Privacy Policy

Last updated: 31/10/2026

This policy describes the data processed by Workfolio in accordance with the GDPR (EU 2016/679).

1. Data controller

The data controller is the operator of the Workfolio platform.

2. Data processed

• Account data: Google identifier, email, name / display name, avatar, GDPR consent date.
• Portfolio data: portfolio, pages, blocks, optional custom domain.
• Imported files: file metadata and storage paths.
• Contact messages received via public portfolios: name, email, message, IP fingerprint (hash).

3. Purposes

• Authentication and account management.
• Portfolio publication and administration.
• Management of imported media.
• Anti-spam protection on contact forms.

4. Legal bases

• Performance of the requested service (creation and hosting of the portfolio).
• Consent (GDPR acceptance on first login).
• Legitimate interest (security and anti-abuse).

5. Retention periods

Data is retained for as long as the account exists. Upon account deletion, data linked to the account (profile, portfolio, pages, blocks, files, custom domain, contact messages) is permanently deleted.

6. Data sharing

Data is not sold. It may be processed by technical sub-processors (hosting, infrastructure) solely to operate the service.

7. Your rights

• Right of access and portability: JSON export available in settings.
• Right to rectification: edit your display name and content from the interface.
• Right to erasure: delete your account from the privacy settings.

8. Security

Workfolio applies appropriate security measures: secure sessions, CSRF protection, prepared SQL queries and application-level access controls.

9. Cookies

A strictly necessary session cookie is used for authentication. No advertising cookies are deployed by default.

10. Complaints

You may lodge a complaint with your national data protection authority.