Privacy Policy

1. Introduction & Scope

DIANA SOSA LLC (doing business as SOSA FIT) is a Florida limited liability company owned by Diana Sosa, a fitness coach based in Miami, Florida, USA. In this policy, the words "SOSA FIT," "we," "us," and "our" all mean DIANA SOSA LLC. The words "you" and "your" mean you, the person visiting our website, joining our mailing list, buying coaching, or using our app.

This Privacy Policy covers our website at sosafitness.com (which is also served at fitness-website-cx3.pages.dev), our SOSA FIT mobile app (currently in development), our online and in-person coaching services, our digital products such as e-books and downloadable plans, and our emails. It applies to everyone who interacts with us, whether you are in Miami, anywhere else in the United States, or somewhere else in the world.

We are based in the United States and our audience is primarily women in the U.S., served in both English and Spanish. Our website is publicly accessible worldwide, but it is directed to and intended for users in the United States. This policy describes our practices; merely using the website does not constitute your consent to non-essential cookies, analytics, or advertising. Where the law requires consent (for example, for users in the EU, EEA, or UK), we rely on the opt-out and opt-out-signal mechanisms described in Sections 6 through 8, and you should not use non-essential features of the site without affirmatively consenting through those mechanisms. If you have a question about your privacy or want to make a request about your information, contact us at [email protected] — Miami, Florida, USA.

2. Information We Collect

We collect two kinds of information: information you give us directly, and information that is collected automatically when you use our website or app.

Information you provide directly. When you apply for coaching, subscribe to our mailing list, buy a product, take a quiz, contact us, or set up an account in the SOSA FIT app, you may give us: your name; your email address; your Instagram handle; your fitness goals; your training experience level; and other onboarding details such as age, gender, height, weight, workout preferences, and nutrition or meal preferences. If you use the app, we also store your account data, workout logs, nutrition entries, and any progress photos you choose to upload. This fitness and body-related information is kept in our app backend (Supabase). When you buy coaching or a product, your payment information (such as your card number) is entered directly with our payment processor, Stripe — we receive a confirmation and limited billing details, but we do not store your full card number.

Information collected automatically. When you visit our website or use our app, certain information is collected automatically, including: your IP address; your device type, browser type, and operating system; the pages you view and how long you stay; the website or link that referred you to us (referring URLs); timestamps; and information collected through cookies, pixels, and similar technologies. From your IP address we may infer your approximate (city-level) location. We do not intend to collect Social Security numbers, government ID numbers, or financial account numbers — payment data is handled by Stripe.

Health-type data and not medical advice. Some of what we collect — your fitness goals, body measurements, and nutrition entries — relates to your health and wellness. We are not a doctor's office and we are not covered by HIPAA, the U.S. medical-privacy law, because we are not a healthcare provider or health plan. SOSA FIT provides general fitness and wellness coaching only. Diana Sosa is not a physician, registered dietitian, or licensed healthcare provider, and nothing we collect or provide constitutes medical advice, diagnosis, or treatment. You should consult a qualified healthcare professional before starting any fitness or nutrition program. Even though we are not a clinical service, we treat your health-related information with extra care, as described in Section 6 below.

Sensitive Personal Information. Some of the information described above may be considered "sensitive personal information" under the CCPA/CPRA and similar U.S. state laws — specifically, health and wellness data such as your body measurements, fitness goals, nutrition logs, and any progress photos you choose to upload. We collect and use this sensitive information only to provide the coaching and app services you request. We do not use or disclose it for any purpose that would trigger your right to limit its use, and we do not sell or share it. Importantly, we do NOT share this health-related data with Google, Meta, or any advertising partner — the tracking described in Section 4 applies to website browsing activity, not to your health or fitness data.

3. How We Use Your Information

We use the information we collect to run our business and serve you. Specifically, we use it to:

• Provide and personalize your coaching, workout programs, nutrition guidance, and the SOSA FIT app, including turning your onboarding inputs into personalized targets;
• Create and manage your account;
• Process your payments and manage your monthly subscription through Stripe;
• Communicate with you — including service messages, coaching messages, support replies, and transactional notices such as receipts and renewal reminders;
• Send you marketing emails (such as fitness content, nutrition tips, and service updates) if you have opted in or are a customer — you can unsubscribe at any time;
• Understand how people find and use our website through analytics (Google Analytics 4);
• Build and serve advertising and retargeting audiences on Google and Meta (this is described in detail in Section 4);
• Keep our services secure, prevent fraud, fix problems, and comply with the law; and
• Improve our website, app, and services over time.

