Trust
Last updated 3 September 2026
Procurement-style questions, answered plainly. This is a sole practitioner selling a low-cost digital download and one-to-one coaching, so several sections are short by design.
What data is processed
Email address and payment reference for buyers. Free-text correspondence for anyone who writes in, which may include self-reported training information. No special category data is requested and none should be sent.
Sub-processors
Four categories are used: SOC 2 Type II certified cloud hosting and edge delivery, a PCI DSS Level 1 certified payment processor, a SOC 2 Type II certified transactional email provider, and business email. Specific vendors are named in the data processing agreement, which is available under NDA on request.
Data residency
Primary processing is in the United States. Content is served from a global edge network, which caches public pages only.
Retention
Purchase records are kept for as long as tax law requires. Correspondence is kept for the life of the relationship and then deleted on request. Server logs roll off on a short window.
Compliance posture
No SOC 2 report is held for Way of Fitness itself, and claiming otherwise would be dishonest for a practice this size. Certification claims on this page describe the vendors underneath, not the practice. GDPR and CCPA rights requests are handled directly by the owner.
Insurance and continuity
Professional liability coverage is in place for the coaching practice. Because the site holds no customer database, recovery after an incident means redeploying static content, which takes minutes.