Privacy Policy

Last updated: October 6, 2026

1. Who we are

Fit By Charro USA ("Fit By Charro," "FBC," "we," "us" or "our") is operated by Astrala Ltd, a company established in Bulgaria.

Registered address: 10 Stefan Karadzha str., fl. 3, 1000 Sofia, Bulgaria
Privacy contact: team@fitbycharro.com

Astrala Ltd is the controller responsible for the personal information described in this policy.

This policy covers our US-facing websites and landing pages that link to it, our digital courses and downloadable products, and related customer support and marketing communications. It explains what we collect, why we use it, who receives it and the choices available to you. Separate Fit By Charro services may have their own privacy policies.

2. Information we collect

Information you provide

We collect information you provide when you purchase a product, create an account, subscribe to communications, contact us or send feedback. Depending on the interaction, this includes:

• Your name, email address and telephone number.
• Billing information, including your billing address where required.
• Account and course-enrollment information.
• Order details, payment status, transaction references and refund requests.
• Messages, questions, feedback and survey answers you choose to send.
• Marketing preferences and records of your consent or withdrawal of consent.

Required information enables us to process an order, provide access or respond to your request. If you do not provide it, we may be unable to complete that action. Marketing subscriptions are optional and are not a condition of purchasing a course.

Payment information

We use ThriveCart and Stripe to support checkout and payment processing. Payment credentials are handled by the payment services used at checkout. We receive information needed to confirm, administer and refund orders, such as payment status and transaction references. We do not need your full card number or card security code to provide customer support; please do not send these to us.

Information collected through our services

Our website and service providers collect technical and activity information, which can include IP addresses, browser and device details, approximate location derived from an IP address, pages viewed, referring websites, timestamps and cookie or similar identifiers.

Our course-delivery services may record enrollment, sign-ins and learning activity, such as lesson progress, depending on the features you use.

Where enabled and permitted, our communications tools record delivery, opens and link clicks to help us understand and improve our messages. Tracking information is not always accurate; for example, email privacy features can affect open measurements.

Information from providers

We receive relevant information from our checkout, payment, course and marketing providers, including order confirmations, enrollment events, subscription choices and campaign interactions. Advertising and analytics providers may supply campaign and website-performance reports.

3. Health information and customer feedback

We do not actively request weight records, medication histories, GLP-1 use, medical diagnoses or before-and-after photographs through our US course purchase and enrollment process.

Please avoid including medical records or other sensitive health information in ordinary customer-support messages. If you voluntarily send health-related information, we limit its handling to what is necessary to address your request, protect the information and meet applicable legal requirements. Where an additional legal basis or explicit consent is required, we obtain it before using that information for an additional purpose.

Sending private feedback does not authorize us to publish it as a testimonial. We seek separate permission before publicly using an identifiable customer quotation, story or photograph.

We do not use voluntarily disclosed health details to build advertising audiences or provide them to affiliate partners for marketing. If we introduce a feature that intentionally collects health information, we will provide the relevant notice and obtain any required consent before doing so.

4. How we use information

We use personal information to:

• Process purchases, payments, refunds and related administration.
• Provide access to courses, videos and downloadable materials.
• Send receipts, access instructions and necessary service notices.
• Respond to questions and provide customer support.
• Operate, secure, troubleshoot and improve our services.
• Understand website use and measure advertising performance, subject to applicable consent and opt-out requirements.
• Send permitted marketing communications and manage your preferences.
• Maintain accounting records, comply with legal duties, prevent misuse and handle legal claims.

We do not treat your purchase as consent to receive marketing text messages or to have private feedback published.

5. Legal bases for processing

As a company established in the European Union, we account for our obligations under the General Data Protection Regulation (GDPR). Depending on the purpose, we rely on:

• Contract: to process your purchase, provide access and administer the services you request.
• Legal obligation: to maintain legally required records and respond to lawful requirements.
• Legitimate interests: to answer inquiries, secure our systems, prevent fraud, manage disputes and improve essential operations, where those interests are not overridden by your rights. Optional tracking is subject to applicable consent requirements.
• Consent: for activities requiring your permission, including marketing texts, certain email marketing, optional cookies and similar technologies, and publication of identifiable customer stories.

For permitted email marketing that does not require prior consent under applicable law, we may rely on our legitimate interest in communicating relevant offers, with an opportunity to opt out.

Where information qualifies as special-category data, a separate condition for processing is required in addition to an ordinary legal basis. Receiving such information in an unsolicited message does not provide blanket permission to reuse it.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Providers and other recipients

We disclose information necessary for the relevant purpose to providers supporting our business, including:

Providers acting on our behalf process information under appropriate arrangements. Some providers also act independently for particular purposes, such as their own payment-security obligations; their privacy notices explain those activities.

We may disclose relevant information where legally required, to protect lawful rights, or in connection with a business transfer, subject to applicable protections.

Affiliate links and introductions

We may recommend third-party products or services and earn a commission when you buy through an affiliate link. Clicking a link can allow the partner to identify the referral and collect information under its own privacy policy.

An affiliate recommendation does not itself authorize us to transfer your customer profile or private messages to the partner. If you request an introduction, we explain what information will be shared and with whom, and obtain permission where required.