4. Cookies, Analytics & Advertising

This section explains the most important part of how we track visitors, and we want to be honest about it rather than bury it. Cookies are small files placed on your device, and pixels are tiny pieces of code on our pages that send information back to us and to third parties. We use these and similar technologies for necessary site functions, for analytics, and for advertising. This section is our complete cookie disclosure — we do not maintain a separate cookie policy.

Google Analytics 4 (GA4). Our website loads Google Analytics 4 for all visitors when our pages load. GA4 uses first-party cookies and collects information such as your IP address, device and browser details, the pages you view, and how you move through the site, and shares it with Google. We use this to understand our traffic and improve the site. These analytics cookies typically last from the duration of your session up to about two years.

Meta Pixel (Facebook / Instagram). Our website also loads the Meta Pixel for all visitors when our pages load. The Meta Pixel uses cookies and online identifiers to collect browsing activity and shares it with Meta Platforms (the company behind Facebook and Instagram). We use it to measure ad results and to build retargeting and "custom audiences" — meaning, if you visit our site, you may later see ads from SOSA FIT on Facebook or Instagram. These advertising cookies typically last up to about 90 days, though some persist longer.

Important — these tools currently fire on load. These tools are not currently gated behind an opt-in consent banner — they load for everyone when a page loads, before you take any action. The information collected by Google and Meta is used both for traffic analytics and for building advertising and retargeting audiences. Because this involves disclosing your information to Google and Meta for cross-context behavioral advertising, it constitutes a "sale" and/or "sharing" of personal information under certain U.S. state privacy laws — see Sections 5, 6, and 7. You can opt out of this tracking, and Section 8 explains exactly how. When you opt out using one of the methods in Section 8 (including the Global Privacy Control signal), we set a cookie-based flag in your browser that tells our site not to load GA4 and the Meta Pixel for you on that browser or device. Because this flag is stored as a cookie, if you clear your cookies or switch browsers or devices, you may need to opt out again.

5. How We Share Information

Here is who we share information with and why. Be aware that, as explained in this Section and in Section 6, our use of advertising pixels constitutes a "sale" and/or "sharing" of personal information under the CCPA/CPRA and similar laws, and you have the right to opt out (see Sections 7 and 8).

Service providers. We use trusted companies to operate our business. These include: Stripe (to process your payments); Cloudflare (to host and protect our website and deliver it quickly, which involves processing technical data such as your IP address); Supabase (to store your app account, profile, and fitness data); and our email marketing provider (to manage our mailing list and deliver our emails). These companies are only allowed to use your information to perform services for us.

Advertising partners. As described in Section 4, we disclose online identifiers and browsing activity to Google (Google Analytics 4 and Google Ads) and Meta (the Facebook/Instagram Pixel) for analytics and for building advertising and retargeting audiences. For advertising and retargeting, Google and Meta act as third parties (and, under the GDPR, as independent controllers) that process the data under their own privacy policies. For basic GA4 analytics that we configure on our behalf, Google may act as our service provider/processor. We do not disclose your health or fitness data (body measurements, nutrition logs, or progress photos) to these advertising partners.

Legal and safety. We may disclose information if we believe in good faith that it is necessary to comply with the law, respond to a valid legal request or legal process, enforce our agreements, or protect the rights, safety, or property of SOSA FIT, our users, or others.

Business transfers. If we are ever involved in a merger, acquisition, financing, or sale of all or part of our business, your information may be transferred as part of that transaction. We will let you know if your information becomes subject to a different privacy policy.

Minors. Our services are intended for adults 18 and over. We do not knowingly sell or share the personal information of consumers under 16 without the opt-in consent required by law, and we do not knowingly collect personal information from children under 13 at all.

6. The CCPA/CPRA "Sale" and "Sharing" Disclosure

Because our advertising pixels disclose information to Google and Meta for cross-context behavioral advertising, this constitutes a "sale" and/or "sharing" of personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA/CPRA"), and under similar laws in other U.S. states. Under these laws, a "sale" is not limited to an exchange for money — it expressly includes disclosing personal information for other valuable consideration, which is exactly what happens when we share pixel data in connection with advertising and analytics services. We are telling you this plainly rather than denying it.

The categories of personal information involved in this "sale" or "sharing" are: online identifiers (such as cookie and device identifiers), internet and other electronic network activity (such as your browsing on our site), and inferences drawn for advertising purposes. We do NOT sell or share your sensitive personal information, including your health and fitness data (body measurements, nutrition logs, and progress photos), and we do not sell or share the personal information of consumers we know to be under 16 without the required opt-in consent.

