Legal
Privacy Policy
What this site collects, why, who sees it, how long we keep it, and what you can ask us to do about it. The company responsible is Aurora Group Platforms LLC.
The short version
- We have no user accounts, no checkout and no payment forms. The only thing you can give us on this site is an email address for the newsletter.
- Advertising measurement (Microsoft Advertising's UET tag) starts in a "denied" state on every page and is only switched to "granted" if you click Accept on the cookie banner. Your choice is stored on your own device.
- We do not sell personal information, and we do not use it for anything this page does not describe.
- Servers are in the United States. If you visit from elsewhere, your data is processed here.
Who is responsible
This policy covers fitsimplelife.com and the newsletter sent from it, The Sunday Plan. The data controller, meaning the company that decides how and why your information is processed, is Aurora Group Platforms LLC, 30 N Gould Street, Sheridan, WY 82801, United States. Contact details are at the bottom of this page. There is no phone line.
What we collect, and why
| What | When | Why, and where it goes |
|---|---|---|
| Your email address, the date and time you signed up (UTC), and the IP address your sign-up came from | Only when you submit the newsletter form on the home page | Written as one line to a private file on our own server. Used to send The Sunday Plan, to avoid adding the same address twice, and to identify abusive or automated sign-ups. The form also contains a hidden field that people never see; if something fills it in, we assume a bot and store nothing. |
| Standard request logs: IP address, page requested, date and time, browser and device description ("user agent"), and the page you came from if your browser sends it | Every visit, like any website | Kept by our hosting server and by Cloudflare, the network service that sits in front of it, to run the site, find faults and block abuse. |
A browser-storage item named fsl_consent, holding the word "granted" or "denied" | As soon as you click Accept or Decline on the cookie banner, or automatically as "denied" if your browser sends a Global Privacy Control signal | Stays in your browser so we do not ask again on that device. It is never sent to us. |
Microsoft Advertising identifiers (cookies such as MUID, _uetsid, _uetvid) and page-view events | Only after you click Accept, and on later visits from a device where you accepted | Sent to Microsoft so it can tell whether a visit followed one of our ads and, if it did, count it. Full details are in the section below and in our Cookie Policy. |
| Whatever you write to us, and the address you write from | Only when you email us | To answer you and to act on a correction or a privacy request. |
What we do not collect
- No accounts, passwords or profiles.
- No payment details. Purchases happen on Amazon, and Amazon does not tell us who bought what; we receive aggregate commission reports only.
- No health information. We do not ask for it, and we ask you not to send it to us. Nothing on this site is tailored to you.
- No sensitive categories of personal information of any kind, and no precise location.
- No analytics service, social-media plug-in, embedded video player or third-party font service. Fonts and images are served from our own site.
Advertising measurement, and what "Accept" changes
We advertise this site through Microsoft Advertising. To measure whether those ads work, every page includes Microsoft's Universal Event Tracking (UET) script. We want to be precise about what that means, because it is easy to overstate.
The script file itself is requested from Microsoft's server (bat.bing.net) on every page load, whatever you choose. That request, like any web request, gives Microsoft your IP address and browser description. Immediately after the script is set up, our page tells it that advertising storage is denied. That is the default on every page, before you have touched the banner, and it stays the default if you click Decline. Microsoft's published documentation for this "consent mode" states that in the denied state first-party cookies are neither read nor written for UET, third-party cookies are not written, and any third-party cookie that is read is used only for fraud and spam detection, not for advertising. Microsoft describes the data it collects in that state as anonymized and aggregated.
If you click Accept, our page records "granted" in fsl_consent and tells the script that advertising storage is granted, on that page and on every later page you open from that device. From then on Microsoft may set and read its identifiers, listed in the Cookie Policy, to attribute your visit to an ad and to build audiences for its advertising services. Microsoft Advertising is an independent company acting under its own privacy statement; we do not receive the identifiers, and we cannot see who any individual visitor is.
You can change your mind at any time with the "Cookie settings" button in the footer of every page, which clears the stored choice and shows the banner again.
Global Privacy Control
If your browser sends the Global Privacy Control (GPC) signal and you have not yet made a choice on this device, our page records "denied" automatically and does not show the banner at all. We handle GPC exactly as if you had clicked Decline, which under California law is the recognized way to tell a business not to sell or share your information. If you had already clicked Accept on a device before turning on GPC, the stored choice is used; click "Cookie settings" in the footer to clear it, and the signal will apply from then on.
Legal bases (for visitors in the EEA, the United Kingdom and Switzerland)
- Consent, for advertising measurement after you click Accept, and for sending you the newsletter after you sign up. You can withdraw either at any time: use the footer button for the first, unsubscribe for the second.
- Legitimate interests, for keeping request logs, blocking abuse, avoiding duplicate sign-ups, and answering your messages. These are the ordinary interests of running a small website, and we keep the data involved to a minimum.
- Legal obligation, if a law or a valid legal process requires us to keep or disclose something.
Who we share information with
We do not sell personal information, and we do not give it to anyone for their own marketing. A small number of service providers handle data on our behalf:
- Our hosting provider, whose server in the United States stores the site files, the request logs and the private newsletter file.
- Cloudflare, which routes and protects traffic to the site and, in doing so, processes connection data such as your IP address. Cloudflare passes the visitor's IP address to our server, which is how the newsletter sign-up record gets it.
- An ordinary email-sending service, used only to deliver The Sunday Plan to subscribers on our instructions.
