Privacy Policy

Who is responsible for your data

Portfely is a portfolio-building and publishing service operated by AaTech in Saudi Arabia. AaTech is the controller of the personal data we process to run Portfely. This policy covers our website, account dashboard, hosted portfolios, and related support and communications.

Portfolio owners choose what they publish and are responsible for having the right to share other people's information. This policy does not govern external websites or services linked from a portfolio.

Information we collect

• Account information: your name, email address, profile image, and account identifier from Google sign-in, plus account dates, plan and trial status, and communication preferences. Portfely does not ask for your Google password.
• Portfolio content: information you enter or import, including your introduction, contact details, images, projects, work history, education, skills, certifications, CV links, social links, languages, and domain settings.
• Billing information: purchase amounts, currency, discounts, payment status, transaction and subscription identifiers, and invoice details returned by our payment provider. Card entry happens on the payment provider's hosted checkout, not in a Portfely card form.
• Support and operational information: messages you send us, account and domain troubleshooting details, request logs, browser or device information, and information needed to investigate errors or misuse.
• Visit information: portfolio views, referral website names, device categories, and a daily visitor identifier derived from an IP address. We also use website analytics to understand how the service is used.

What becomes public

Saving a portfolio makes its saved content available on its public address. Depending on your template and settings, visitors can see your published contact details, images, work, and links. Public pages may appear in search engines and be copied or cached by others. Uploaded portfolio images have publicly accessible URLs.

Only publish information you want to share. Do not upload identity documents, payment details, private client material, or sensitive personal information. Removing content from Portfely does not automatically remove copies held by search engines or other people.

Why we use your information

We use information to authenticate you, save and publish your portfolio, provide paid features, connect domains, process purchases, answer support requests, send service notices, measure usage, and protect the service against fraud and abuse.

The basis for processing depends on the purpose and applicable law: performing our agreement with you for account and hosting services; meeting legal obligations for records and lawful requests; and legitimate interests, where permitted, in service reliability and security. Where processing relies on consent, you may withdraw it without affecting processing that was lawful before withdrawal. Providing account information is necessary to use an account; most portfolio fields are your choice.

Service providers and access

We use service providers for authentication, hosting, databases, image storage, payment processing, email delivery, and analytics. These include Google for sign-in, MongoDB for database services, Amazon Web Services for image storage, StreamPay for payments, and Resend for email delivery. Information shared depends on the feature: for example, checkout sends your name, email, and account reference to StreamPay.

Opening the optional CvFlow import tool sends your account email to CvFlow to find matching resumes. You choose which resume to import. External images, fonts, and links may also cause your browser to contact their providers, whose own policies apply to their services.

Authorized administrators can review account, portfolio, and billing information and access an account through administrative support tools to operate, troubleshoot, or protect the service. We may also disclose information when necessary to meet a legal obligation, respond to a lawful request, or protect rights and safety. We do not sell your personal data or use it for third-party targeted advertising.

Cookies, browser storage, and analytics

We use session cookies to keep you signed in, and browser storage to remember interface preferences and portfolio editor content. Login sessions are configured for up to 30 days and the sidebar preference cookie for seven days. Locally stored editor content can remain after you sign out. On a shared device, clear this site's browser data when you finish. Blocking storage may prevent sign-in or saving preferences.

Our portfolio analytics endpoint uses an IP address to generate a date-based hashed visitor identifier rather than storing the raw IP in the portfolio analytics record. This identifier is pseudonymous, not a guarantee of anonymity. Portfolio owners can view counts and summaries such as views, referral sources, and device categories. Hosting, security, and website analytics providers may separately process technical request information.

Service emails and offers

We send emails related to your account, support, purchases, and service operation. The trial-offer feature also sends promotional emails near the end of a trial. Promotional emails include an unsubscribe option; you can also contact support to stop these offers. Unsubscribing from offers does not stop necessary account, security, or purchase communications.

Accepting the Terms of Service or reading this policy is not, by itself, consent to direct marketing where separate consent is required by law.

Where and how long data is kept

AaTech operates in Saudi Arabia, but our infrastructure and service providers may process data in other countries. We do not promise that all information stays in Saudi Arabia. International processing is subject to applicable data protection and transfer requirements. You can contact us for information about the providers used for your account.

Account and portfolio records are kept to provide the service. Expiry of a trial or paid plan does not automatically delete your content. Payment and operational records may be needed longer for accounting, legal obligations, security, or resolving disputes. Most account, portfolio, payment, and analytics records do not currently have a fixed automatic deletion period; some subscription-operation logs are configured to expire after 90 days.

You can request deletion through support. We assess what can be removed and what must be retained under applicable law. Deletion from active systems may not immediately remove provider backups or third-party caches. Browser-stored editor copies must be cleared on your own device. We will explain any lawful reason that prevents us from fulfilling a deletion request.

Your choices and rights

Depending on applicable law, you may request information about processing, access to or a copy of your personal data, correction, completion, or destruction of data that no longer needs to be kept. Where applicable, you may withdraw consent, object to or restrict certain processing, or request data portability. Some rights have legal exceptions.

You can edit portfolio information in your dashboard. For other requests, including account deletion, email support@portfely.com from your account address. We may ask for proportionate information to verify your identity and will handle requests within the periods required by applicable law. You can deactivate your account in Settings. This takes your portfolio offline without immediately erasing your data.

You may raise a concern with us or complain to the competent data protection authority. In Saudi Arabia, this is the Saudi Data and Artificial Intelligence Authority (SDAIA). Contacting us first does not limit your right to complain.

Security and younger users

We use access controls and other technical safeguards to help protect personal data. No online service or transmission is completely secure. Keep your Google account secure and contact us if you suspect unauthorized access.

Portfely is not directed at children below the age at which they may lawfully use the service without a guardian. Where guardian authorization is required, a guardian must authorize and supervise use. If you believe a child has provided data without the required authorization, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this policy when the service or our processing practices change. We will update the date above and provide notice of material changes through the service or email where required. If a new use requires consent, a policy update alone does not provide that consent.