You have the right to opt out of this "sale" and "sharing." We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request, and we provide additional opt-out methods described in Section 8. See Section 7 for the full list of your rights and Section 8 for every way you can opt out.

7. Your Privacy Rights

Depending on where you live, you may have rights over your personal information. We extend the following core rights to all U.S. residents as a matter of good practice, and we describe the rights of Florida and EU/EEA/UK residents separately below.

U.S. state privacy rights (CCPA/CPRA and similar laws). Subject to certain exceptions, you have the right to: know and access the personal information we collect, use, and disclose about you; delete your personal information; correct inaccurate personal information; receive a portable copy of your information; opt out of the "sale" or "sharing" of your personal information and of targeted (cross-context behavioral) advertising; limit the use of sensitive personal information where applicable; opt out of profiling used to make significant decisions about you; and not be discriminated against for exercising any of these rights. If we deny a request, you have the right to appeal, and we will respond to your appeal within the time the law allows.

Global Privacy Control (GPC). We honor GPC and other recognized browser-based universal opt-out signals as a valid request to opt out of the sale and sharing of your personal information and of targeted advertising. If your browser sends a GPC signal, we treat it as an opt-out for that browser or device and set a cookie-based flag so our site does not load GA4 or the Meta Pixel for you.

A note on automated personalization. The SOSA FIT app turns the inputs you provide during onboarding (such as your goals, age, height, and weight) into personalized fitness and nutrition targets. We consider this a routine personalization of the service you requested, not profiling used to make legal or similarly significant decisions about you, and we do not use it to deny you any service, opportunity, or benefit. If you prefer, you can ask us to review or adjust these targets by emailing [email protected].

Florida Digital Bill of Rights (FDBR). The Florida Digital Bill of Rights imposes "controller" obligations only on businesses with more than one billion U.S. dollars in global gross annual revenue that also meet specific additional criteria. DIANA SOSA LLC does not meet the revenue threshold and is therefore not a regulated controller under the FDBR. As a courtesy, we voluntarily honor the consumer-facing rights — access, correct, delete, portability, and opt out of the sale of personal data and of targeted advertising — for Florida residents. You can exercise them by emailing [email protected].

EU/EEA/UK rights (GDPR). Our website is directed to users in the United States and is not intended for users in the European Union, European Economic Area, or United Kingdom, and our non-essential cookies and pixels are not currently consent-gated for those regions. If you are nonetheless in the EU, EEA, or UK, you should not provide personal data or use non-essential features of the site without affirmatively consenting. To the extent the General Data Protection Regulation applies to you, you have the right to access, rectify (correct), erase, restrict, and port your data, to object to certain processing, and to withdraw consent at any time where we rely on consent. Where the GDPR applies, we rely on these legal bases: your consent (for marketing and any non-essential cookies and pixels you affirmatively accept); performance of a contract (to provide paid services you request); our legitimate interests (such as security and improving our services); and legal obligation (such as tax and recordkeeping). You also have the right to lodge a complaint with your local data protection authority. We have not appointed an EU representative; this does not change the rights described here.

How to exercise your rights. To make any request, email us at [email protected] and tell us what you would like to do. For access, deletion, and correction requests, we may need to verify your identity before acting, for example by confirming details we already have on file, to protect your information. You do NOT need to verify your identity to opt out of the sale or sharing of your personal information — verification applies only to access, deletion, and correction requests. You may use an authorized agent to make a request on your behalf, and we may ask for proof of that authorization. We do not charge a fee for exercising your rights except as permitted by law. We aim to respond within the time required by law (for example, within 45 days under the CCPA, with the possibility of an extension when needed).

8. How to Opt Out of Tracking

You have several ways to limit or stop the tracking and advertising described in Sections 4 and 6. You can use any one of these, or combine them:

Opting out of advertising tracking does not mean you will stop seeing ads — it means the ads you see should be less tailored to you. When you opt out using GPC or our own opt-out method, we set a cookie-based flag so our site does not load GA4 or the Meta Pixel for you on that browser or device. Because some opt-outs are stored as cookies, if you clear your cookies or use a different browser or device, you may need to opt out again.

