Privacy & Cookies

The Plate Atlas is run by Alessandro Azzaretto, Novara, Italy, who is the data controller for this site. For anything about your data, write to ciao@theplateatlas.com.

We use no profiling cookies, no analytics and no advertising. The guide itself sets no cookies.

The only things stored on your device are technical:

• pg_lingua (local storage on your device): remembers the language you chose with the EN / IT switch. It stays until you clear your browser's data.
• pg_gymdata_v2 (local storage on your device), only if you fill in the form for gyms with your personal link: keeps your answers, including the name and role of the person filling it in, so they are not lost if the page closes. Photos are not kept. It is deleted when you send the form, or stays until you clear your browser's data.
• pg_field_v1 (local storage on your device), only if you use the invite-only gym report form: keeps your answers, nickname, email if given, and invite code on your phone, so you can finish a report over several days. Nothing in it reaches us until you press Send. It stays until you delete the report from the form or clear your browser's data.

Because nothing here tracks you, there is no cookie banner.

If you use "Near me" in The Guide, your browser asks for permission first. Your position is used only inside your browser to sort the gyms. It is never sent to us and never saved in the page address.

Links to Instagram take you to Instagram's own site, which has its own privacy policy. Nothing from Instagram is embedded in these pages.

The site and its database are hosted by Cloudflare, Inc., which acts as our data processor. To deliver the pages and protect the site, Cloudflare processes technical data such as your IP address, your browser type and the pages you request. Some of this processing may take place in the United States; these transfers are covered by the EU-US Data Privacy Framework.

We use your IP address only for a few seconds in memory, for an anti-abuse counter that resets after one minute; we do not save it in any archive. Legal basis: legitimate interest in the security of the form.

Map tiles and map labels are loaded from OpenFreeMap (tiles.openfreemap.org), and only on pages that show a map. To send them, OpenFreeMap receives your IP address and the map area you are looking at, like any web server. Map data © OpenStreetMap contributors, © OpenMapTiles.

Besides Cloudflare and OpenFreeMap, described above, these providers process data for us as data processors:

• Google Ireland Ltd and Google LLC (Gmail): the mailbox that receives the emails sent to ciao@theplateatlas.com. If you write to us, your email address and your message are kept there.
• Resend: sends our emails, from servers in the European Union.

Any transfer of data to the United States is covered by the EU-US Data Privacy Framework.

The gym report form is by invitation only: we send a personal link to people who already train at a gym. The form is only for people aged 18 or over.

What we collect when you send a report:

• the invite code in your link, and the name we linked to that code when we sent it to you;
• a nickname, and your email if you choose to give it;
• the gym's name, address, city, country and type;
• your answers to 30 questions and your impressions in your own words;
• the three statements you tick before sending: that you are 18 or over, that you are a member of the gym or train there regularly with no conflict of interest, and that the report is your own direct experience;
• when the report arrived, the indicative score calculated from your answers, your consent to publication, and a random ID of the report that prevents duplicates.

Why. To publish community reports in the guide. On the gym's page we publish a summary we write ourselves, what stands out and what to watch out for, the facts members report, your account of the gym in your own words (read and edited by us), and the month your report was sent. Your nickname, your email and the name linked to your invite are never published: the gym pages have no place for them.

Legal basis. Your consent for publication (Art. 6(1)(a) GDPR), given with the tick box before you send. Our legitimate interest (Art. 6(1)(f) GDPR) for the security of the form and its anti-abuse limits, and for keeping a record of your statements, which shows that community reports are authentic.

Your IP address. We use your IP address only for a few seconds in memory, for an anti-abuse counter that resets after one minute; we do not save it in any archive. Legal basis: legitimate interest in the security of the form.

How long. Your nickname, email, invite code and the name linked to it are deleted 12 months after your report arrives. The rest of the report is kept while the community report is published, or until you ask us to delete it.

Who sees it. Only Alessandro Azzaretto, and Cloudflare as our hosting provider. If you write to us by email, also the providers listed under Recipients. To write the summaries we may export reports to a private file; the same rules apply to it.

Withdrawing consent. You can withdraw your consent at any time by writing to us: we remove your report from the guide and from our database. Withdrawal does not make unlawful what we did before it.

Gyms in the guide can receive a personal link, valid for 60 days, to send us their official information (see For gyms). We store the link only as a fingerprint (a SHA-256 hash), never the link itself.

What we collect:

• the gym's information: type, opening hours, equipment, house rules, services, access, links (website, Instagram, a link to a video) and up to 3 highlights in the gym's own words;
• the name and role of the person who fills in the form, which we never publish;
• up to 8 photos of the gym. The page resizes them in your browser before sending, which removes hidden data such as location. We do not accept video uploads, only links;
• the boxes ticked before sending, the version of the Conditions for gyms accepted, and when the information arrived.

Why. To publish the gym's page in the guide, with the label "Provided by the gym", and to contact the gym about it.

Legal basis. Carrying out the gym's request (Art. 6(1)(b) GDPR), to manage and publish the information it sends us. Consent for photos and videos (Art. 6(1)(a) GDPR). Our legitimate interest (Art. 6(1)(f) GDPR) in managing the gym's page.

Where. With Cloudflare, Inc., our hosting provider. Photos are stored in a private Cloudflare R2 bucket, under random names. They become public only after we approve them; photos we discard are deleted.

How long. The name and role of the person who fills in the form, and the declarations, are kept for 24 months from our last contact. The gym's information and photos are kept while they are published, or until the gym asks us to remove them. Information we do not approve is deleted within 12 months.

Your rights. The rights listed below apply. Write to ciao@theplateatlas.com; a gym can also ask us at any time to correct or remove its information and photos, and we answer within 7 days.

We contact the gyms in the guide only once, at the generic email address published on their official website (the source of their information), to ask them to check their information.

For each gym we keep a contact record: its generic email address, the page of its website where we found it, and the status of our contact (when we wrote, whether it answered or sent its information). We keep it while the gym is in the guide.

If a gym answers that it does not want to be contacted, we add it to an exclusion list (only the email address and the date). We keep this list indefinitely, for the sole purpose of not contacting that gym again.

Legal basis. Our legitimate interest (Art. 6(1)(f) GDPR) and respect for the objection received (Art. 21 GDPR).

Under the GDPR you can ask to access your data, correct it, delete it, withdraw your consent, object to its processing, restrict it, and receive it in a portable format. Write to ciao@theplateatlas.com: we answer within one month.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it (opens in a new tab)).

If the Italian and English versions of this page differ, the Italian version prevails.

Last updated: 14 November 2026

Leggi questa pagina in italiano →