privacy.

this page sets no cookies and stores nothing on your device. it counts visits and clicks on my own server, without knowing who you are. whop handles the payment, discord runs the server. here is who sees what, and what you can ask me.

1.who is responsible

this site is run by matteo abati, italy. i am the data controller under the general data protection regulation (eu) 2016/679 (gdpr) for everything described here. for anything about your data, write to matteoabati054@gmail.com. i have no data protection officer: the law does not require one for an activity of this size.

2.what this website measures

there is no login here, no newsletter, no cart, no search box, no comments, and only one form: the 1of1 waitlist, which sends nothing until you fill it in and press its button (section 13). there is no advertising pixel, no embedded video, no font loaded from a third party and no analytics service of anyone else. the page sets no cookies and writes nothing to your browser: no local storage, no session storage, no indexeddb. it does not follow you across sites, and nothing on it is loaded from anyone else: your browser talks only to the server that sent you the page, and, only if you send the waitlist form, to the form service of section 13.

what the page does is count. a small script of mine, written into the page, sends my own server a short record of the visit, so that i can see which parts of the site work and which do not. the record goes to a database in my cloudflare account (section 8) and to no one else. it holds:

where you came from: the tag of the link you used (for example matteoaab.com/tt for tiktok, or a utm tag), otherwise the domain of the site that sent you, only the domain, never the full address;
the language of your browser, the size of the window, the density of the screen and the hour of the day on your device;
which sections of the page came into view and after how long, how far down you scrolled, what you clicked on the page (buttons, links, questions, screenshots, the video) and where that link leads, and whether you left for another site;
how fast the page loaded and answered (the standard web vitals: lcp, cls, inp, ttfb), a short error message if the code of the page breaks, and for how many seconds the page was on screen: a few times while it is open (after 15, 30, 60 seconds and so on, up to 8 minutes) and when you close or leave the tab.

when the record arrives, my server notes the time it arrived, and cloudflare tells it the country and region your connection comes from; the user agent of your browser tells it the type of device, the operating system, the browser, and whether you opened the page inside an app such as instagram or tiktok. if you open an address of this site that does not exist, the record also holds the path you asked for (never what comes after a "?"), so that i can find broken links.

your ip address is used for one thing only: together with the user agent and a random value that changes every day, it goes through a one-way function (sha-256) that makes a code, so that one visitor counts once a day. the ip address itself is never stored. the random value of each day is deleted from the database two days later. like every database at cloudflare, mine also keeps an automatic restore history that i cannot switch off: 7 days on cloudflare's free plan, up to 30 days on a paid plan. for that extra time a deleted value could still be brought back, and with it a code could in theory be matched to an address by trying addresses one by one. i never do that, and i never restore the database for it. once the value is gone from that history too, nobody, me included, can turn the code back into an address or link it to the same person on another day.

each page load also gets its own random id. in your browser it lives only in the memory of the page and is gone when you close it; it is sent with each record and kept with the records of that visit, for as long as they are kept (section 9), so that the steps of one visit can be read together. it is never reused and says nothing about who you are.

i do not use any of this to find out who you are, i do not combine it with what whop, cal.com or discord know about you, i do not sell it and i do not share it. legal basis: my legitimate interest in measuring and improving my own site (art. 6(1)(f) gdpr), with the least data that does the job. if your browser sends global privacy control or do not track, the script does nothing at all and no record is sent.

when you click a whop checkout link on the page, three tags are added to that link: where you came from (for example tiktok), the word "site", and which button you pressed. whop receives them with the page you open and may show them to me next to a sale. they carry nothing else, but next to a sale, which on whop comes with your username and e-mail address, they tell me which channel and which button that buyer came from.

the cookies page says the same thing in a few lines.

the page links out to whop, cal.com, discord, youtube, instagram, tiktok, tradeify and alpha futures. nothing from them is embedded: those sites learn nothing about you unless you click. once you click, you are on their site and their privacy policy applies, not mine, except for what you enter on my booking page on cal.com (section 5).

3.what the server sees anyway

the site is hosted on cloudflare pages, by cloudflare, inc. like every website, the machine that hosts this page keeps technical logs: your ip address, the date and time, the page requested, your browser and operating system, and the size of the response. an ip address counts as personal data in the eu (court of justice, breyer, c-582/14).

i use these logs only to keep the site up and to spot abuse. legal basis: my legitimate interest in running a working, secure website (art. 6(1)(f) gdpr). the host acts as my processor under art. 28 gdpr, under its standard data processing agreement, and deletes the logs on its own schedule.

4.when you buy on whop

payment does not happen on this site. it happens on whop.com: today for the signal room, and before 27 october 2026 also for the mentorship and the 1of1, which are closed to new members (terms, section 3). the 1of1 was paid from a private whop link sent once we had agreed it in writing by e-mail, and those e-mails i keep the same way as the whop records below. whop collects your payment details, your billing address and whatever it needs for tax; i never see your card number. for the payment itself whop is an independent controller: its policy is at whop.com/privacy.

after the purchase i see what any seller sees on whop: your whop username, your e-mail address, the plan you bought, the dates and amounts, the country used for tax, and anything you write in a support or refund case. i use this to deliver what you bought, to answer you, to send you the notices the terms promise (a price change, a closing), to handle refunds and disputes, and to keep the records that tax and accounting law require. legal bases: the contract with you (art. 6(1)(b) gdpr) and my legal obligations (art. 6(1)(c)).

