Privacy Policy
1. Who we are
This website and the SocialFolio service are operated by [OPERATOR LEGAL NAME], [REGISTERED ADDRESS], [COMPANY REGISTRATION NUMBER / TAX ID] (“we”, “us”). We are the controller of the personal data described in this policy, except where stated otherwise. Contact: [PRIVACY CONTACT EMAIL]. [DATA PROTECTION OFFICER / EU OR UK REPRESENTATIVE, IF REQUIRED]
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: email address, name, username | Create and secure your account, sign you in, contact you about the service | Contract (Art. 6(1)(b)) |
| Google sign-in identifier and email (if you use Google) | Let you sign in with Google | Contract |
| Portfolio and profile content: title, bio, photo, services, social links, campaigns, results and media you upload | Provide the portfolio and campaign planning features; publish only what you choose to make public | Contract |
| Security data: session records, a keyed hash of your IP address, browser user-agent, audit log of security events | Keep accounts secure, prevent abuse, rate-limit sign-in and forms | Legitimate interests (Art. 6(1)(f)) in security |
| Subscription and billing records (plan, status, invoice references) | Provide paid plans, accounting and tax obligations | Contract; legal obligation (Art. 6(1)(c)) |
| Messages sent through contact forms (name, email, message) | Deliver the message to the portfolio owner or to us, and reply | Legitimate interests / steps prior to a contract |
| Portfolio statistics (views, clicks), stored with a daily-rotating keyed visitor hash and referrer domain — no cookies, no raw IP | Show portfolio owners aggregate statistics | Legitimate interests |
| Cookie consent choices (categories, policy version, time, keyed IP hash) | Record and respect your choices | Legal obligation |
| Newsletter email (only after you confirm by email) | Send occasional tips | Consent (Art. 6(1)(a)) — withdraw any time |
We do not sell personal data. We do not use your content to train AI models. We do not receive or store payment card details.
3. Public portfolios
Your portfolio is private until you publish it. When published, only the fields and projects you select are shown publicly (for example name, title, bio, photo, selected projects and results). Email addresses, budgets, internal notes, audience notes and private campaigns are never shown. You can unpublish at any time. Search engines may keep cached copies for a while after you unpublish; “unlisted” portfolios ask search engines not to index them.
4. Service providers (processors and independent controllers)
| Provider | Role / purpose | Location |
|---|---|---|
| [HOSTING PROVIDER] | Web hosting and database | [COUNTRY] |
| [EMAIL / SMTP PROVIDER] | Sending sign-in links and service emails | [COUNTRY] |
| Paddle.com Market Ltd (and affiliates) | Merchant of Record for paid plans: checkout, payment processing, invoicing, tax. Paddle processes payment data as an independent controller under its own privacy notice. | [CONFIRM] |
| Google LLC / Google Ireland Ltd | “Sign in with Google” (only if you choose it) | [CONFIRM] |
| [OPTIONAL ANALYTICS PROVIDER — ONLY IF CONFIGURED AND CONSENTED] | Website analytics, loaded only after consent | [COUNTRY] |
Where data is transferred outside the EEA/UK we rely on [ADEQUACY DECISIONS / STANDARD CONTRACTUAL CLAUSES — CONFIRM PER PROVIDER].
5. How long we keep data
- Account and portfolio data: while your account exists. When you delete your account it is scheduled for permanent deletion after 7 days (you can cancel during that time), then removed including uploaded files.
- Sign-in links: expire after 15 minutes; records are deleted after 24 hours.
- Portfolio statistics: 395 days.
- Contact messages: 730 days, or until the recipient deletes them.
- Billing records: kept for [STATUTORY ACCOUNTING PERIOD, e.g. 10 YEARS] as required by law, detached from your account after deletion.
- Security audit logs: [RETENTION PERIOD].
6. Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent. You can export your data and delete your account yourself in Settings → Privacy. You can also contact us at [PRIVACY CONTACT EMAIL]. You have the right to complain to a supervisory authority, for example [LEAD SUPERVISORY AUTHORITY].
7. Cookies
See our Cookie Policy. Optional cookies and trackers are only used after you consent.
8. Security
We use HTTPS, hashed single-use sign-in tokens, secure session cookies, access controls and audit logging. If a personal data breach occurs we will notify the competent authority and affected users where required by law, within the legal deadlines ([INCIDENT RESPONSE CONTACT / PROCEDURE]).
9. Children
SocialFolio is intended for professionals and is not directed at children under [MINIMUM AGE, e.g. 16].
10. Changes
We will post changes here and update the version above. Material changes will be notified by email or in the app, and you will be asked again for cookie consent where relevant.