Privacy policy
Last updated: 21 August 2026
1. Who is responsible
The data controller is Hardcore Mania, registered for VAT in Italy under number 03329770600. For anything about your data, write to Hardcoremania11@gmail.com, which is the address that reaches the people who decide.
We have not appointed a Data Protection Officer, and we are not required to: we do not carry out large scale systematic monitoring and we do not process special categories of data.
This policy covers academy.hardcoremania.com. Our shop at hardcoremania.com runs on a different platform and has its own policy.
2. What we collect
- Contact details: your name and email address. A phone number only if we ask for one at checkout, which today we do not.
- Order details: what you bought, when, how much you paid, payment method type, country, refunds and subscription status. We never receive your full card number: that stays with Stripe.
- Account and progress: your login, which lessons you have completed, your KANG activation code.
- Usage data: pages visited, session and visitor identifiers, approximate location derived from your IP address, browser and device type, and the referrer or campaign that brought you here.
- Email interaction: whether an email we sent was delivered, opened, bounced or reported as spam.
- What you send us: messages, support requests, and any video clip you choose to send.
3. Why we use it, and on what legal basis
| What for | Legal basis |
|---|---|
| Taking your order, giving you access, running your membership, sending your receipt and your login link | Performance of the contract with you (art. 6.1.b GDPR) |
| Invoicing, accounting and tax records | Legal obligation (art. 6.1.c) |
| Reminding you about a checkout you started and did not finish | Our legitimate interest in recovering an order you began (art. 6.1.f). One click stops it forever |
| Marketing emails about new drops, tips and offers | Your consent, or our legitimate interest in writing to existing customers about similar products. Every email carries an unsubscribe link that works |
| Measuring which pages and campaigns actually work | Our legitimate interest in knowing whether the money we spend on ads returns (art. 6.1.f) |
| Advertising and conversion measurement through Meta, Google and Microsoft tools | Consent where required. See section 7, which explains exactly what happens today |
| Keeping the site up, preventing fraud and abuse | Our legitimate interest in a service that works and does not get robbed (art. 6.1.f) |
Giving us your name and email is necessary to buy: without them we cannot take the order or give you access. Everything else is optional, and refusing it costs you nothing.
4. Who else sees it
We do not sell personal data and we do not trade it. We use the following providers, each of them bound by a data processing agreement and each of them seeing only what their job requires:
| Provider | What for | Where |
|---|---|---|
| Stripe | Payments, subscriptions, refunds, billing portal | Ireland and USA |
| Supabase | Database and accounts | EU (Frankfurt) |
| Vercel | Hosting, site analytics and performance metrics | EU and USA |
| Mux | Video and audio hosting and delivery | USA |
| Resend | Sending our emails and reporting what happened to them | USA |
| Meta | Advertising and conversion measurement | USA |
| Google Analytics 4 | USA | |
| Microsoft | Clarity, which records how pages are used | USA |
| n8n (KANG bot) | Only if you activate the WhatsApp bot: your email address and whether your membership is active | EU |
We may also share data with our accountant and, where the law requires it, with public authorities.
5. Data leaving the EU
Some of the providers above are based in the United States. Those transfers rely either on the European Commission's adequacy decision for the EU to US Data Privacy Framework, where the provider is certified under it, or on the Standard Contractual Clauses approved by the Commission, with additional safeguards where needed. You can ask us for a copy of the safeguards that apply to a specific provider.
6. Cookies and similar technologies
These are the ones we set ourselves. They are not used for advertising:
| Name | What it does | Lifetime |
|---|---|---|
| hcm_attr | Remembers which campaign or link brought you here, so we can credit the right one when you buy. It also holds an anonymous visitor id. Not readable by scripts | 90 days |
| hcm_s | An anonymous session id, so we can tell how many people moved from the landing page to the checkout | 30 minutes, renewed as you browse |
| Login cookies | Keep you signed in to the members area. Strictly necessary: without them the area cannot work | Session and refresh |
Third party cookies and identifiers are also set by Stripe on the checkout page, and by Meta, Google and Microsoft for the tools described in the next section.
7. Advertising and measurement, stated plainly
This site currently loads the Meta pixel, Google Analytics 4 and Microsoft Clarity when you arrive, and there is no consent banner asking you first. We are telling you rather than hiding it. What each one does:
- Meta pixel and Conversions API: report page views and purchases to Meta so we can measure our advertising and reach similar audiences. When you buy, we also send Meta a hashed version of your email address, which means a one way fingerprint of it and not the address itself, so that a sale can be matched to an ad. This is profiling for advertising purposes.
- Google Analytics 4: aggregated traffic statistics.
- Microsoft Clarity: records how pages are used, including scrolling and clicks, so we can see where a page confuses people. Keystrokes in form fields are masked.
How to opt out today.You can turn these off at the source: through your Meta account's ad settings, with Google's opt out add on, through your browser's tracking protection, or with any content blocker. You can also write to Hardcoremania11@gmail.com and object, and we will act on it. None of this affects your purchase, your access or your refund rights.
8. How long we keep it
| What | How long |
|---|---|
| Invoices, orders and accounting records | 10 years, because Italian law says so and we do not get a choice |
| Your account, access and lesson progress | For as long as you have an account, then 24 months |
| Marketing contacts and unfinished checkouts | 24 months from your last interaction, or until you unsubscribe |
| Unsubscribe records | Kept indefinitely, precisely so that we never email you again by mistake |
| Email delivery events | 24 months |
| Page views and session data | 14 months |
9. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it over in a portable format, or stop a processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time, and withdrawing it does not affect what we did before.
Write to Hardcoremania11@gmail.com. We answer within one month. There is no charge, and we do not ask why.
If you think we handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority in the EU country where you live.
10. Age
This site is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.
11. Automated decisions
We do not make decisions about you by automated means that produce legal effects or similarly significant effects. The advertising tools in section 7 profile visitors for ad targeting, which you can object to as described there.
12. Security
Data is encrypted in transit, access to the database is limited to the few people and systems that need it, and payment details never touch our servers. No system is perfect: if a breach ever puts your rights at risk, we will tell you and the authority, as the law requires.
13. Changes
When this policy changes we update the date at the top. If a change matters, for example a new purpose or a new provider, we will tell you before it applies.