5.when you book a call

if you book a call with me, you do it on cal.com through a plain link: nothing from cal.com is embedded in this site, and this page still collects nothing. the booking page asks for the details written on it, such as your name and e-mail, and your answers to its questions, so that i can hold the call and prepare it. legal basis: steps you asked for before a contract (art. 6(1)(b) gdpr).

cal.com runs the booking page for me as a processor under art. 28 gdpr (section 8); for the rest of its site its own policy applies (cal.com/privacy). the booking goes into my google calendar, the call runs on google meet, and my e-mail, any written agreement included, runs on gmail: google handles those under its own privacy terms. i do not record the call.

i do not ask for account numbers or any login, and you should not send them. if we do not work together, the booking, your answers and my notes are deleted within six months; if we do, they are kept as purchase records (section 9).

6.inside the discord server

if you join the niche discord, discord inc. processes your data under its own policy (discord.com/privacy). inside the server i see what everyone sees: your username, your messages in the channels, the list of members, and the direct messages you send me. paying members get a role that whop assigns and removes automatically when a membership starts or ends; that is the only thing whop and discord exchange about you through me.

my bot answers questions in the server: in the premium channels from my lessons and my breakdowns, in the free channels about what i sell and how the server works. it runs on my own computer. what you write to it, in a channel or in a direct message, and any image or file attached to a message it is asked to read, is sent to anthropic, the company whose ai model (claude) powers it, to generate the answer. the messages, the answers and those attachments are also kept on my computer, and i can read them. to understand a question, the bot may also read the earlier messages of the same channel or conversation.

a question you ask the bot in a channel, the free chat of the free discord included, is a message like any other: it and the bot's answer are posted in that channel, and everyone who can see the channel can read them. if you would rather keep it between us, write to me in a dm.

anthropic handles them under its own privacy terms, which say what it keeps and how it may use it. do not paste account numbers, credentials or anything private into the bot, such as your health, your money troubles or someone else's data; it does not need them and neither do i. if you did, tell me and i delete it from what the bot keeps.

legal basis for all of this: the contract with you for the paid channels (art. 6(1)(b)), and my legitimate interest in running a community you chose to join, and a bot that answers in it, for the free ones (art. 6(1)(f)).

7.screenshots, reviews and quotes of members

the payout screenshots, certificates, chat messages and quotes on the site and on my socials were posted by members inside the niche discord, written as reviews on whop, or sent to me by members. i show them there as proof of what happens in the server. they show the discord username under which the message was posted, the amount, the date and the text. first names, surnames, e-mail addresses, account numbers and balances that appeared on the documents have been pixelated; whop reviews appear with the name the reviewer chose to publish on whop.

legal basis: my legitimate interest in showing, with real evidence, what my service does (art. 6(1)(f) gdpr), balanced against yours: the data is what you chose to post in a server of more than a thousand people, the identifying details are removed, nothing is sold or matched with anything else, and you can have it taken down at any time.

if one of them is yours and you want it gone, or your name shortened, write to matteoabati054@gmail.com or message me on discord and it comes down. no explanation needed. that is your right to object under art. 21 gdpr, and i do not weigh it: i just remove it, from the site and from my socials. if you are no longer in the server, e-mail works.

what i show is posted under the text in force when it was posted. for anything posted before 25 september 2026 that is the old text: if your username is on the site or on my socials from back then and you would rather it was not, tell me and it is shortened, or the whole post comes down. no explanation needed.

8.where your data goes

i do not sell data and i do not share it for advertising. the only third parties involved are cloudflare, which hosts the site and keeps the database of visit records (sections 2 and 3), whop (section 4), cal.com and google (section 5), discord and the ai provider behind my bot (section 6), and formspree, the form service of the waitlist, only if you use it (section 13), each for the part described. what the bot keeps stays on my own computer. cloudflare, whop, cal.com, discord, anthropic and formspree are established in the united states, and google may process data there too.

cloudflare and cal.com work for me as processors (art. 28 gdpr), and their transfers of your data out of the eu rest on the standard contractual clauses approved by the european commission (art. 46(2)(c) gdpr); cloudflare is also certified under the eu-us data privacy framework. the transfers of whop, discord, anthropic and google rest on the safeguards in their own policies: the same standard contractual clauses and, where the company is certified, the eu-us data privacy framework. i am a customer of all of them and do not control their transfers; their policies say exactly which safeguard applies to which service.

