Privacy Policy

1. Information we collect

Information you give us

• Account details: your email address and password. Passwords are handled by Google Firebase Authentication and stored only in hashed form; we never see them. If you sign in with Google, we receive your name, email address and profile photo from Google.
• Resume and portfolio content: the resume you upload or paste and everything you add in the editor, such as your name, job title, contact details, work history, education, skills, projects, certificates, awards, social links, photos, videos and other files. You decide what goes in. Please don't include sensitive information such as government ID numbers, health information or financial account numbers.
• Billing details: payments are handled by Stripe, which collects your card details. We never receive or store your full card number. We keep your Stripe customer and subscription IDs, your plan, billing status and renewal dates, and a record that you agreed to the automatic-renewal terms. Our billing page shows limited card details from Stripe (brand, last four digits, expiry).
• Custom domains: domain names you connect and their settings.
• Messages: what you send us when you email support, and your contact details.

Information collected automatically

• Technical data: when you or anyone else visits the Service, our hosting provider Cloudflare processes the IP address, browser and device type, pages requested, referring page and time, to deliver pages and protect against attacks. We also use IP addresses briefly to limit how often some features (like resume import) can be used; we don't store them for this.
• Cookies and browser storage: see Cookies and browser storage.

Visitors to portfolio sites

We host the portfolio pages our users publish. We don't put analytics, advertising or tracking tools on them, and we don't give site owners information about their visitors. Cloudflare processes visitors' technical data as described above. Some themes load decorative images from other websites, which (like any website) receive the visitor's IP address.

Information from other companies

We receive profile details from Google if you sign in with Google, and payment status and fraud signals from Stripe.

2. How we use information

• To provide the Service: run your account, import your resume, save, publish and host your sites, and connect your domains.
• To process payments, subscriptions, renewals and refunds, and to prevent fraud.
• To send service emails: sign-in and security messages (such as password resets), receipts, renewal reminders, payment problems, plan changes and important updates.
• To answer your questions and give support.
• To keep the Service secure: detect and prevent abuse, spam, fraud and illegal content, and enforce our Terms.
• To fix problems and improve the Service.
• To meet legal obligations (such as tax and accounting records), respond to lawful requests, and establish or defend legal claims.

We don't send marketing emails without your consent, and we don't use your resume or portfolio content to train AI models.

If you are in the European Economic Area or the UK, our legal bases are: performing our contract with you (running your account, sites and subscription); our legitimate interests (security, fraud prevention, improving the Service and telling you about it), which we balance against your rights; legal obligations (such as keeping tax records); and your consent where we ask for it, which you can withdraw at any time.

3. AI resume import

When you import a resume, we extract the text from your PDF on our servers (we don't keep the file) and send that text to OpenAI's API, which returns it as structured information to fill in the editor. OpenAI processes the text for us as a service provider. According to OpenAI's API data policies at the time of writing, data sent through its API isn't used to train its models and is kept for a limited period (currently up to 30 days) for abuse monitoring, then deleted. Until you save your site, the imported information stays only in your browser.

4. How we share information

We don't sell your personal information, and we don't share it for targeted advertising. We share it only in these cases:

• Service providers that run parts of the Service for us and may use it only to do so:
  • Google (Firebase Authentication, Cloud Firestore and Cloud Storage): accounts, site content and uploaded files;
  • Cloudflare: hosting, content delivery, security, DNS and custom domain connections, and our support email;
  • Stripe: payments and subscription billing;
  • OpenAI: reading imported resumes;
  • Resend: sending our emails.
• The public: anything you publish on a portfolio site can be seen by anyone, including search engines.
• Legal reasons: to comply with the law or a valid legal request, or to protect the rights, property or safety of our users, the public or us.
• Business transfers: if MyPortfolios is involved in a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.
• With your permission or at your direction.

5. How long we keep information

• Account and site content: while your account exists. When you delete content, we remove it from our active systems. When you ask us to delete your account, we delete it and its content within 30 days, apart from the records below.
• Saved sites stay in your account after a paid plan ends, so you can come back to them.
• Billing and tax records: as long as the law requires, generally up to 7 years. Stripe keeps payment records under its own policy.
• Records that you agreed to automatic renewal: at least 3 years, or 1 year after your subscription ends if that is longer, as the law requires.
• Email delivery logs and server logs: kept for a limited time by Resend and Cloudflare for delivery, security and troubleshooting.
• Unsaved editor work: kept only in your browser tab and cleared when you close it.

6. Cookies and browser storage

We use only what is needed to run the Service. We don't use advertising or analytics cookies.

• Staying signed in: Firebase Authentication keeps you signed in using your browser's storage, and we set a short-lived idToken cookie (renewed hourly while you are active) so our servers can check who is making a request.
• Work in progress: the editor keeps unsaved changes in your browser's session storage so they survive signing in. It is cleared when you close the tab.
• Checkout: on the checkout page, Stripe sets cookies to prevent fraud (see Stripe's privacy policy).

Because these are strictly necessary, we don't ask for cookie consent. You can block cookies in your browser, but signing in and checkout won't work.

7. Your choices and rights

You can view and change most of your information in your account and the editor, and unpublish or delete your sites at any time. To get a copy of your information, correct it, or delete your account, email support@myportfolios.site from the address on your account. We may need to confirm your identity before acting on a request. We respond within the time the law requires (for example, 45 days under California law, or one month in the EEA and UK), and we won't treat you differently for using these rights.

California residents

California law gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We don't sell or share personal information, and we use sensitive information (your account login) only to provide the Service. You may use an authorized agent, who must show us your written permission. In the past 12 months we collected these categories: identifiers (name, email, IP address, account IDs); commercial information (plan and purchase history); professional, employment and education information (from your resume); internet activity (technical data); and audio or visual information (photos and videos you upload). The sources, purposes, recipients and retention periods are described above.

We don't share personal information with third parties for their own direct marketing (California Civil Code Section 1798.83).

Other US states

Depending on where you live, you may have similar rights. If we decline your request, you can appeal by replying to our answer with the word "Appeal"; if we still decline, you may contact your state attorney general.

EEA, UK and Switzerland

You have the right to access, correct, delete, restrict or object to our use of your personal information, to receive it in a portable format, and to withdraw consent at any time. You can also complain to your local data protection authority. MyPortfolios is the controller of your information. We are based in the United States, and our providers process information in the US and other countries, relying on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

8. Do Not Track and Global Privacy Control

We don't track you across other websites, and we don't let other companies do so on the Service, so we don't respond to Do Not Track signals differently. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of your personal information, which we don't do anyway.

9. Security

We use HTTPS for all connections, rely on Firebase for password security and on Stripe (a PCI-DSS certified provider) for card data, and limit access to our systems. No service can be completely secure. If a breach affects your personal information, we will notify you and the authorities as the law requires. Please use a strong password that you don't use anywhere else.

10. Children

The Service isn't directed to children and isn't meant for anyone under 16. We don't knowingly collect personal information from children under 16; if we learn that we have, we will delete it. Parents and guardians can contact us at support@myportfolios.site.

11. Changes to this policy

When we update this policy, we will post the new version here with a new effective date. If the changes are significant, we will also email you or show a notice on the Service before they take effect.

12. Contact us

Questions or requests about your privacy: support@myportfolios.site. MyPortfolios · myportfolios.site