Privacy Policy

1.Who We Are

Datafolio is operated by datafolioOnline, a company registered in Kenya. When we say “Datafolio,” “we,” “us,” or “our” in this policy, we mean that entity.

We operate the Service at datafolio.online. Our team and the infrastructure supporting the Service may span multiple countries; see Section 8 on international data transfers.

2.Definitions

Capitalised terms used throughout this policy have the meanings given below.

“Service”

The Datafolio website, platform, and all associated features available at datafolio.online, including the portfolio builder, AI-assisted writing tools, resume generator, and any APIs.

“User”

Any individual who accesses or uses the Service, whether or not they hold a registered Account.

“Account”

A registered user account created on the Service by providing an email address and password.

“Portfolio”

A personal portfolio page created by a User within the Service, hosted at a unique URL chosen by the User.

“Content”

Any information, text, images, links, or other material a User submits, uploads, or publishes through the Service, including Portfolio Content and any AI-generated text produced at the User’s request.

“Personal Data”

Any information relating to an identified or identifiable natural person, as defined by applicable data protection law in the relevant jurisdiction.

“Third-Party Processor”

A company we engage to process Personal Data on our behalf (e.g., for hosting, payments, or email delivery), each bound by their own privacy terms.

3.Information We Collect

We collect only the information necessary to operate and improve the Service.

We do not intentionally collect sensitive categories of Personal Data (e.g., health data, political opinions, biometric data). Please do not include such information in your Portfolio Content.

4.How We Use Your Information

• ›Operating the Service. To create and maintain your Account, host your Portfolio, generate your resume PDF, and deliver AI-assisted writing features.
• ›Communications. To send transactional emails (e.g., password reset, payment confirmation) and, where you have consented, product updates. You can opt out of non-transactional communications at any time.
• ›Payment processing. To activate your subscription, verify payment status, and manage renewals or cancellations.
• ›Product improvement. To understand how the Service is used, diagnose bugs, and develop new features. We rely on aggregated or anonymised data where possible.
• ›Security and fraud prevention. To detect and prevent abuse, unauthorised access, or violations of our Terms of Service.
• ›Legal compliance. To comply with applicable laws, respond to lawful requests from authorities, and enforce our agreements.

5.Legal Basis for Processing

For Users in jurisdictions where a legal basis for processing Personal Data must be identified (including the EU, UK, and similar regions), we rely on the following:

• ›Contract performance. Processing necessary to provide the Service you have signed up for — creating your Account, hosting your Portfolio, and processing payments.
• ›Legitimate interests. Processing for fraud prevention, security, and product improvement, where those interests are not overridden by your rights.
• ›Consent. Where we send marketing communications, we rely on your consent and provide a clear opt-out in each message.
• ›Legal obligation. Where we are required to retain or disclose data by applicable law.

6.Public Nature of Portfolios

When you choose to publish a Portfolio, its content — including your name, bio, project descriptions, and contact links — becomes accessible to anyone on the internet without requiring a login. This is the core purpose of the Service.

Unpublished (draft) Portfolios are private: they are accessible only to you when logged in and are not indexed by search engines or exposed via our public API.

You control what you include in your Portfolio. Do not publish information you do not want publicly available. You can unpublish or delete a Portfolio at any time through the dashboard.

7.Data Sharing and Third Parties

We do not sell your Personal Data. We share data only with the following categories of recipients, each subject to their own privacy practices and, where required, a data processing agreement with us:

• ›Vercel — application hosting and edge delivery. Your data transits and is processed on Vercel’s infrastructure. Vercel Privacy Policy: vercel.com/legal/privacy-policy
• ›Neon — PostgreSQL database hosting. All structured account and portfolio data is stored in a Neon-managed database. Neon Privacy Policy: neon.tech/privacy-policy
• ›NowPayments — cryptocurrency payment processing (USDT, USDC). When you make a crypto payment, NowPayments processes the transaction and sends us a confirmation webhook. NowPayments Privacy Policy: nowpayments.io/privacy-policy
• ›Lemon Squeezy — card payment processing (where available). Card details are handled exclusively by Lemon Squeezy and never reach our servers. Lemon Squeezy Privacy Policy: lemonsqueezy.com/privacy
• ›Resend — transactional email delivery (password resets, account notifications). Your email address is transmitted to Resend to send these messages. Resend Privacy Policy: resend.com/legal/privacy-policy
• ›Anthropic — AI text generation. When you use AI features (case-study writer, LinkedIn blurbs, portfolio roast), the relevant project data is sent to Anthropic’s API to generate the response. Anthropic Privacy Policy: anthropic.com/privacy

We may also disclose Personal Data if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights or safety of any person.

8.International Data Transfers

Our team is distributed and our Third-Party Processors operate infrastructure in multiple countries, including the United States. If you access the Service from the European Economic Area, United Kingdom, or another jurisdiction with data transfer restrictions, your Personal Data may be transferred to and processed in countries that do not provide an equivalent level of data protection under your local law.

Where such transfers occur, we rely on the transfer mechanisms provided by applicable law (e.g., Standard Contractual Clauses for EU transfers). The specific safeguards in place For transfers from the EEA or UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms required by applicable law.

9.Data Retention

• ›Active accounts. We retain your Account Data and Portfolio Content for as long as your Account is active and as needed to provide the Service.
• ›Account deletion. When you delete your Account, your Account Data, Portfolio Content, and published Portfolio pages are removed from our active systems. Deletion is processed within 30 days. Backups containing your data may persist for up to 90 days before being purged.
• ›Payment records. We retain payment confirmation records (transaction IDs, amounts, dates) for 7 years to comply with applicable financial recordkeeping obligations.
• ›AI-generated content. Roast reports and AI-generated text saved to your projects are treated as Portfolio Content and deleted with your Account.

10.Your Rights

Depending on your location, you may have rights regarding your Personal Data, including:

• ›Access. Request a copy of the Personal Data we hold about you.
• ›Correction. Request correction of inaccurate or incomplete data. You can update most information directly in your account settings.
• ›Deletion. Request deletion of your Personal Data. You can delete your account from the dashboard, or contact us to request deletion of specific data.
• ›Data portability. Request an export of your Personal Data in a structured, machine-readable format.
• ›Objection and restriction. Object to certain processing (e.g., direct marketing) or request that we restrict processing in specific circumstances.
• ›Withdraw consent. Where we rely on consent as a legal basis, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@datafolio.online. We will respond within 30 days and may ask you to verify your identity before acting on your request.

If you are in the EU or UK and believe we have not handled your request correctly, you have the right to lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority).

11.Security

We implement technical and organisational measures to protect your Personal Data, including:

• ›Passwords stored as bcrypt hashes — your raw password is never stored or logged.
• ›Password reset tokens stored only as SHA-256 hashes and invalidated after single use.
• ›HTTPS encryption in transit via Vercel’s edge network.
• ›Database access restricted to application credentials with minimum necessary permissions.
• ›All dashboard and builder API routes require authenticated sessions scoped to the requesting user.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security vulnerability or breach, please contact us immediately at contact@datafolio.online.

12.Children's Privacy

The Service is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect Personal Data from children under 13. If you believe we have inadvertently collected such data, please contact us at contact@datafolio.online and we will delete it promptly.

13.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service itself. When we make material changes, we will:

• ›Update the “Last updated” date at the top of this page.
• ›Notify registered Users by email at least 30 days before the changes take effect, for material changes that affect your rights.

Continued use of the Service after the effective date of an updated policy constitutes your acceptance of the changes.

14.Contact

Questions, requests, or complaints regarding this Privacy Policy should be directed to: contact@datafolio.online. We aim to acknowledge all enquiries within 5 business days.