7. Cookies, analytics and advertising choices

We use essential technologies to support functions such as security, checkout and access. Google Analytics, Meta Pixel and related tools can use cookies or similar identifiers to measure visits, interactions and advertising results. Advertising partners may associate this activity with other information they hold and recognize a browser or device across services.

We use optional tracking subject to applicable consent and opt-out requirements. You can change available website tracking preferences through our cookie or privacy controls. Browser settings also let you block or delete cookies, although this may affect some functions.

We do not sell customer mailing lists for cash. However, providing identifiers or website activity to advertising partners can constitute a "sale," "sharing" or "targeted advertising" under certain US privacy laws, even where no money changes hands. Where those laws apply, you may opt out through our website privacy controls or contact team@fitbycharro.com for assistance.

We honor recognized opt-out preference signals, including Global Privacy Control, where required by applicable law. Legacy browser "Do Not Track" signals are different from these recognized opt-out signals and do not automatically change our website settings.

Opting out of personalized advertising does not necessarily stop all advertising; it changes the use of information for the covered advertising activity.

8. Email and SMS

You can unsubscribe from marketing emails using the unsubscribe link or by contacting team@fitbycharro.com. Necessary purchase and service messages may still be sent.

If you opt into our SMS program, we process your mobile number, consent records and messaging interactions to provide it. Consent to marketing texts is not a condition of purchase. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. You may also contact team@fitbycharro.com.

Mobile opt-in information and SMS consent are not shared with third parties or affiliates for their own marketing or promotional purposes. They may be disclosed to providers that help us operate and deliver the messaging service.

Where we send abandoned-checkout reminders, checkout events and cookies or similar technologies help identify an unfinished purchase. Marketing reminders are sent only where permitted; SMS reminders require the relevant SMS consent. Additional program information is provided in the messaging terms presented when you subscribe.

9. International processing

Astrala Ltd is based in Bulgaria. Our providers may process information in other countries, including the United States, where privacy laws may differ.

Where GDPR transfer safeguards are required, transfers must be supported by an applicable mechanism, such as a European Commission adequacy decision or Standard Contractual Clauses with additional measures where necessary. We assess the relevant provider and transfer arrangement rather than treating your purchase as consent to unrestricted international transfers.

Contact team@fitbycharro.com to request information about the safeguards applicable to your information or a copy of relevant safeguards, subject to appropriate redactions.

10. How long we keep information

We retain information for the purposes described here, using these criteria:

• Orders and accounting records: for the period required by applicable accounting, tax and related legal obligations.
• Accounts and course access: as needed to provide purchased access and administer the account, taking account of account closure, valid deletion requests and any legal obligations.
• Support communications: for as long as reasonably needed to resolve the request and address related disputes, followed by deletion or anonymization when no longer required.
• Marketing information: while you remain subscribed and the information remains relevant to the communication purpose. After you opt out, we retain limited suppression information where necessary to respect your choice.
• Consent records: for as long as needed to document the permission relied upon and address applicable claims or obligations.
• Analytics and technical records: for the configured period necessary for measurement, security or troubleshooting, followed by deletion or aggregation.
• Customer stories: in accordance with the permission granted, any withdrawal and applicable legal requirements.

We consider the sensitivity of information, the reason it was collected, relevant legal deadlines and whether a less identifiable form can serve the purpose. We do not retain information indefinitely merely because storage is available. Information subject to a legal hold may be retained until that requirement ends.

11. Your rights

Depending on applicable law, you may request access to your information, correction, deletion, restriction of processing or a portable copy. You may also object to processing based on legitimate interests, withdraw consent, and opt out of covered sale, sharing, targeted advertising or certain profiling.

You have a right to object to processing for direct marketing, including related profiling. Marketing selections may use purchase or engagement information; they do not constitute automated decisions determining eligibility for credit, employment, insurance or similar significant matters.

Send requests to team@fitbycharro.com. We may ask for proportionate information to verify identity or an authorized agent's authority. We respond within applicable deadlines and explain any lawful restriction on fulfilling a request. Exercising your rights will not result in unlawful discrimination.

Where an applicable US state law gives you a right to appeal a denied request, email the same address with the subject Privacy Request Appeal. We will explain the appeal outcome and further complaint options as required.

Under the GDPR, you may complain to a competent supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP): https://cpdp.bg/en/. You may also have the right to complain to the authority in your place of habitual residence, work or the alleged infringement.

12. Security and children

We use technical and organizational measures intended to protect personal information and limit access to people who need it for authorized purposes. No online service is completely secure. Keep account credentials confidential and contact us if you suspect unauthorized access.

Our products are intended for adults. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

13. External services and policy updates

Third-party websites and services have their own privacy policies. We remain responsible for our own disclosures of information to them.

We may update this policy when our practices, services or legal obligations change. The date above identifies the latest version. We provide appropriate notice of material changes and obtain additional consent where required before introducing a new use that requires it.

For questions or requests, contact:

Astrala Ltd — Fit By Charro USA
10 Stefan Karadzha str., fl. 3
1000 Sofia, Bulgaria
team@fitbycharro.com