Privacy Policy

Quettafit is operated by a private individual controller established in Brazil, who also acts as the person responsible for privacy questions. Even microenterprises formally exempted by ANPD Resolution CD/ANPD No. 2/2022 should appoint such a person, and we do so voluntarily. Write to the contact address above at any time, and we will confirm the full legal identification of the controller when you need it for a formal request.

We collect only what the platform needs to work, grouped as follows.

• Identification and account data: email address, password (stored only as a secure hash), name or display name, profile photo, account type (trainer or client), language and country, and for trainers a public biography, city, specialties, public page address, and studio details.
• Technical and browsing data: internet address (IP), device and browser information, access and error logs, session identifiers stored in your browser, and a one-way device signature used only to prevent repeated abuse of free trials. We do not track your GPS location.
• Payment data: subscription plan, status, billing periods, payment identifiers created by our payment provider, payout details you choose to publish (such as a PayPal address), and records of payments a client reports to a trainer. Full card numbers never reach our systems.
• Health-related data, treated as sensitive: body measurements and weight, training history and logs, nutrition intake and targets, health limitations and intake questionnaires, progress photos of your body, and notes your coach writes about your training. These are collected only with your explicit consent and only for coaching purposes.
• Content you create: messages, community posts and comments, reviews, uploaded exercise videos, photos, brand logos, program content, and prompts you send to our in-app assistant.
• Support and communication data: messages you send us and your email preferences.

• To create and maintain your account, deliver coaching features, scheduling, messaging, the marketplace, and to charge subscriptions: performance of a contract.
• To keep the platform safe, prevent fraud and abuse of free trials, moderate content, and investigate incidents: legitimate interest.
• To keep tax, accounting, and billing records: compliance with a legal or regulatory obligation.
• To process health, nutrition, body measurement, and body photo data: your explicit consent for sensitive data, which you may withdraw at any time.
• To send optional product analytics, optional marketing emails, and to publish a public coach profile: your consent.
• To defend our rights in administrative, judicial, or arbitration proceedings when necessary: regular exercise of rights.

Withdrawing consent stops future processing based on that consent but does not affect processing that was already lawful. Withdrawing consent for health data means we can no longer provide personalized coaching features that depend on it.

We never sell personal data. We share only what each provider needs to deliver its part of the service:

• Cloud hosting, database, authentication, and file storage (Supabase, on infrastructure in the United States): all application data, including account and health data. Policy: supabase.com/privacy
• Payments, subscriptions, and payouts (Stripe): email, name, country, plan, payment and payout records. Policy: stripe.com/privacy
• Application platform and assistant gateway (Lovable): hosting of the application and the requests sent to our in-app assistant, including the prompt text and images submitted for automatic adult-content screening. Policy: lovable.dev/privacy
• Transactional email delivery (Resend): your email address and the content of the message we send you. Policy: resend.com/legal/privacy-policy
• Sign-in with Google (Google LLC), when you choose it: your Google account identifier, email, and name. Policy: policies.google.com/privacy
• Sign-in with Microsoft (Microsoft Corporation), when you choose it: your Microsoft account identifier, email, and name. Policy: privacy.microsoft.com
• Bot protection on sign-in, sign-up, and password recovery (Cloudflare Turnstile): your internet address and browser signals needed to tell people from bots. Policy: cloudflare.com/privacypolicy
• Nutrition database lookups (Open Food Facts): only the barcode number you scan, with no personal identifier attached. Policy: openfoodfacts.org/privacy

Coaches and clients who are linked to each other see the data the platform is designed to share between them, such as programs, logs, measurements, photos you upload for review, and messages. Your public coach profile and marketplace reviews are visible to anyone.

Our hosting, payment, email, and assistant providers operate servers outside Brazil, mainly in the United States and the European Union. These transfers are made under Article 33 of the Brazilian General Data Protection Law, supported by standard contractual clauses and the data processing agreements offered by each provider, plus encryption in transit and access controls. You may ask us for details about the safeguards in place.

• Account, profile, training, nutrition, measurement, photo, and message data: while your account exists, and up to 30 days after you delete it, to complete the deletion across backups.
• Access and security logs: 6 months, matching Article 15 of the Brazilian Internet Civil Framework.
• Financial and tax records of payments and payouts: 5 years, as required by Brazilian tax and consumer law, in reduced form that keeps only what the law requires.
• Consent and acceptance records: while your account exists and for 5 years afterwards, as proof that consent was given and later withdrawn.
• Support messages: 2 years after the conversation ends.

When a period ends, data is deleted or irreversibly anonymized. Public content you posted in the community or marketplace may remain visible in an anonymized form.

Under Article 18 of the Brazilian General Data Protection Law you may ask us to:

• Confirm whether we process data about you.
• Give you access to the data we hold.
• Correct data that is incomplete, inaccurate, or out of date.
• Anonymize, block, or delete data that is unnecessary, excessive, or processed unlawfully.
• Port your data to another provider, in a structured, machine-readable format.
• Delete data processed on the basis of your consent.
• Tell you who we shared your data with.
• Explain what happens if you refuse consent, so you can decide freely.
• Withdraw a consent you previously gave.
• Ask for human review of a decision taken only by automatic means, under Article 20. Our assistant only drafts suggestions for a human coach to approve, so no decision about you is made automatically.

The fastest route is the in-app privacy centre, where you can export your data, review your consent history, change consent, and request account deletion. You can also write to the contact address above. We answer within 15 days, and we may need to confirm your identity first. Requests are free.

In line with Article 46 of the Brazilian General Data Protection Law we use encrypted connections, encryption at rest by our hosting provider, row-level access rules so users can only reach their own data and data explicitly shared with them, password hashing and checks against known leaked passwords, rate limiting on sensitive actions, private storage buckets with signed short-lived links for photos and videos, automatic adult-content screening of uploaded images, administrative access limited to the account owner, and audit records for sensitive operations. No system is completely risk-free, so please use a strong, unique password.

• Strictly necessary: keep you signed in, remember your theme and language, secure forms against cross-site requests, and keep offline workout entries until they sync. These cannot be switched off without breaking the service.
• Analytical (optional): help us understand which features are used, only if you accept them.
• Marketing: we do not use marketing or advertising cookies, and we have no advertising pixels installed.

The cookie banner lets you accept optional analytics or keep essential storage only, and you can change your choice at any time in the privacy centre. You can also block or delete cookies and local storage in your browser settings, though signing in may stop working.

Quettafit is intended for people aged 18 or over, and we ask you to confirm this when you create an account. We do not knowingly collect data from children. If a teenager uses the platform with a parent or guardian, processing follows Article 14 and the best interest of the young person, and personalized coaching data is only processed with verifiable authorization from the parent or guardian. If you believe a minor created an account, write to us and we will remove it.

If a security incident occurs that may create relevant risk or damage, we will investigate immediately, contain the incident, and notify the National Data Protection Authority and the affected people within a reasonable period, targeting 72 hours from becoming aware, as required by Article 48. The notice will describe the data involved, the risks, the measures taken, and what you can do.

If you are not satisfied with our answer, you may complain to the Brazilian National Data Protection Authority at gov.br/anpd, or to the consumer protection bodies in your city.

This is version 2026-09-05, the first published version. If we make a relevant change we will publish the new version here with a new effective date and notify you in the app or by email before it applies to you. The version you accepted is recorded with your account as proof of consent.

This policy is governed by Brazilian law, in particular the General Data Protection Law (Law No. 13.709/2018), the Internet Civil Framework (Law No. 12.965/2014), and the Consumer Protection Code. Disputes may be brought in the court of the consumer's domicile.