Privacy policy
Versão 2026-08-30 · atualizado em 2026-08-30
Who is the controller
The controller of the personal data processed on this site is weavehub. For questions, requests, or to exercise your rights under this policy, contact [email protected]. This same address also serves as the data protection officer (DPO) contact required under the LGPD and the GDPR.
Data we collect
We collect different categories of personal data depending on your role on weavehub. Contact form visitor: — Name. — Chosen contact channel (email, phone call, or WhatsApp) and the corresponding detail (email or phone number). — The content of the message sent. — The language the form was filled in. — Your IP address is hashed (SHA-256) at submission time, solely for abuse control (rate limiting). The raw IP address is never stored. Coach profile: — Name, email, and photo (stored via our hosting provider's Blob storage). — Declared location (country, city, region, and time zone). — Links provided (personal website, LinkedIn, Instagram, YouTube). — Declared credentials (institution, year, and verification URL, when provided). — Bio and headline shown on the public profile. — Some internal profile-classification fields that are not shown publicly. Authentication: — Email, magic-link tokens, and session data, used for passwordless login. Coach activity in the logged-in area: — The week a login happened, with the number of logins in that week, and the week the dashboard was opened. The record is weekly: we do not keep the time of any individual access, nor how many times the dashboard was opened.
Purposes and legal basis
We process this data for specific purposes, each with a corresponding legal basis under the LGPD (Art. 7) and the GDPR (Art. 6): — Coach profile: we maintain the directory and publish the coach's profile. Legal basis: performance of a contract or service. — Contact form: we deliver your message to the chosen coach by email. Legal basis: consent, recorded at the time the form is submitted. — Abuse control (hashed IP): we protect the service against misuse and excessive submissions. Legal basis: legitimate interest. — Magic-link authentication: allows coaches and the curation team to access the logged-in area. Legal basis: performance of a contract or service. — Analytics (PostHog): we measure audience anonymously, without identifying visitors. Legal basis: legitimate interest, given the anonymous, cookieless nature of the collection (see “Cookies and analytics”). — Coach activity in the logged-in area: we track who remains active, so the curation team can reach out to those who stopped, and we measure engagement across the directory. Legal basis: legitimate interest. This record stays in our own database, in the European Union, and never reaches the analytics tool.
Consent for contact
By submitting the contact form, you consent to the processing of the data described in “Data we collect” for the purpose of delivering your message to the coach. This consent is recorded at submission time, together with the version of this policy then in effect. To withdraw consent at any time, write to [email protected].
Cookies and analytics
We use only essential cookies, needed to keep your session active and remember your chosen language. We do not use tracking or advertising cookies. Our analytics tool (PostHog) is configured to collect data anonymously: — It masks all text and element attributes on the page. — It respects the browser's Do Not Track signal. — It does not write cookies or persistent browser storage: the anonymous identifier of the visit is kept in session storage (sessionStorage) and discarded when the tab is closed. — It only creates a person profile if someone identifies themselves explicitly at some point. — It runs only on public pages — never in the admin area or the coach dashboard. In the coach dashboard we record only the week of a login and the week of an access, in our own database — no tracking cookie, and nothing sent to the analytics tool. The “Data we collect” and “Retention” sections describe this record.
Subprocessors and international transfers
We use service providers (subprocessors) to run weavehub: database, hosting, email delivery, and analytics. The full list, with each provider's purpose and region, is on the Subprocessors page. One of these providers, responsible for transactional email delivery, processes data in the United States. This international transfer relies on standard contractual clauses, as required by the LGPD (Art. 33) and the GDPR (Chapter V).
Retention
We keep data for as long as needed for the purposes described in this policy: — Contact messages: kept for as long as the coach's profile exists. If a coach is removed from the directory, associated messages are deleted along with it. — Sessions and access tokens (magic links): expire automatically once each token or session reaches its expiration date. — Abuse-control records (hashed IP): discarded automatically and periodically, as the control window is reassessed. — Coach photo: deleting a coach's profile cascades to delete related data; removal of the photo from storage may not happen automatically. If you'd like it removed, request it through this policy's contact channel. — Coach activity in the logged-in area: kept for 12 months. Weeks older than that are deleted automatically as new accesses are recorded. Deleting a coach's account deletes this history along with it.
Your rights and how to exercise them
As a data subject, you have the right to: — Confirm that processing exists and access the data we hold about you. — Correct incomplete, inaccurate, or outdated data. — Request deletion of your data. — Request portability of your data to another provider. — Object to processing or withdraw a consent previously given. Today, these rights are handled manually by our curation team — there is no self-service button on the site for this yet. To exercise any of them, write to [email protected]. We respond within the legally required timeframe.
Changes to this policy and versioning
This policy has a dated version, shown on this page. Whenever the text changes, we publish the new version here, with an updated date. The version in effect when you submit the contact form is recorded together with your consent.