Legal · LGPD

PRIVACY POLICY

Last updated: 2026-06-12 · DRAFT — pending legal review

1. Data we collect

  • Account: e-mail address, password (stored as an Argon2id hash — we never see or store the plain text) and optional country.
  • Athlete profile: full name, sport, gender, optional birth date, weight category, belt rank, biography and country.
  • Profile photo (optional): the image you upload is re-encoded to a small square picture before storage, and any embedded metadata — including camera details and GPS location (EXIF) — is removed automatically. The original file is never stored.
  • Fight records: opponent name, event, date, result, method and the evidence links you submit.
  • Technical: IP address and browser identifier of active sessions, used exclusively for account security (session revocation and abuse prevention).

2. What we use it for

  • Operating the ranking: approved fights feed the official monthly rankings with your athlete name, division and points.
  • Account security: login, session refresh and lockout protection.
  • Billing: subscription payments are processed by Stripe (international) or AbacatePay (Brazil). Card and PIX data go directly to those processors — WECL never receives them.
  • Transactional e-mail: address verification, password reset and subscription renewal reminders, sent through Resend.
  • Photo storage: profile photos are stored with Cloudflare (R2 object storage), acting as a data processor on our behalf.

3. What we never do

  • We do not sell or rent personal data.
  • We do not use your data for third-party advertising.
  • We do not send marketing e-mail without separate consent.

4. Public information

  • Rankings are public by design: your athlete name, country, sport, division, record and points appear on public pages and in monthly snapshots while your profile is active.
  • Your profile photo, when you choose to upload one, is also shown on your public athlete page. You can replace or remove it at any time in the athlete portal.

5. Your rights (LGPD)

  • Access, correction: edit your profile at any time in the athlete portal.
  • Deletion: the "Delete account" action in the portal anonymizes your account immediately — e-mail and password are scrambled, the subscription is canceled, profiles leave all public listings, profile photos are permanently deleted from storage and the name on historical ranking entries becomes "Removed athlete". Anonymized data is no longer personal data under the LGPD.
  • Portability and other requests: contact us at the address below.

6. Retention

  • Active accounts: data is kept while the account exists.
  • After deletion: only anonymized competition records remain (ranking integrity); payment records are retained as required by tax law, by the payment processors.

7. Contact

  • Data controller: WECL — World Extreme Combat League. Requests: privacy@wecl.com.