Privacy Policy

1. What we collect

• Account. Email, display name if provided, auth provider (email/password or Google), Firebase user ID, optional profile photo.
• Career content. Structured profile data you enter or that we extract from an uploaded CV (roles, education, projects, skills, certifications, awards, summary, links). Draft content stays private until you publish.
• Uploaded files. CV PDFs (and related uploads) stored in Firebase Storage for extraction, editor use, and optional "Download CV" on your public site.
• Published site. Chosen username, template and style settings, visibility of sections, and the public HTML/JSON we serve at your vanity URL and on https://www.sitefolio.app/u/…. Optional custom (bring-your-own) domain hostname after unlock, verified via DNS.
• Billing. Stripe customer ID, checkout session IDs, price/plan kind (1-Year or Lifetime), and site access entitlement on your user record. We do not store full card numbers.
• Site analytics. When your site is live, we store first-party aggregates (for example daily views and CV download counts) in Firestore so you can see them in the dashboard. These are tied to your site, not sold as advertising profiles.
• Transactional email. Address and message metadata when Resend is configured and we send password-reset or "site live" email.
• Technical. IP and request metadata used for rate limiting, CSRF, security logs, and abuse prevention. Hosting platform logs on Vercel.
• Aggregate traffic. DataFast (cookieless) and Vercel Web Analytics page views on marketing and app pages (no advertising identifiers from us by default). Separate from your per-site dashboard analytics above.

2. How we use it

• Authenticate you and keep a secure session
• Extract and edit CV content, preview, and publish your site
• Serve your public vanity URL, optional custom domain, and CV download when enabled
• Show unlock-gated visitor analytics (views and downloads) in your dashboard
• Process one-time unlock payments and grant or revoke access
• Send email you request (reset) or that confirms publish, when email is configured
• Protect the service (rate limits, CSRF, fraud signals)
• Understand aggregate usage of marketing and product pages
• Comply with law and respond to lawful requests

We do not sell your personal data. We do not use your CV to train public models for unrelated third parties beyond what is required to run extraction via our AI provider (see processors below).

3. Legal bases (EEA / UK readers)

Where GDPR or UK GDPR applies, we typically rely on:

• Contract: to provide the account, editor, publish, and unlock features you request.
• Legitimate interests: security, abuse prevention, aggregate analytics, product reliability.
• Consent: where required for optional non-essential cookies (not enabled by default; see Cookies).
• Legal obligation: tax, accounting, and regulatory requests.

4. Where it lives (processors)

Data is processed by these providers under their own terms and privacy notices:

• Google Firebase: Authentication, Firestore, Storage (project dedicated to SiteFolio). Firebase privacy
• Stripe: Checkout and payment records for one-time unlocks. Stripe privacy
• OpenAI: PDF / scan extraction when you upload a CV. Document content is sent to generate structured fields you then review. OpenAI privacy
• Resend: transactional email (password reset, site-live notices) from our sending domain when configured. Resend privacy
• Vercel: hosting, edge/middleware, and cookieless Web Analytics. Vercel privacy

Processors may process data in the EU, US, or other regions depending on their infrastructure. Where required, transfers rely on appropriate safeguards offered by those providers (for example SCCs).

5. Public sites and your CV

Until you publish, drafts and uploads are private to your account (subject to processor access for providing the service). After you publish:

• Content in visible sections is public on the internet at your vanity hostname, optional custom domain, and related URLs.
• If Download CV is enabled, visitors can fetch the file you attached.
• Every public site shows a discrete "Made with SiteFolio" credit. It is always on and not a paid hide.
• Phone numbers are not published unless you add them. You can hide Contact or other sections in the editor.
• Unpublishing removes public access; copies already downloaded or cached by third parties are outside our control.

6. Retention

• Account and site data are kept while your account exists.
• Billing records and security logs may be retained longer where needed for disputes, tax, or abuse prevention.
• If a 1-Year Pass expires, the site may go private; we do not auto-delete your content solely because the pass ended.
• Account deletion (from account settings / delete API) removes account-linked data we control, subject to backups and legal retention windows.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to object to certain processing. You can:

• Edit profile and site content in the product
• Request deletion via account tools or email
• Contact info@mail.sitefolio.app for access or other requests

EEA/UK users may lodge a complaint with their local supervisory authority. We will respond within a reasonable time.

8. Children

SiteFolio is not directed at children under 16. Do not create an account if you are under the age required in your country to consent to online services.

9. Security

We use HTTPS, Firebase session cookies (httpOnly), CSRF protection, rate limiting, and least-privilege server access patterns. No online service is perfectly secure. Report suspected issues to info@mail.sitefolio.app.

10. Changes

We may update this policy. The date at the top will change when we do. Material changes may also be called out in-product or by email when appropriate. Continued use after an update means you accept the revised policy.

11. Contact

Privacy questions: info@mail.sitefolio.app. Also see Terms of Service and Cookies.

This page describes how the product works. It is not legal advice.