- Microsoft Advertising, but only after you click Accept, and only for the measurement described above. Microsoft acts as an independent controller of what its tag collects. Some U.S. state laws describe passing identifiers to an advertising platform for measurement or audience building as "sharing" for targeted advertising; if that description applies, declining on the banner or sending a GPC signal is how you opt out, and nothing is shared before you accept.
We may also disclose information if the law requires it, to comply with a valid legal process, or to protect the rights, safety or property of Fit Simple Life, its readers or the public.
Where your data is processed
Our server and our company are in the United States, and Microsoft and Cloudflare operate globally. If you visit from the European Economic Area, the United Kingdom, Switzerland or anywhere else outside the United States, your information is transferred to and processed in the United States, where privacy law differs from your own. We keep what we hold to the minimum described on this page, we only send the newsletter to people who asked for it, and advertising measurement runs only with your consent. Where our service providers offer standard contractual safeguards for international transfers, we rely on those as well.
How long we keep things
- Newsletter sign-up record (email, time, IP address): for as long as you are subscribed. When you unsubscribe, or ask us to delete it, we remove the whole line, including the IP address, within 30 days.
- Request logs: kept for routine operation for up to 30 days, then discarded. A specific entry may be kept longer only if it is needed to investigate abuse or a security incident. Cloudflare keeps its own connection logs under its own retention rules.
- Your consent choice (
fsl_consent): on your device until you clear your browser's site data or click "Cookie settings". - Microsoft Advertising identifiers: on your device for lifetimes set by Microsoft, or until you clear them. We do not hold copies.
- Email correspondence: for as long as needed to deal with the matter, and normally no more than twelve months after it is closed.
Security
The site is served over HTTPS, the newsletter file sits in a folder the web server refuses to serve to visitors and search engines are told not to crawl, and access to the server is limited to the people who maintain the site. No website can promise perfect security, and we do not; what we can promise is that we hold very little, and hold it for a short time.
Children
This site is written for adults and is not directed at children. We do not knowingly collect personal information from anyone under 13, and the newsletter is for people 18 and over. If you believe a child has submitted an email address to us, write to the address below and we will delete it.
Your rights and choices
Everyone. You can ask us what we hold about you, ask us to correct or delete it, and unsubscribe from the newsletter at any time, whatever the law where you live says. In practice the only record we can look up is a newsletter sign-up, and we look it up by the email address you write from, which is also how we verify that the request is yours.
California and other U.S. states. If a state privacy law such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to you, you have the right to know what personal information we collect and how we use and disclose it, to access it, to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information (we collect none), and not to be discriminated against for exercising any of these rights. We do not sell personal information. If passing identifiers to Microsoft after you click Accept counts as "sharing" under your state's law, declining on the banner or sending a Global Privacy Control signal is the opt-out, and we honor GPC as a valid request. Aurora Group Platforms LLC may fall below the size thresholds at which these laws apply, but we honor these requests regardless. You may use an authorized agent; we will ask for proof that you gave the agent permission. We will confirm receipt within 10 business days and respond within 45 days, or tell you within that time if we need up to 45 days more.
EEA, United Kingdom and Switzerland. If the GDPR, the UK GDPR or Swiss data-protection law applies to you, you have the right to access your data, to have it corrected or erased, to restrict or object to processing based on legitimate interests, to receive the data you gave us in a portable format, and to withdraw consent at any time without affecting what was done before. We respond within one month, or tell you within that month if a complex request needs up to two months more. You also have the right to complain to the supervisory authority where you live; we would appreciate the chance to resolve a concern first.
Newsletter. Every issue of The Sunday Plan explains how to unsubscribe, and an email to the address below saying "unsubscribe" works just as well. We do not send a confirmation email when you sign up, so if an address was entered without its owner's permission, one message to us is enough to have it removed.
Links to other sites
Product buttons take you to Amazon, and source links take you to manufacturers, government agencies and journals. Once you leave fitsimplelife.com, that site's privacy practices apply. Amazon's privacy notice, not this one, governs anything you do on Amazon, and we never see it. How we are paid when you buy through our links is explained in the Affiliate Disclosure.
Changes to this policy
If our tools, our practices or the law change, we will update this page and the date at the top. If a change materially affects the newsletter, we will also say so in the next issue. We do not send separate notices otherwise, so check the date when you visit.
How to reach us
- Data controller
- Aurora Group Platforms LLC
- Address
- 30 N Gould Street
Sheridan, WY 82801, United States - [email protected]
Sources
- Microsoft Advertising, "Setting up UET for consent mode": the meaning of the ad_storage "granted" and "denied" states, and the description of tag loading with a denied default. learn.microsoft.com/en-us/advertising/msa-help/hlp_ba_conc_uet_consent
- Microsoft Advertising, "FAQ - UET and user consent": the identifiers subject to consent (
MUID,_uetvid,_uetsid,_uetsid_exp,_uetvid_exp,MSPTC) and the requirement that the tag load with consent denied by default. learn.microsoft.com/en-us/advertising/msa-help/hlp_ba_conc_uet_consentfaq - Microsoft Privacy Statement, which governs what Microsoft does with the data its tag collects and includes Microsoft's own opt-out for personalized advertising. microsoft.com/en-us/privacy/privacystatement
- Cloudflare, "Cloudflare Cookies": the technical cookies Cloudflare may set and their durations. developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies
- Global Privacy Control, the specification and its stated purpose. globalprivacycontrol.org
- California Department of Justice, Office of the Attorney General, "California Consumer Privacy Act (CCPA)": the rights listed above, the 45-day response period, and the status of GPC as a valid opt-out request. oag.ca.gov/privacy/ccpa