• Browser cookie controls — block or delete cookies through your browser settings (note: blocking essential cookies may break parts of the site);
• Global Privacy Control (GPC) — turn on GPC in a supported browser or extension; we honor it as an opt-out signal for the sale and sharing of your information and for targeted advertising;
• Our opt-out request method — email [email protected] and tell us you want to opt out of the sale or sharing of your personal information, and we will set the opt-out flag for you;
• Google Analytics Opt-out Browser Add-on — install it from tools.google.com/dlpage/gaoptout to opt out of Google Analytics;
• Google Ads Settings — manage your ad personalization at adssettings.google.com;
• Meta ad preferences — adjust your ad settings and Off-Facebook Activity controls inside your Facebook or Instagram account;
• Digital Advertising Alliance (DAA) — opt out of interest-based advertising at optout.aboutads.info;
• Network Advertising Initiative (NAI) — opt out at optout.networkadvertising.org; and
• Mobile devices — use your device's "Limit Ad Tracking" or "Opt out of Ads Personalization" setting.

9. Email Communications & CAN-SPAM

If you subscribe to our mailing list or become a customer, we may send you marketing emails such as fitness content, nutrition tips, and updates about our services. We comply with the U.S. CAN-SPAM Act, which means every marketing email identifies who it is from and includes a working way to unsubscribe.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any marketing email, or by emailing us at [email protected]. We will honor your request promptly. Please note that transactional and service emails — such as payment receipts, subscription renewal notices, and important account messages — are not marketing, and we may continue to send those even if you have opted out of marketing.

10. Data Retention

We keep your personal information only as long as we need it for the purposes described in this policy, or as long as the law requires (for example, we keep certain payment and tax records for the period required by U.S. and Florida law).

Account, profile, and fitness/health data — including any progress photos — are deleted or anonymized within 90 days after you close your account or ask us to delete your information, except for records we are legally required to keep for tax, accounting, or other legal purposes. Analytics and advertising data is retained according to the default retention settings of Google and Meta. When we no longer need your information, we delete it or make it anonymous.

11. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect your personal information, such as encryption of data in transit, access controls, and working with reputable service providers like Stripe, Supabase, and Cloudflare.

However, no method of transmitting or storing data over the internet is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify affected individuals and applicable regulators where and as required by Florida's Information Protection Act (FIPA, Fla. Stat. 501.171) and any other applicable state breach-notification laws.

12. Children's Privacy

Our website, app, and services are intended for adults 18 and over and are not directed to children. We do not knowingly collect personal information from anyone under 18. Consistent with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. Consistent with the CCPA/CPRA, we do not knowingly sell or share the personal information of consumers under 16 without the opt-in consent required by law.

If you are a parent or guardian and believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will delete it.

13. International Visitors

We are based in the United States, and we process and store information in the United States and wherever our service providers operate. Our website is accessible worldwide, but it is directed to and intended primarily for users in the United States.

If you access our website or services from outside the United States — including from the European Union, EEA, or United Kingdom — you understand that your information will be transferred to, stored, and processed in the United States, which may have data-protection laws that are different from those in your country. Where required, we rely on appropriate safeguards for such transfers. By using our services from outside the United States, you consent to this transfer.

14. Third-Party Links

Our website, emails, and app may contain links to other websites and services that we do not control, such as social media profiles, Stripe checkout, or partner sites. This Privacy Policy does not apply to those third parties.

We are not responsible for the content, products, or privacy practices of any third-party site or service. We encourage you to read the privacy policies of any third party before providing them with your information.

15. Relationship to Our Terms & Disclaimers

This Privacy Policy addresses how we handle your information. Our separate Terms of Service and Disclaimer govern your use of our services and contain important statements you should read, including that Diana Sosa is not a physician, registered dietitian, or licensed healthcare provider; that nothing we provide is medical advice; and that individual fitness results vary and are not guaranteed.

SOSA FIT is a new coaching brand. We do not publish fabricated testimonials, client counts, or before-and-after results. If we ever feature client testimonials or results in the future, we will present them honestly and with the clear and conspicuous disclosures required by the U.S. Federal Trade Commission (FTC), including that individual results are not typical or guaranteed.

16. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our practices, technology, or the law. When we make changes, we will post the updated policy with a new "Last updated" date at the top.

If we make a material change, we will take reasonable steps to notify you, such as by email or a notice on our website. Your continued use of our website, app, or services after the changes take effect means you accept the updated policy.

17. Contact & How to Exercise Your Rights

If you have questions about this Privacy Policy, or if you want to exercise any of your privacy rights — including the right to access, delete, or correct your information, or to opt out of the sale or sharing of your personal information — please contact us:

DIANA SOSA LLC (doing business as SOSA FIT) — Email: [email protected] — Miami, Florida, USA.

This Privacy Policy is governed by the laws of the State of Florida, USA. It is available in English and Spanish; if there is any conflict between the two versions, the English version controls. When you reach out, please tell us what you would like to do so we can verify your identity (where required — not needed to opt out of sale or sharing) and respond as quickly as the law allows.