Privacy Policy

1. Introduction

Portfoliofy is a service operated by Universal Net Solutions FZ-LLC (“Portfoliofy,” “we,” “us,” or “our”) that lets you build and publish a personal portfolio website. This policy describes how we handle personal data when you use our websites, apps, and services (the “Service”). We are the controller of the data described here. Questions? Email support@portfoliofy.io.

2. How this policy applies to you

This policy applies whether you are a creator who builds a portfolio with us, or a visitorwho views a portfolio published on the Service. Where a creator publishes a portfolio that collects information from visitors, the creator is responsible for that information; see “Your portfolio’s data collection and your responsibility” below.

3. Information we collect

Information you provide directly:

• Account details. Your email address, and, if you sign in with Google, the basic profile Google shares (name, email, avatar).
• Portfolio content. The answers, text, images, links, and settings you add to build and publish your portfolio.
• Billing details. Your plan and subscription status. Card payments are handled by our payment processor, Stripe; we never see or store your full card number.
• Support messages. The contents of messages you send us through the contact form or by email.

4. Information collected automatically

When you use the Service, we automatically collect basic technical and usage data: IP address, browser and device type, referring pages, pages viewed, actions taken, and performance metrics. When someone views a published portfolio, we record aggregate view and event counts so creators can see how their portfolio is performing. We do not build advertising profiles of visitors.

5. Information from third parties

If you sign in with Google, we receive the basic profile details described above. Our payment processor tells us the status of your subscription and payments. We do not buy personal data about you from data brokers.

6. Why we collect your information

• to create your account and provide the Service;
• to generate, store, render, and publish your portfolio;
• to process payments and manage your subscription;
• to send service messages such as sign-in codes, billing notices, and important updates;
• to keep the Service secure, prevent abuse, and enforce our Terms;
• to measure and improve performance and reliability;
• to meet our legal obligations.

Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running and securing the Service, your consent where we ask for it, and compliance with legal obligations.

7. How we share your information

We do not sell your personal data. We share it with the service providers below only as needed to run the Service, and each processes data under its own terms and security commitments:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, and performance and usage analytics.
• Stripe — payment processing and subscription billing.
• Anthropic — AI generation of suggested copy.
• Resend — transactional and support email delivery.
• Upstash — rate limiting to protect the Service from abuse.
• Sentry — error monitoring, to detect and fix technical problems in the Service. Receives diagnostic error data, not your content.
• Google — optional sign-in, if you choose to connect a Google account.

We may also disclose data if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of our business, in which case we will let you know.

8. Your portfolio’s data collection and your responsibility

If you publish a portfolio that collects information from visitors, for example through a contact form, you are the controller of that information and you are responsible for handling it lawfully. That includes giving visitors any notices they are due, obtaining consent where it is required, and honoring their requests. We provide the tools; compliance for what you collect from your visitors is your responsibility. You agree to use visitor data only for the purpose the visitor provided it and not for spam or unlawful purposes.

The same applies to testimonial collection links. When you share a collection link, the people you invite submit their name, an optional role or company, a star rating, and a short testimonial. We store those submissions so you can review them, and anything you approve becomes part of your published portfolio. You are responsible for only inviting people whose words you have the right to publish, and for removing a testimonial if the person asks.

9. Cookies and tracking

We use cookies and similar technologies that are needed to sign you in, keep your session, and secure the Service, together with limited analytics to understand performance. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, though some features may not work without them.

10. Data retention

We keep your data for as long as your account is active. When you close your account, we delete or de-identify your personal data within a reasonable period, except where we need to keep certain records to meet legal, tax, or security obligations, or in limited backups that expire on a rolling basis.

11. Security

We use reasonable technical and organizational measures to protect your data, including encryption in transit and access controls. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security.

12. International transfers

We and our providers may process and store data in countries other than the one you live in, including the United States and Singapore. If you use the Service from outside those countries, you understand your data may be transferred to and processed there. Where required, we rely on appropriate safeguards, such as standard contractual clauses, to protect data that moves across borders.

13. Your rights (GDPR and CPRA)

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA and UK have these rights under the GDPR; residents of California have similar rights under the CPRA. You can update most of your data in the app, or email support@portfoliofy.io to make a request. We will not discriminate against you for exercising these rights, and we may need to verify your identity before we act. If you are in the EEA or UK, you may also complain to your local data protection authority.

14. Do not sell or share (CPRA)

We do not sell your personal data, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. Because we do not sell or share in this way, there is nothing to opt out of, but you can still contact us with any questions about your data.

15. Sensitive personal data

We do not ask for sensitive personal data (such as government IDs, health, or financial account numbers) to use the Service. Please do not include sensitive information in your portfolio content or support messages. Anything you choose to publish on your portfolio is public.

16. Global Privacy Control (GPC)

Some browsers let you send a Global Privacy Control signal. Because we do not sell or share personal data for advertising, there is no such activity for a GPC signal to stop. We will honor recognized signals to the extent the law requires.

17. Children’s privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

18. Data breach notification

If a data breach affects your personal data, we will notify you and the relevant authorities where the law requires, and within the timeframes it sets, and we will take reasonable steps to limit the impact.

19. Changes to this policy

We may update this policy from time to time. When we make a material change, we will update the date above and, where appropriate, let you know in the app or by email. Continuing to use the Service after a change takes effect means you accept the updated policy.

20. Contact

Questions about your privacy or this policy? Email support@portfoliofy.io.