Privacy policy

Version of October 14, 2026

If the versions differ, the Portuguese version prevails.

On this page
  1. 1.Who we are
  2. 2.Who the data belongs to
  3. 3.What we store
  4. 4.Students' health data
  5. 5.The AI
  6. 6.Who the data is shared with
  7. 7.Data that leaves Brazil
  8. 8.Cookies and what stays on your device
  9. 9.How long we keep data
  10. 10.How we protect it
  11. 11.Your rights
  12. 12.Changes to this policy

1. Who we are

Treinora is a messaging and client-tracking platform built for personal trainers: WhatsApp conversations with students and prospects, training plans, student records, scheduling, and billing for the platform itself.

Address: Avenida José Luiz Sereno, 1147, Jundiaí/SP.

For any privacy matter, contact our data protection officer: newco.claude@gmail.com.

2. Who the data belongs to

There are two kinds of data on the platform, and our responsibility differs for each.

  • Your account data (your name, email, WhatsApp number, payment): here Treinora is the controller, meaning we decide how and why it is processed.
  • Your students' data and the data of prospects who message you: here you are the controller, and Treinora is the processor. We process this data only to provide the service to you, following your instructions and the rules you set on the platform.

Your students never signed anything with Treinora. That is why their data is kept separate per organization in the database, and no other account can read what is yours.

3. What we store

  • Your sign-up details: name, email, WhatsApp number, language, and whatever you add to your profile (about you, specialties, Instagram, logo and colors, a photo of your professional registration).
  • People who request the free trial: name, WhatsApp number, email, and the ad campaign they came from, if any.
  • Your students: contact details, WhatsApp messages, goal, age range, weight and measurements over time, progress photos, diet, questionnaires, materials, workouts and what was done in each, schedule, and any health information you record.
  • People who message your WhatsApp without being students: number, profile name, and the messages exchanged.
  • Subscription payment: the document type and the last two digits of the CPF or CNPJ, the card brand and last four digits, and the charge IDs at Asaas. The full document stays only with Asaas. The card number passes through our server only to be sent to Asaas and is never stored.
  • Technical records: what the platform needs to run and protect itself, such as the IP address of whoever requests a trial, used to limit repeated sign-ups, and a record of each message received from WhatsApp.

4. Students' health data

Injury, pain and restriction are sensitive personal data (article 11 of Brazil's LGPD). On the platform they have one use only: when a student mentions something like that, the platform does not reply and calls you instead.

This data is never sent to the AI. There is a check in our code that fails if anyone tries to include it.

It is up to you to have the student's consent, or another legal basis, to record their health information on the platform.

5. The AI

When you turn on AI replies, the text is generated by Claude, from Anthropic, a United States company. The AI is also used to tell students apart from prospects, to suggest replies and exercise swaps, and to read a photo of a food label.

To reply, the AI receives: the person's name, whether they are a student, their goal, age range, whether their weight is going up, steady or down, the notes you wrote about them, today's workout, the last workout done, the recent messages in the conversation, and what you wrote about yourself and how you talk.

The AI does not receive the student's health information. And what you forbid (topics it may not answer, things it may not recommend) is checked by the platform before and after the AI writes, not just requested from it.

6. Who the data is shared with

We don't sell data. To run the platform we use these services, each receiving only what it needs for its role:

  • Supabase: database, login and files, in the São Paulo region, Brazil.
  • A server in Brazil, rented by us, which runs the platform, the WhatsApp connection and the message queue.
  • WhatsApp, from Meta: the messages you and your students exchange travel over the WhatsApp network, like any conversation.
  • Anthropic (United States): the AI, with the data described in the section above.
  • Resend (United States): email delivery, such as the invitation to set your password and subscription notices.
  • Asaas (Brazil): subscription billing by Pix or card.

We may also have to hand over data when the law or a court order requires it.

7. Data that leaves Brazil

Sending data to Anthropic (AI) and Resend (email) is an international data transfer, to the United States. Everything else stays in Brazil.

8. Cookies and what stays on your device

The platform only uses cookies it needs to work, none for advertising:

  • login, so you stay signed in;
  • your choice of light or dark theme, and whether the side menu stays open;
  • a mark of each team member's first visit of the day, so we know the account is being used;
  • anyone arriving through a referral link gets an identifier for 90 days, so the referral is counted.

On the student's phone, the workout in progress is kept on the device until it is sent, so nothing is lost if the connection drops.

9. How long we keep data

Right now the platform deletes nothing automatically over time: data stays as long as the account exists. When a subscription expires nothing is deleted, so you find everything as you left it if you come back.

If you ask us to delete your account or a student, we do it by hand, through the privacy channel. Payment records are kept for as long as the law requires.

Retention periods: account data is kept while the account is active and deleted within 90 days after it is closed; payment and billing records are kept for 5 years, as tax law requires; platform access logs are kept for 6 months, as required by Brazil's Marco Civil da Internet.

10. How we protect it

  • Each organization only sees its own data. The separation is enforced by the database itself, row by row, not just by the screen.
  • Every connection to the platform is encrypted (HTTPS).
  • We never store the card number.
  • Payment records and sensitive-topic records only ever get new rows: what was written is never edited or deleted.
  • When someone on our team enters your account for support, the visit is logged before it happens and has a time limit. By default they can only look: no message goes out to your students and no file is uploaded. To change anything they must deliberately unlock it, and that unlock is logged too.

11. Your rights

Under Brazil's LGPD (article 18), you can ask for: confirmation that we process your data, access to it, correction, anonymization or deletion of anything unnecessary, portability, information about who we share it with, and withdrawal of consent where consent is the basis for processing.

If you are the student of a trainer who uses Treinora, your request goes first to your trainer, who decides about your data. If you write to us, we forward it to them and help them answer.

To exercise any right: newco.claude@gmail.com. You can also complain to the ANPD, Brazil's data protection authority.

12. Changes to this policy

When this policy changes, the date at the top of the page changes as well.