MOVZA Privacy Policy

Text updated: October 30, 2026

MOVZA values privacy, transparency and the protection of personal data. This Policy explains how we process information in the MOVZA app and related services, including support, communications and features available through the official website.

This document describes the categories of data, the purposes of processing, the recipients, the retention criteria and the ways to exercise your rights. It should be read together with the Terms of Use and the notices presented within specific features.

Making this Policy available or reading it does not replace the specific authorizations required for certain types of data processing.

1. About MOVZA and the data controller

MOVZA is a movement, physical activity and well-being platform that uses technology, including artificial intelligence, to provide personalized experiences, content, guidance and workouts.

MOVZA is the public-facing name of the service, currently operated by Bruno Leon Milinov, an individual responsible for decisions regarding the processing of the personal data described in this Policy. Privacy requests are handled through the email address below or the official WhatsApp channel listed in Section 18.

Official website: https://movza.com.br

Privacy and data subject support channel: [email protected]

The app's pages on the Apple App Store and Google Play are app distribution channels. Requests concerning personal data should be sent to MOVZA through the privacy channels listed in this Policy.

2. Information we process

The information varies according to the data provided and the features used. You do not need to provide every category below to use each feature.

2.1. Registration and account

We process registration and account management data, such as your name, email address, telephone number, profile photo, authentication information, records of acceptance of the terms, preferences and settings.

When you sign in through an external authentication service, we receive the information made available by that service and needed to authenticate you, according to the method selected.

2.2. Profile, physical activity and well-being

We may process age or age range, height, weight, goals, sports and activities practiced, experience, availability for workouts, equipment, preferences, generated or saved workouts, completed sessions, performance and progress.

Information voluntarily provided about limitations, injuries or health conditions may form part of the context used for personalization. Data revealing health information is subject to specific treatment as sensitive personal data, in accordance with applicable law.

2.3. Conversations, memories, support and feedback

We process messages, requests, responses, transcriptions, preferences and information recorded in conversation and memory features. This content may be linked to your profile and history to provide continuity and personalize responses and workouts.

We also process support messages and feedback submitted by you. When you contact us through the official WhatsApp channel, we receive your telephone number and the messages and files you choose to send, so that we can provide support and handle your request. Avoid including unnecessary personal information or other people's data without a need and a valid basis for sharing it.

2.4. Photographs, recordings and environments

You may submit photographs, images and voice recordings to use specific features. In the Environments feature ("Ambientes"), photographs are analyzed to identify equipment and resources available for workouts.

Images in Environments are stored in a private area with access rules linked to your account. They remain associated with the environment and are removed from active storage when you delete that environment or your account, subject to the retention and deletion information in this Policy.

Image, voice and text content may be sent to the providers identified in Section 6 to perform the requested analysis, transcription or audio generation. A photograph or recording may contain personal information beyond the equipment or request itself; we recommend avoiding identifiable people, documents and other unnecessary elements.

2.5. Technical and usage data

We may process IP addresses, device and operating system characteristics, app version, technical session identifiers, access logs, features used, interactions, and error or performance logs.

This data is used to operate, diagnose, secure and technically improve the services. Usage events are also processed for campaign measurement, such as registration, completion of the initial account setup (onboarding) and workout completion. The sharing of these events with Meta and the tracking of electronic communications are described in Section 14.

2.6. Location for weather information

With permission granted on your device, MOVZA accesses location coordinates, such as latitude and longitude, to retrieve and display weather information on the Home and coach screens.

The coordinates may represent an approximate or precise location, depending on the permissions and settings used. The request is sent to the Open-Meteo weather service.

MOVZA does not keep these coordinates in its database as a location history. This does not mean that the weather service provider does not process the data or keep technical logs, as explained in Section 9.

You may deny or revoke permission in your device settings. In that case, features that depend on this location may be unavailable or have limited functionality.

3. Integrations with external devices and platforms

The version of the app to which this Policy relates does not offer connections to personal accounts on external health or physical activity platforms, or the import of wearable device data through such integrations.

If these features are offered, MOVZA will provide advance information about the services involved, the data accessed, the purposes, the storage conditions, and the means of disconnecting and deleting data. Necessary authorizations will be requested before activation, and this Policy will be updated when required.

This provision does not constitute advance authorization or indicate that these integrations are already available. It is distinct from the current use of the technology providers described in Section 6.

4. How we use information

Providing the service. To create and authenticate accounts, manage profiles, fulfill requests, generate and adapt workouts, maintain histories and memories, record activities and display your progress.

Personalization. To take account of goals, preferences, availability, history, reported limitations, equipment and environment characteristics in the responses and experiences requested.

Content processing. To interpret messages, analyze photographs, transcribe voice recordings, produce audio responses and retrieve weather information related to the authorized location.

