Privacy Policy

1. Overview

This Privacy Policy describes how WeForge (“we”), through the platform available at weforge.fit, collects, uses, stores, and protects personal data, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD).

For data of students entered by Professionals (personal trainers, nutritionists), the Professional acts as the controller and WeForge as the processor, handling data according to the Professional’s instructions. For the Professionals’ own registration data, WeForge acts as the controller.

2. Data We Collect

Registration data: full name, email, and password (stored in encrypted form).

Student data entered by Professionals: name, email, phone, date of birth, identification document, payment status, assigned workouts and plans.

Physical progress data (sensitive health data): progress photos and body measurements (weight, circumferences), entered by the student or the Professional.

Usage data: access logs, IP address, browser identifier (user agent), and Platform usage events, for security, auditing, and product improvement purposes.

3. Purposes of Processing

Providing the contracted service: management of students, workouts, nutrition, progress, and payments.

Authenticating users and protecting accounts against unauthorized access.

Sending essential transactional communications (invitations, password resets, confirmations).

Maintaining audit trails of sensitive actions, as a security obligation.

Monitoring Platform errors and performance for continuous improvement.

4. Sharing with Sub-processors

We use infrastructure and service providers strictly necessary to operate the Platform: application hosting (Railway), database, authentication and file storage (Supabase), error monitoring (Sentry), product usage analytics (PostHog), and transactional email delivery (Resend).

These providers process data on our behalf, under contracts requiring confidentiality and security. Some may store data outside Brazil; in such cases, the international transfer follows the mechanisms set out in the LGPD.

We do not sell personal data nor share it for advertising purposes.

5. Data Isolation (Multi-tenant)

Each Professional’s data and that of their students is isolated by workspace (tenant), with database-level security policies (Row Level Security). One Professional cannot access another’s data, and students access only their own data.

Progress photos are stored in a private area, accessible only through signed URLs and authentication.

6. Retention and Deletion

We keep data while the account is active and for the period necessary to comply with legal obligations.

The Professional can permanently delete a student through the Platform itself; in that case, the student’s progress photos, measurements, assignments, and other records are removed, including from file storage servers.

To delete the Professional’s own account and all data in their workspace, simply request it via the email indicated in the Contact section.

7. Data Subject Rights

Under the LGPD, you may request: confirmation that processing exists, access to the data, correction of incomplete or outdated data, anonymization or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent.

Students should direct requests primarily to the responsible Professional (controller). When the request is directed to WeForge, we will provide the necessary support to fulfill it.

8. Security

We adopt technical and organizational measures to protect data, including encryption in transit (HTTPS), hashed passwords, role-based access control, tenant isolation, audit trails, and error monitoring.

No system is entirely immune to incidents. In the event of a security incident posing a relevant risk to data subjects, we will notify those affected and the National Data Protection Authority (ANPD) as required by law.

9. Cookies and Similar Technologies

We use cookies strictly necessary for authentication and session operation, as well as identifiers for product usage analytics. We do not use third-party advertising cookies.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated through the Platform or by email. The date of the last update is shown at the top of this page.

11. Contact

To exercise your rights or clarify questions about privacy, contact us at [email protected].