. We will respond to appeals within the time frame required by law. If your appeal is denied, you may contact the California Attorney General's office.

As a business based and operating in New Jersey, we recognize the rights afforded to New Jersey residents under the New Jersey Data Protection Act (NJDPA), effective January 15, 2025. Subject to certain exceptions, New Jersey residents have the right to:

• Confirm whether we process your personal data, and access it;
• Correct inaccuracies in your personal data;
• Delete personal data we hold about you;
• Obtain a copy of your personal data in a portable, readily usable format; and
• Opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects — as described above, Atilis Gym does not engage in any of these activities, so there is nothing to opt out of at this time.

How to submit a request. Email atilis777@comcast.net to exercise any of these rights. We will verify your identity as reasonably necessary and respond within the time frame required by the NJDPA.

Appeals. If we decline to take action on your request, you may appeal by replying to our decision and describing the basis for your appeal. We will respond to your appeal in writing within the time frame required by the NJDPA, explaining our reasoning. If your appeal is denied, you may submit a complaint to the New Jersey Division of Consumer Affairs.

Residents of Virginia (Virginia Consumer Data Protection Act), Colorado (Colorado Privacy Act), Connecticut (Connecticut Data Privacy Act), and Utah (Utah Consumer Privacy Act) are afforded similar consumer privacy rights under their respective state laws. In general, and subject to each law's specific terms and exceptions, these rights include the ability to:

• Confirm and access the personal data we hold about you;
• Correct inaccurate personal data (where recognized by your state's law);
• Delete your personal data;
• Obtain your personal data in a portable format; and
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of certain automated decisions.

As stated in Section 3 above, Atilis Gym does not sell personal data, use it for targeted advertising, or profile visitors — so exercising any applicable opt-out right will have no practical effect, since none of these activities currently occur.

To exercise any right described in this section, email atilis777@comcast.net. We will verify your request as reasonably necessary and respond within the time frame required by the applicable law. If we decline your request, you may appeal by replying to our response; we will respond to appeals in writing within the time frame required by law, after which you may contact your state's Attorney General if you remain unsatisfied.

As of the Effective Date, the Site does not set cookies for advertising or behavioral-tracking purposes, and does not use analytics platforms, advertising pixels, or third-party tracking scripts. The only client-side storage currently used by the Site is the sessionStorage age-verification flag on the Peptides page described in Section 1, which is cleared automatically when your browser session ends and is never transmitted to us.

Our hosting provider, Cloudflare Pages, automatically generates standard server access logs (IP address, browser type, pages visited) as part of ordinary website hosting and security operations, as described in Section 1.

If we add web analytics (such as Google Analytics) or advertising technologies in the future, we will update this section — and the Effective Date of this Policy — to describe what is collected, for what purpose, and what choices are available to you, before or at the time such tools go live.

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Our Peptides page carries an additional, independent restriction: it requires visitors to confirm they are 21 or older before viewing that content, because the products described there are age-restricted, in-store-only research compounds.

If you believe a child has provided us with personal information, please contact us at atilis777@comcast.net and we will promptly delete it.

As described in Section 1, our contact and inquiry forms route through your own email application rather than a backend, so no submission data is stored on our systems by the Site itself. When you do email us, we keep that message in our ordinary business email account only as long as reasonably necessary to respond to you and for related recordkeeping, after which it is deleted.

If we connect a form backend or email service in the future, we will retain information collected through it only for as long as reasonably necessary for the purpose it was collected, and we will update this Policy accordingly.

Standard hosting server logs are retained by our hosting provider for the limited period typical of ordinary website operations and security monitoring.

We maintain reasonable administrative and technical safeguards designed to protect the information we handle in connection with the Site. However, no method of transmission over the internet, or method of electronic storage, is 100% secure, and we cannot guarantee absolute security.

The Site links to our Facebook and Instagram pages, and may link to other third-party platforms from time to time. Those platforms operate under their own privacy policies and terms, which we do not control. We encourage you to review the privacy practices of any third-party site or platform before providing information to it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements — for example, if we connect a form backend, add a newsletter platform, or enable web analytics. Any changes will be posted on this page along with a revised Effective Date. We encourage you to review this page periodically.

If you have questions about this Privacy Policy, or would like to submit a privacy request, please contact us at:

atilis777@comcast.net

You're also welcome to reach out through our Contact page.