Support and communications. To answer questions, handle personal data requests, send service-related messages and engage in user relationship communications, subject to the conditions in Section 14.

Operations and security. To correct errors, assess performance, improve features, prevent fraud or abuse and protect the services. Technical improvements to the platform should not be confused with AI model training, which is addressed in Section 5.

Campaign measurement. To evaluate the results of MOVZA's promotional activities and the relationship between campaigns, registration and app usage, through the events described in Section 14. Measurement does not constitute authorization to use conversation content or health information in advertising.

Obligations and rights. To comply with legal or regulatory obligations and exercise or defend rights in specific circumstances, using only the necessary data.

5. Artificial intelligence and automated processing

5.1. Operation and sharing

MOVZA uses language models, image analysis and voice technologies to interpret requests, generate responses, create or adapt workouts, identify equipment and enable audio interaction.

These features may require content to be sent to third parties. Depending on the feature used, this may include excerpts from conversations, memories and profile information relevant to the request, photographs from Environments, voice recordings or text to be converted into audio. The providers and their roles are identified in Section 6.

The transfer of personal data to AI services must be preceded by clear information about the sharing and the authorization required for that processing. You may refuse or withdraw consent through the privacy channel. Refusal may prevent the use of features that depend on that processing and does not constitute authorization for additional processing.

5.2. Model training and retention

MOVZA does not use users' personal data to train its own artificial intelligence models.

The processing required to produce a response, the retention of technical logs and the use of content to train models are distinct activities. The fact that MOVZA does not train its own models does not, on its own, mean that all external providers apply the same condition.

In the OpenAI API, customer data is not used for training by default; voluntary sharing for that purpose depends on specific settings selected by the API customer.

The processing conditions for Google Gemini and ElevenLabs depend on the service contracted and the applicable settings. These providers distinguish processing needed to provide the service from potential uses for product improvement or model training. Accordingly, the statement that MOVZA does not train its own models should not be interpreted as a general guarantee that no provider uses data for training. The conditions published by providers can be consulted in their official documents; MOVZA remains responsible for explaining the processing actually carried out in its operations.

This Policy does not constitute blanket consent for personal data to be used to train models for purposes other than the features requested. Any additional processing requires a stated purpose, an appropriate legal basis and respect for the data subject's choices.

Providers may retain processing records for service operation, security, abuse prevention or legal obligations, depending on the service and its settings. MOVZA does not operate under a general guarantee of zero data retention across all providers.

5.3. Limitations and automated decisions

Automated responses may contain errors, omissions or suggestions that are inappropriate for the context. You may correct information you have provided and request clarification through the support channels.

Where a decision affecting your interests is based solely on automated processing of personal data, you may request information and a review under applicable law. Limitations relating to health and physical activity are described in Section 16.

6. Sharing and service providers

MOVZA does not sell personal data.

To provide the features described, we use the following services and technologies, depending on the feature:

The content transmitted depends on the feature used. The use of these providers does not mean that all of them receive all account data. When Meta App Events is used, Meta receives the measurement events described in this Policy; this does not authorize unrestricted access to the profile, conversations, photographs or complete workout history.

Information on how AI services process data is also available in OpenAI's privacy and data usage documentation, the Gemini API terms and ElevenLabs' information on data use. These documents do not replace MOVZA's responsibilities or the obligation to uphold your rights.

MOVZA is responsible for processing carried out within its services and for its selection and use of providers, in accordance with its legal responsibilities. Contractual conditions and any independent purposes applicable to a provider do not override data subjects' rights or authorize uses that are incompatible with the law.

Data may also be shared in response to a user request, a legal obligation, a valid order from a competent authority or a specific need to exercise rights.

If the operation of MOVZA is transferred to another controller, processing must remain limited to legitimate and compatible purposes, with users being informed and legal safeguards being observed. An investment or reorganization does not constitute unrestricted authorization to share the user database.

7. Legal bases for processing

MOVZA observes Brazilian Law No. 13,709/2018, the General Personal Data Protection Law (LGPD). The legal basis is determined according to the purpose and nature of the data, not by blanket acceptance of this Policy.

Performance of the contract and requested procedures: for registration, authentication, account maintenance and the provision of features, to the extent that they involve non-sensitive personal data necessary for the service.

Consent: for processing that depends on a specific choice, including sharing that requires authorization and the use of health data for personalization, where this is the applicable legal basis. Consent for sensitive data must be specific, prominently presented and linked to defined purposes.

Legitimate interest: for proportionate and necessary operations, such as certain security controls and technical diagnostics involving non-sensitive data, after considering the data subject's rights, expectations and the impacts on them. This basis is not used to justify the processing of sensitive personal data.