9.how long i keep things

server logs: deleted by the host on its schedule (section 3).
visit records (section 2): 400 days, then deleted automatically; the restore history of the database (section 2) can hold a deleted record for up to 30 more days. the daily random value behind the visitor code: two days, plus that same history.
purchase records, on whop and for the 1of1: for as long as your membership lasts, then for as long as tax and accounting rules require records of a sale to be kept (in italy, up to ten years).
call bookings (section 5): if we do not work together, the booking, your answers and my notes are deleted within six months; if we do, they are kept as purchase records.
messages in the server and to me: for as long as the server exists, or until you delete them; discord keeps its own copy under its policy.
what the bot keeps on my computer (section 6): messages, answers and attachments, for as long as the server exists, or until you ask me to delete yours; anthropic keeps its own copy under its terms.
screenshots and quotes on the site and on my socials: for as long as they are up, and no longer than they stay true. removed on request, at once.
the 1of1 waitlist (section 13): until a spot opens and i have written to you about it, or 12 months at most, then deleted; sooner if you ask, or if i close the list.
support and refund cases: for as long as a dispute could still be raised on that payment, then deleted.

10.your rights

you can ask me, at any time and for free, to tell you what data of yours i hold and to give you a copy (access, art. 15), to correct it (art. 16), to delete it (art. 17), to restrict what i do with it (art. 18), to receive it in a portable format where it was processed by automated means on the basis of contract or consent (art. 20), and to object to any processing based on legitimate interest (art. 21), including every screenshot and quote in section 7. where i rely on consent, as for the 1of1 waitlist (section 13), you can withdraw it at any time, as easily as you gave it, without affecting what was done before.

the visit records of section 2 are not linked to a name or an address, so i usually cannot tell which ones are yours (art. 11 gdpr) unless you give me something that points to them. to object for the future, switch on global privacy control or do not track in your browser, if it has them: from then on nothing is sent.

write to matteoabati054@gmail.com. you get an answer within one month (art. 12(3) gdpr). i may ask you to prove that the data is yours, and nothing more.

11.complaints

if my answer is not good enough, you can complain to the italian data protection authority, the garante per la protezione dei dati personali (www.gpdp.it, piazza venezia 11, 00187 roma), or to the supervisory authority of the eu country where you live or work. you can also go to court. none of this costs you a right you already have.

12.under 18

the site, the products and the server are for adults. i do not knowingly process data of anyone under 18; if i learn that a member is, that member is removed from the server (terms, section 7) and i delete the data i hold, except the purchase record that tax and accounting law makes me keep, and what i need for a refund or a dispute on that payment while it can still be raised (section 9).

13.the 1of1 waitlist

the 1of1 is full. under its card on the site there is one small form where you can leave your e-mail address or your discord username, so that i can message you if a spot opens. it is the only form on the site, and nothing is sent until you tick both boxes and press "add me to the list".

who is responsible. i am, matteo abati, as for the rest of this page (section 1).
what i get. only what you write in the field, an e-mail address or a discord username, the fact that you ticked the consent box and the box saying you understand the 1of1 price starts from a minimum of EUR 1,000, and the date and time your entry arrived. i do not ask for your name or for anything else. a hidden field that people leave empty is there to stop spam bots; it holds nothing about you.
what for, and nothing else. to write to you if a 1of1 spot opens: by e-mail if you left an e-mail, on discord if you left a handle (section 6). no newsletter, no other offers, no advertising, and it is not sold or shared with anyone for their own use.
legal basis. your consent (art. 6(1)(a) gdpr), given by ticking the box, which is never ticked for you. giving it is up to you: without it you are simply not on the list, and the rest of the site works the same. you can withdraw it at any time, as easily as you gave it, by writing to me (below): your entry is then deleted. withdrawing does not affect what was done before.
how long. until a spot opens and i have written to you about it, or 12 months from the day your entry arrived at most, whichever comes first; then it is deleted. sooner if you ask, or if i close the list.
deleting it. write to matteoabati054@gmail.com or message me on discord with the e-mail or discord username you left: it is deleted from my list and from the form service, and i tell you when it is done.
who else gets it. the form does not go to my server. when you press the button, your browser sends it to the form service i use, formspree (formspree.io), an outside company that receives the entries and keeps them for me, as my processor (art. 28 gdpr), so that i can read them. like any server, it also receives the technical data of the request, such as your ip address and your browser, and may keep them for its own security under its own terms. formspree is a company based in the united states, so your entry may be transferred outside the eu; that transfer relies on the safeguards of section 8 and on the data processing terms with formspree. where it keeps the data, you can ask me at any time.
no tracking. the form adds no cookie and no tracker, and nothing from the form service is loaded in the page before you press the button. my visit count (section 2) can note that the waitlist was opened or that its button was pressed, as for any other button, but never what you write in it.
no automated decision. nothing is decided about you automatically (art. 22 gdpr). being on the list does not give you a spot or a place in a queue: what the list means is in the terms, section 29.
your rights. access, correction, deletion and the others of section 10, and the right to complain to the garante or to the authority where you live (section 11).

14.changes

if this text changes, the date at the top changes with it. changes that reduce what you can expect from me are announced in the server before they apply.