Privacy Notice

Foliopin (“we”) helps you build a portfolio website. This notice explains, in plain words, what personal data we handle, why, how long we keep it, who helps us, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act). For your account data, we are the Data Fiduciary.

[LEGAL REVIEW: legal entity name, registered address and, if applicable, whether Foliopin is a Significant Data Fiduciary.]

1. What we collect

When you create an account

• Your name and email address.
• Your password, stored only in scrambled (hashed) form by our login provider. We never see it.
• The consents you give or withdraw, with the date and the version of this notice.

What you add to your portfolio

• Profile photo, headline, About text, location, languages and highlight numbers.
• Projects, photos, videos links, experience, education, certificates, services, prices and shop items.
• Contact details you choose to show: phone, WhatsApp, email and social links.
• A CV file, if you upload one. It may contain more personal details; only add what you want to share.
• Details of other people you add, such as client names or testimonials. Please add these only with their permission (see our Terms).

Automatically

• Technical logs kept by our hosting and database providers (for example IP address, browser type and time of a request), used to keep the service secure and working.
• Small files on your device: a sign-in cookie that keeps you logged in (essential), and settings saved in your browser such as hidden tips or your choice about videos. We do not use advertising or analytics trackers.

Payments

• If you buy Premium, we keep a record of the pass (date, amount and validity). Card or UPI details are handled by the payment provider and never reach us. [LEGAL REVIEW: update when the payment provider is connected.]

2. Why we use it

• To create and run your account and portfolio (with your consent): saving your content, showing the editor preview, storing your photos (up to 5 MB free, 30 MB Premium) and sending account emails such as sign-in links and password resets.
• To publish your portfolio (with your consent, given when you press Publish): anything on your published portfolio, including contact details you added, is visible to anyone with the link and may be found by search engines. You can unpublish at any time.
• To keep the service safe: preventing abuse, fixing errors and meeting legal obligations.
• Product emails: only if you ticked the optional box, and you can stop them any time.

We do not sell your personal data, and we do not use it for advertising.

3. Who helps us (processors)

We use these service providers to run Foliopin. They process data only on our instructions.

• Supabase: database and sign-in. [LEGAL REVIEW: confirm data region.]
• Cloudflare R2: storage for photos and CV files.
• Vercel: hosting of the website and portfolios.
• Email delivery: sign-in and account emails. [LEGAL REVIEW: name the email provider once set up.]
• YouTube and Loom: only when a portfolio owner adds a video and a visitor allows videos or presses play. These services then receive the visitor's IP address and may store cookies, under their own privacy policies.

Some of these providers may store data outside India. [LEGAL REVIEW: confirm locations and any restrictions notified by the Government under the DPDP Act.]

4. How long we keep it

• Your account and portfolio: while your account is active.
• Every account runs for a year at a time and is renewed for free (or with Premium). If it isn't renewed, the portfolio goes offline after a 15-day grace period (30 days for Premium) and the account is then reviewed and deleted. [LEGAL REVIEW: commit to a maximum time, for example within 90 days of going offline.]
• “Start over” deletes your portfolio content and photos straight away. “Delete my account” deletes your account, content, photos and consent records straight away.
• Backups held by our database provider may keep copies for a short time after deletion. [LEGAL REVIEW: confirm the backup period.]
• Payment records may be kept longer where tax law requires it. [LEGAL REVIEW: period, e.g. 8 years.]

5. Your rights

• Access: download a copy of your data any time from Your data & rights, or ask us for a summary of what we process and who we share it with.
• Correction: edit most of your data yourself in the dashboard, or ask us to correct anything you can't.
• Erasure: delete your content (Start over) or your whole account yourself, or ask us.
• Withdraw consent: stop product emails, unpublish your portfolio, or delete your account. This doesn't affect what we did before you withdrew.
• Nominate: name someone who can use these rights for you if you die or can't act.
• Complain: contact our Grievance Officer (below). If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

Use the form at Your data & rights (sign-in needed) or email us. We may ask you to confirm your identity first.

6. Grievance Officer

Grievance Officer, Foliopin
Email: privacy@foliopin.com
Address: [Registered postal address to be added]

We aim to acknowledge every complaint within 7 days and resolve it within 90 days. [LEGAL REVIEW: confirm officer and timelines.]

7. Children

Foliopin is for people aged 18 or older. We ask you to confirm your age when you sign up. If you believe a child has created an account, please contact us and we will delete it.

8. Security and data breaches

We use encrypted connections (HTTPS), access controls on every database table, and providers with strong security. If a personal data breach happens, we will inform affected people and the Data Protection Board of India as the DPDP Act and Rules require.

9. Changes

If we change this notice in a way that affects you, we'll tell you in the dashboard and, where needed, ask for your consent again.