Privacy Policy

Last updated: October 19, 2026

Zafit is an app for training and nutrition with an AI coach. This policy explains what we collect, why, who helps us process it, and the choices you have. It follows Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

1. Who we are

Zafit is operated by KACTUZ LAB TECNOLOGIA LTDA, CNPJ 52.069.351/0001-52 ("Kactuz Lab", "we"), the controller of the personal data described here.

Data protection officer (encarregado): Gustavo Henrique, [email protected]. You can also write to [email protected].

2. What we collect

• Account: name, email address and a user ID, from Sign in with Apple, Google or email.
• Profile and goals: date of birth, sex, height, weight and weight history, goal, target weight, activity level, sports and training schedule, equipment and food preferences.
• Health information: health conditions, medications you choose to tell us about (for example GLP-1 medicines, dose and start date), allergies, supplements and notes. This is sensitive personal data under the LGPD.
• Activity you log: meals, food quantities, water, workouts and sessions.
• Photos: meal photos you take or pick, so the coach can estimate what is on the plate.
• Conversations: the messages you exchange with the coach, and, if "Zaf memory" is on, the preferences it remembers between conversations.
• Voice: when you dictate a message, iOS turns your speech into text. Depending on your device, Apple may process the audio on its servers. We receive only the text.

We do not collect your location, contacts or advertising identifiers, and we do not read data from the Apple Health app.

3. Why we use it

• To create your account and keep it signed in on your devices.
• To build and adjust your workout plan, calorie and macro targets, and meal plan.
• To let the AI coach answer you with your context (profile, health, logs and conversation).
• To send the reminders you turn on.
• To keep the service secure, fix problems and answer your requests.

Legal bases: performance of the contract with you (LGPD art. 7, V) for account and plan data; your specific consent (art. 11, I) for health information, which you can withdraw at any time; and legitimate interest (art. 7, IX) for security and fixing problems.

4. Who processes it for us

We do not sell your data and we do not share it for advertising. We do not track you across other companies' apps or websites. We use these providers only to run Zafit:

• Supabase: sign-in, database and photo storage.
• Cloudflare: hosting of the service that connects the app to the AI coach.
• Anthropic (Claude): the AI model that writes the coach's replies and reads meal photos. Anthropic does not use this data to train its models.
• Apple and Google: sign-in, if you choose them, and speech recognition on iOS.

Some of these providers keep data outside Brazil, including in the United States. These transfers follow the LGPD (art. 33) through contractual safeguards with each provider.

5. How long we keep it

We keep your data while your account exists. When you delete a conversation, it leaves the app. When you delete your account, we delete your data from our servers, except for anything the law requires us to keep, and only for as long as that obligation lasts.

6. Your choices and rights

In the app, under Settings, you can:

• edit your profile, goals and health information;
• turn the coach's memory off;
• export a summary of your data;
• delete all conversations;
• delete your account and your data.

Under the LGPD you can also ask us to confirm the processing, access, correct, anonymize or delete data, move it to another provider, learn who we share it with, and withdraw consent. Write to [email protected]. You can also complain to Brazil's data protection authority (ANPD).

7. Security

Data travels encrypted (HTTPS). Access to the database is restricted by account. No system is completely secure, so if an incident could put you at risk, we will tell you and the ANPD.

8. Age

Zafit is for people 18 and older. We do not knowingly collect data from minors.

9. Changes

If we change this policy in a meaningful way, we will tell you in the app before the change takes effect. The date at the top shows the latest version.