Legal or regulatory obligations and the regular exercise of rights: to meet applicable requirements and address specific circumstances involving the defense of rights, including observing the specific grounds under the LGPD when sensitive data is involved.

Promotional communications, interaction tracking and advertising measurement must observe the relevant legal basis, required authorizations and the user's choices. Operating system permissions do not replace other legal requirements and do not authorize the use of sensitive data for advertising. Processing based on consent may be stopped by withdrawing that consent, subject to lawful retention exceptions.

8. International data transfers

The infrastructure, AI, voice, communications, weather information and measurement services used by MOVZA may involve processing or storage outside Brazil. Transfers relate to the purposes and data categories described in this Policy.

The location of processing depends on the provider, the hosting region and the service settings. The location of a company's headquarters does not, on its own, determine where data is processed. Information about destinations, recipients and applicable safeguards may be requested through the privacy channel.

Transfers must comply with mechanisms provided for in the LGPD and the regulations of the Brazilian data protection authority, such as contractual clauses valid for this purpose or another mechanism that actually applies.

You may request clarification about recipients, safeguards and documents that can be made available through the privacy channel. Sharing with providers abroad does not override the rights set out in this Policy.

9. Information retention

9.1. Account, content and location

Registration information, profile data, preferences, memories, conversations and activities are retained while necessary for the account and the features used, until they are deleted or no longer needed, subject to legal exceptions.

Photographs from Environments remain in active storage while the corresponding environment exists. Deleting the environment or the account removes these files from MOVZA's active storage.

The coordinates used for weather queries do not form a location history in MOVZA's database. However, Open-Meteo states that technical request logs are retained for up to 90 days; depending on the service, these logs may contain coordinates, request URLs and technical access information.

9.2. Backups, technical logs and providers

Backups may temporarily retain information deleted from active systems until the relevant backup cycle is renewed or deleted. Retention periods depend on the plan and settings actually used; there is no single period that applies to all systems.

Operational and security logs are retained for as long as necessary for their purpose and in accordance with applicable obligations. If a backup is restored, deletion requests already made must be respected when processing the restored information.

AI providers may retain processing records and data needed for certain features to function. In the OpenAI API, for example, abuse monitoring logs have a default retention period of up to 30 days, subject to applicable exceptions; this is not a universal maximum period for all features or files processed by the provider.

MOVZA will handle deletion requests and forward them to providers when necessary and legally applicable. Zero retention or immediate deletion of all external records should not be assumed.

9.3. Feedback, support and obligations

Feedback linked to a user is deleted from active systems together with the account. There is no general exception allowing this feedback to be retained simply because its account identifiers have been removed.

Records strictly necessary to handle a privacy request, demonstrate an action taken or comply with a legal obligation may be retained with restricted access for a justifiable period. This does not authorize keeping the account's conversation history or feedback for routine use after deletion. Data with no valid retention purpose or legal basis will be deleted or effectively anonymized, where appropriate.

Events already transmitted to communications or measurement providers are not necessarily removed by the same command that deletes MOVZA's active databases. Requests concerning these records will be handled in accordance with applicable rights, including forwarding them to the recipient when necessary.

10. Information security

We adopt technical and administrative measures intended to reduce the risks of unauthorized access, misuse, loss, alteration or disclosure of information. Measures described for the operation include account access controls and private access rules for images in Environments.

Access by authorized individuals and systems must be limited to what is necessary for operations, support, security or handling requests. No system can guarantee absolute security.

If a personal data security incident occurs, MOVZA will assess its impacts, take appropriate measures and provide the required notifications to data subjects and the competent authority, in accordance with applicable legal requirements.

11. Account and data deletion

You may request deletion directly in the app, in the "Perfil" (Profile) area, using the "Excluir sua conta" (Delete your account) option. You may also send the request through the privacy channel, particularly if you cannot access the app.

Once the deletion process is complete, the data and content linked to the account are removed from active systems: registration information, profile, preferences, memories, conversations with the AI coach, generated and saved workouts, sessions, history, performance, environments, personalized coaches, feedback and associated files, including photographs and voice recordings. Removal covers both the main database and file storage, as well as the conversation history held in MongoDB. The login is deleted at the end of the process.

The app displays the progress of the request and shows a message if a failure occurs. A failure during the process should not be interpreted as confirmation that deletion has been completed; in that situation, you may use the privacy channel to obtain support.

Justifiable residual retention involving backups, security logs, legal obligations and external services is addressed in Section 9. These exceptions do not authorize keeping the account active or reusing its content for incompatible purposes.

Account deletion does not mean the automatic removal of all records that a provider is legally required to retain. Any retention must have a justifiable purpose, legal basis and duration.

12. Your rights and how to exercise them

You may request confirmation of processing and access to your data; correction of information; anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data; and portability, subject to applicable rules.

