Privacy Policy

1. Information We Collect

1.1 Account and Profile Information

• Name and email address
• Contact information
• Account credentials

1.2 Business Content You Create

As a business-management platform, Portfelio stores the content you and your clients put into the service, including:

• Projects and client records (names, contact details, notes)
• Contracts, invoices, questionnaires, and photography timelines
• Galleries and uploaded images
• Bookings, calendar entries, and prep checklists
• Email threads connected to a project

1.3 Connected-Service Data

When you connect Google Calendar, an email mailbox, Instagram, or a payment provider, we process the data needed to provide that feature. For Google Calendar specifically, we access and store calendar events you create through our service, calendar metadata (calendar names, settings), event details (titles, dates, descriptions), and your Google account information (name, email, profile picture).

1.4 Usage and Technical Data

We collect logs, device and browser information, and diagnostic data used to operate, secure, and improve the service.

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the features you use, including your CRM, documents, galleries, and bookings
• Create and manage calendar events on your behalf and synchronize project data with your Google Calendar
• Power the AI assistant when you ask it to read or act on your data
• Send transactional notifications and the messages you choose to send to clients
• Process payments and transactions
• Provide customer support
• Secure the platform, prevent abuse, and meet legal obligations

3. Data Sharing and Disclosure

We do not sell your personal data. We share information only as needed to run the service, with:

• Google: when you use the Google Calendar integration
• Stripe: for payment processing
• AWS: for data storage and hosting
• Intercom: for customer support
• Instagram / Meta: when you connect Instagram (see Section 8)
• AI providers: when you use the AI assistant or connect a third-party AI client such as ChatGPT (see Section 9)
• Legal: where required by law, or to protect rights, safety, and the integrity of the service

We do not use your business content or your clients’ information to train AI models.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption of data in transit and at rest, secure authentication mechanisms, and limited access to personal data.

5. Your Rights and Choices

You have the right to access, correct, delete, and export your personal information. You can revoke any connected service — including Google Calendar, Instagram, and AI connectors — at any time through your account settings.

6. Data Retention

We retain your data while your account is active and for as long as needed to provide the service. When you delete content or close your account, we delete or anonymize the associated data within a reasonable period, except where we must retain it to meet legal, accounting, or security obligations. When you disconnect Google Calendar or delete your account, we remove all stored Google Calendar data within 30 days and revoke our access to your Google account.

7. Google API Compliance

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only access data necessary for our calendar integration features, do not sell or transfer your Google user data to third parties, and allow you to revoke access at any time.

8. Instagram Integration

When you connect your Instagram account to Portfelio, we access and process:

• Your Instagram Business/Creator account profile information
• Permission to publish content on your behalf
• Media and post data for scheduling and publishing

How We Use Instagram Data:

• To publish social media posts you create within Portfelio
• To display your connected account information
• To manage scheduled content

Data Retention: Instagram data is retained while your account is active. When you disconnect Instagram or delete your account, we revoke access and delete stored Instagram data within 30 days.

Your Rights: You can disconnect your Instagram account at any time from your Portfelio settings. You can also revoke access directly from Instagram’s settings under Apps and Websites.

Our use of Instagram data complies with Meta’s Platform Terms and Developer Policies.

9. AI Assistant and AI Connectors

Portfelio offers an AI assistant (“Lio”) and AI connectors that let approved third-party AI clients (such as ChatGPT, via the Model Context Protocol) access your data on your behalf. These features only access your data after you explicitly connect them, and only within the permissions you grant.

• Authorization. Connectors use OAuth 2.1. You sign in and approve a specific list of permissions, and you choose which of your sites the connection applies to, before any access is granted.
• Read vs. write. Read access (viewing projects, invoices, galleries, and similar) and write access (creating or editing projects, contracts, invoices, or calendar events) are separate permissions. Write permissions are off by default and must be enabled deliberately on the consent screen.
• Per-action confirmation. For external AI clients, write actions require a second explicit confirmation before they execute, so an AI cannot silently change your data.
• Third-party processing. When you use a third-party AI client, the content you exchange with it is also subject to that provider’s privacy policy. We only respond to requests carrying a valid access token you authorized.
• Revocation. You can disconnect a connector at any time, which revokes its access going forward.
• Training. We do not use your business content or your clients’ data to train AI models.

10. Contact and Business Identity

If you have any questions about this Privacy Policy or your data, you can reach us at the contact details below.