How we look after your data

What we keep

• Registration form: name, email, WhatsApp number, date of birth, CPF (optional), nationality, level, goals, how often you surf, other training, board size, availability and notes, plus when you accepted the liability terms.
• Health: injuries or limitations you choose to tell us about (see below).
• Training: your plan, booked lessons and attendance, level, and the notes, ratings and progress videos your coaches record.
• Payments: amounts, dates, payment method and the status of each month. Card details stay with Stripe; we never see your full card number.
• Portal login: your email and when you logged in.
• Messages you send us on WhatsApp or Instagram.

Health data

Information about injuries is sensitive data under the LGPD (and the GDPR). We only keep what you write on the form, and only with your specific consent (the box you tick on the form). We use it only to train you safely. Who sees it: Marina, the admin team and the coach of your lesson. You can withdraw this consent at any time, and we then delete the information.

What we use it for (and the legal basis)

• Organising your training, groups, plan and payments: performing our agreement with you.
• Keeping payment records for as long as tax law requires: legal obligation.
• Keeping you safe in the water based on your injuries: your consent.
• Protecting the site and portal from abuse (for example automated form submissions) and counting visits anonymously: legitimate interest.

We don't sell your data, we don't use it for advertising and we don't send newsletters unless you ask.

Who sees your data

• Marina and the Surf Like a Girl admin team: all of it, to run training and payments.
• Coaches: name, level and health notes of the students in the lessons they teach.
• You: in the portal, only your own data. The system stops one student from seeing another's.

Services we use

To run all this we use a few providers that process data on our behalf, and only for that:

• Supabase: database and portal login.
• Vercel: website hosting and anonymous visit statistics.
• Stripe: online card and Pix payments.
• Resend: sending the portal login emails.
• WhatsApp (Meta) and Instagram: conversations you start with us.
• Google Drive: video analysis, when shared with you.

Data outside Brazil

Some of these providers store data on servers outside Brazil (for example in the United States or Europe). We choose companies that commit by contract to protecting it, as the LGPD and, for students in Portugal, the GDPR require.

Cookies

Only what's needed: one cookie that remembers the language you picked and, in the portal, the cookies that keep you logged in. No advertising cookies.

To see how many people visit the site and whether pages load quickly, we use Vercel's statistics (Web Analytics and Speed Insights). They use no cookies, don't identify you and only show totals, such as visits per page and the country they come from.

How long we keep it

• Registration forms that don't become an enrolment: deleted once no longer needed, at most after 12 months.
• Student data: while you train with us and up to 2 years after your last lesson, so it's easy if you come back. Sooner if you ask.
• Payment records: as long as tax law requires (usually 5 years).

Under 18s

If the student is under 18, the form must be filled in or approved by a parent or legal guardian, who can also use the rights below on her behalf.

Your rights

Under the LGPD (art. 18) and, for students in Portugal, the GDPR, you can at any time and free of charge:

• ask whether we hold data about you and get a copy;
• correct incomplete or wrong data;
• have data deleted or anonymised (except what the law requires us to keep);
• receive your data to take to another service;
• know who we share it with;
• withdraw consent you gave.

Security

The site uses an encrypted connection (HTTPS), access to data is limited by role, and portal login works with a link or code sent to your email, so there's no password to steal. If an incident ever puts your data at risk, we will tell you and the authorities.

Complaints

If you feel we didn't handle a request well, you can complain to Brazil's data protection authority (ANPD, gov.br/anpd). Students in Portugal can also go to the CNPD (cnpd.pt).