You may also request information about the entities with which data has been shared, the possibility of refusing consent and the consequences of doing so; withdraw consent; request deletion of data processed on that basis; and object in the cases provided for by law.

Where applicable, you may request a review of decisions based solely on automated processing that affect your interests, as well as information about the criteria and procedures used, subject to legal limits.

Requests are free of charge and may be sent by email to [email protected] or through the official WhatsApp channel listed in Section 18. We may request proportionate information to verify your identity and prevent improper disclosure of data, without requesting excessive information.

Requests will be handled within the legally required timeframes and conditions. If a request cannot be fulfilled in full, we will explain the reasons and the appropriate measures. You may also submit a petition to the Brazilian data protection authority and contact other competent bodies.

13. User permissions and choices

Location, camera, microphone and tracking permissions, where applicable, can be managed in your device settings, according to the features used. The choice to send an image or recording must be considered separately from authorization for its processing by third parties.

Consent for specific processing may be withdrawn through the privacy channel. Withdrawal may prevent the continued use of a feature that depends on that data, but does not constitute a waiver of rights.

Revoking a permission prevents new access covered by it, but does not automatically delete data already sent. To delete content or your account, use the app's tools or the support channel.

14. Communications and campaign measurement

14.1. Emails and interaction tracking

MOVZA sends messages about accounts, security, support, features and the user relationship. User relationship emails are sent through Resend.

These communications may use delivery, open and click tracking technologies. Events and dates associated with the message and recipient are recorded to evaluate the receipt of and interaction with communications and improve their relevance.

Tracking may use small tracking images and links that record a click before redirecting to the destination. These events do not mean access to your inbox or the content of your other emails.

You may request that promotional communications stop and submit requests concerning interaction measurement through the privacy channel or the unsubscribe mechanisms provided in the communication. Messages strictly necessary for your account, security or support may continue for as long as they remain relevant to your relationship with the service.

14.2. Meta App Events and advertising measurement

MOVZA uses Meta App Events to measure campaign results and understand the relationship between app promotion and actions taken by users. Measurement includes registration, completion of the initial account setup (onboarding) and workout completion events.

These events are shared with Meta for campaign analysis and optimization. Processing may involve technical information about the app and device, and identifiers allowed by the system and applicable settings. The device's advertising identifier is not accessed without the required authorization.

Not accessing the advertising identifier does not, on its own, mean that every event is anonymous or that no data is shared. On systems requiring authorization for tracking across apps and services of different companies, such tracking depends on the corresponding permission.

Measurement must remain limited to the stated purpose and permitted data. This Policy does not authorize sending conversations, photographs, audio, diagnoses, injuries, limitations or other health information for advertising targeting. The choice of events and their parameters must itself respect the restrictions applicable to health and physical activity data.

You may manage the permissions available on your device and request information or exercise your rights through the privacy channel. Refusing advertising tracking does not, on its own, result in account deletion or loss of the app's core features.

15. Audience and protection of children and adolescents

MOVZA is not specifically directed at children. This Policy describes data processing and does not, in itself, authorize children or adolescents to use features that are subject to age restrictions. The content rating displayed in app stores does not replace the service's access conditions or the restrictions of its technology providers.

The processing of children's and adolescents' data must respect their best interests and the protective measures required by law. Authorization from a parent or guardian does not override contractual restrictions of a technology service that prohibits such processing.

If the data of minors is found to have been processed contrary to applicable conditions, MOVZA will assess the measures needed to stop processing, restrict features, contact parents or guardians where appropriate and delete information, subject to legal obligations.

Parents or guardians may use the privacy channel to report situations or exercise rights concerning the data of children and adolescents.

16. Health, physical activity and service limitations

MOVZA offers features focused on movement, physical activity and well-being. Its content, workouts and responses, including those generated by AI, do not replace assessment, diagnosis, treatment or care by qualified professionals.

Consider your physical condition, limitations and any professional guidance you receive before engaging in an activity. The conditions of use and other limitations of the service are addressed in the Terms of Use. This Policy addresses data protection and does not entail a waiver of users' rights.

17. Updates to this Policy

This Policy may be updated to reflect actual changes to features, providers, processing practices or legislation. The date of the latest update will be available on the official website.

Significant changes will be communicated through appropriate means. Where a change requires new authorization, it will be requested before the corresponding processing takes place. Continued use of the app does not replace specific consent required by law or by the conditions applicable to the service.

18. Contact

For questions, requests or complaints concerning personal data, please use:

MOVZA — Privacy and Data Subject Support Channel

Email: [email protected]

Official WhatsApp: +55 (11) 99426-6496

Website: https://movza.com.br

You may use email and WhatsApp even if you cannot access your account in the app, including to request information about the data controller. For your security, do not send passwords, access codes or health information that is unnecessary for handling your request.