Privacy policy
Versão 2026-07-06 · atualizado em 2026-07-06
Who is the controller
The controller of the personal data processed on this site is weavehub. For questions, requests, or to exercise your rights under this policy, contact [email protected]. This same address also serves as the data protection officer (DPO) contact required under the LGPD and the GDPR.
Data we collect
We collect different categories of personal data depending on your role on weavehub. Contact form visitor: — Name. — Chosen contact channel (email, phone call, or WhatsApp) and the corresponding detail (email or phone number). — The content of the message sent. — The language the form was filled in. — Your IP address is hashed (SHA-256) at submission time, solely for abuse control (rate limiting). The raw IP address is never stored. Coach profile: — Name, email, and photo (stored via our hosting provider's Blob storage). — Declared location (country, city, region, and time zone). — Links provided (personal website, LinkedIn, Instagram, YouTube). — Declared credentials (institution, year, and verification URL, when provided). — Bio and headline shown on the public profile. — Some internal profile-classification fields that are not shown publicly. Authentication: — Email, magic-link tokens, and session data, used for passwordless login.
Purposes and legal basis
We process this data for specific purposes, each with a corresponding legal basis under the LGPD (Art. 7) and the GDPR (Art. 6): — Coach profile: we maintain the directory and publish the coach's profile. Legal basis: performance of a contract or service. — Contact form: we deliver your message to the chosen coach by email. Legal basis: consent, recorded at the time the form is submitted. — Abuse control (hashed IP): we protect the service against misuse and excessive submissions. Legal basis: legitimate interest. — Magic-link authentication: allows coaches and the curation team to access the logged-in area. Legal basis: performance of a contract or service. — Analytics (PostHog): we measure audience anonymously, without identifying visitors. Legal basis: legitimate interest, given the anonymous, cookieless nature of the collection (see “Cookies and analytics”).
Consent for contact
By submitting the contact form, you consent to the processing of the data described in “Data we collect” for the purpose of delivering your message to the coach. This consent is recorded at submission time, together with the version of this policy then in effect. To withdraw consent at any time, write to [email protected].
Cookies and analytics
We use only essential cookies, needed to keep your session active and remember your chosen language. We do not use tracking or advertising cookies. Our analytics tool (PostHog) is configured to collect data anonymously: — It masks all text and element attributes on the page. — It respects the browser's Do Not Track signal. — It does not write to cookies or browser local storage; data exists only in memory, for the duration of the session. — It only creates a person profile if someone identifies themselves explicitly at some point. — It runs only on public pages — never in the admin area or the coach dashboard.
Subprocessors and international transfers
We use service providers (subprocessors) to run weavehub: database, hosting, email delivery, and analytics. The full list, with each provider's purpose and region, is on the Subprocessors page. One of these providers, responsible for transactional email delivery, processes data in the United States. This international transfer relies on standard contractual clauses, as required by the LGPD (Art. 33) and the GDPR (Chapter V).
Retention
We keep data for as long as needed for the purposes described in this policy: — Contact messages: kept for as long as the coach's profile exists. If a coach is removed from the directory, associated messages are deleted along with it. — Sessions and access tokens (magic links): expire automatically once each token or session reaches its expiration date. — Abuse-control records (hashed IP): discarded automatically and periodically, as the control window is reassessed. — Coach photo: deleting a coach's profile cascades to delete related data; removal of the photo from storage may not happen automatically. If you'd like it removed, request it through this policy's contact channel.
Your rights and how to exercise them
As a data subject, you have the right to: — Confirm that processing exists and access the data we hold about you. — Correct incomplete, inaccurate, or outdated data. — Request deletion of your data. — Request portability of your data to another provider. — Object to processing or withdraw a consent previously given. Today, these rights are handled manually by our curation team — there is no self-service button on the site for this yet. To exercise any of them, write to [email protected]. We respond within the legally required timeframe.
Changes to this policy and versioning
This policy has a dated version, shown on this page. Whenever the text changes, we publish the new version here, with an updated date. The version in effect when you submit the contact form is recorded together with your consent.