How SmartPortfolio handles your data.

SmartPortfolio is operated by ⚠ FILL IN: legal entity name, registered at ⚠ FILL IN: registered address in ⚠ FILL IN: country of registration. That entity is the data controller for the personal data described here and is who you are contracting with when you use the product.

For anything in this policy, including any of the rights below, write to parvezrobinn@gmail.com.

We collect what you give us and what the product needs to run. Nothing is bought from data brokers, and we run no advertising or analytics trackers.

• Account data. Your email address, your account identifier, and — if you sign in with Google — the basic Google profile described below. Passwords, where you use one, are stored hashed by our authentication provider and are never visible to us.
• Résumé files. The PDF or image you upload is stored as a file and its text is sent to an AI provider for extraction. A résumé usually carries your name, contact details, employment history, and education.
• Portfolio content. Everything in the editor: profile details, biography, job history, projects, skills, links, and any images you upload.
• AI usage records. One row per AI request with your user id, which operation ran, the day, the model, token counts, and success or failure. These enforce per-day limits and let us track cost. They do not store your prompt text or the generated output.
• Beta and access records. If a beta campaign is running, whether you hold a seat or sit on the waitlist, and when that changed.
• Operational logs. Ordinary server and error logs from our hosting and error-monitoring providers: request URLs, IP address, user agent, timestamps, and stack traces when something breaks. The public résumé-download endpoint additionally uses your IP address as part of a short-lived rate-limit key.
• Session cookies. The cookies that keep you signed in. We set no advertising, tracking, or analytics cookies.

You choose what to upload. A résumé can contain information that data protection law treats as special category — health, religion, trade union membership, political opinions, a photograph revealing race or ethnicity — and if you include it, it is processed and sent to an AI provider along with the rest of the file. We do not ask for that information and do not need it. Remove anything you would rather not share before you upload.

Where the GDPR or UK GDPR applies, these are the lawful bases we rely on:

• Performance of a contract (Art. 6(1)(b)) — creating and securing your account, storing and editing your portfolio, sending your résumé and answers to an AI provider so the product can generate the portfolio you asked for, and publishing your site when you press publish. This is the basis for most of what we do.
• Legitimate interests (Art. 6(1)(f)) — keeping the service up and secure, error monitoring, rate limiting, abuse and fraud prevention, and controlling AI spend. We use the minimum data that works; you can object using the rights section below.
• Legal obligation (Art. 6(1)(c)) — responding to lawful requests and keeping records we are required to keep.
• Consent (Art. 6(1)(a)) — we do not currently rely on consent for any part of the core product. If we later ask for it (for example, for optional email), you can withdraw it at any time without affecting anything processed beforehand.

If you choose to sign in with Google, we use Google OAuth to authenticate your account. Through that sign-in flow, we may receive basic profile information associated with your Google account, such as your name, email address, and Google account identifier.

We use Google user data only to authenticate you, create or access your SmartPortfolio account, and maintain your signed-in session. We do not use Google user data for advertising, and we do not sell that data to third parties.

If our use of Google data changes in the future, we will update this policy before applying that new use.

• Run the product: authenticate you, store your portfolio, render the editor, and serve your published site.
• Turn your résumé and answers into portfolio content using AI, at your request.
• Serve your résumé file to visitors of your published portfolio, through our server, while that portfolio is published.
• Enforce per-day AI limits and keep AI spend under control.
• Keep the service secure: detect abuse, prevent fraud, and enforce our terms.
• Send you essential account, security, and support messages.

We do not sell personal data, we do not share it for advertising, and we do not use your portfolio content to train AI models of our own.

We run SmartPortfolio on third-party infrastructure. Each company below processes personal data on our instructions, and only what is listed:

• Neon — our database. Holds your portfolio rows, your settings, and your usage records. This is where your account data lives at rest.
• Cloudflare R2 — file storage. Holds your uploaded images and your résumé file. Neither storage bucket is publicly readable; files are served only through SmartPortfolio itself.
• Clerk — our authentication provider. Holds your login identity: your email address, where you used one your hashed password, and your Google account link if you sign in that way. It is deleted when you delete your account.
• Vercel — application hosting. Serves every request and therefore sees request URLs, IP addresses, user agents, and anything in the request body while it is being handled.
• Sentry — error monitoring, when it is enabled for a deployment. Receives error reports: stack traces, the URL that failed, and whatever variables were in scope at the moment of the failure, which can include fragments of your content.
• Upstash— rate limiting for the public résumé download endpoint. Receives the visitor’s IP address and the portfolio id as a short-lived counter key, and no content.
• Google — sign-in only, if you use Google sign-in. Google is the source of the profile data described above; we send it nothing else.
• AI providers — see the next section. They receive résumé and portfolio text.

We also disclose data if the law requires it, or where it is necessary to protect the rights and safety of users or of the service. Anything you publish is a separate matter: see “What becomes public” below.

Three operations send your content to a large language model: résumé extraction (the file or pasted text), portfolio generation (the answers you type into the wizard), and rewriting (the single passage you ask to be rewritten). The output comes straight back into your draft.

Anthropic is the default provider for all three operations and, unless this section says otherwise, the one your content goes to. It receives your uploaded résumé — as a PDF, image, or text — plus any portfolio text you ask it to generate or rewrite.

The product can be pointed at other providers instead, one operation at a time. Each receives the same content as Anthropic for whichever operation it is assigned:

• OpenAI — résumé and portfolio text, if an operation is routed to it.
• Google (Gemini) — résumé and portfolio text, if an operation is routed to it.
• DeepSeek — résumé and portfolio text, if an operation is routed to it. DeepSeek processes data in China.
• OpenRouter — résumé and portfolio text, if an operation is routed to it. OpenRouter is a broker and passes the request on to the model vendor you have selected.
• A self-hosted or private endpoint the operator configures, used only where we have named it here first.

We update this section before routing content to a provider not listed here. How long a provider keeps a request is governed by that provider’s own terms, not ours.

Publishing a portfolio makes the content of that portfolio readable by anyone with the address, including search engines. If your portfolio carries an uploaded résumé, the download button on the published page serves that file to any visitor for as long as the portfolio stays published. Unpublishing stops both immediately. Drafts are never public.

Our database is hosted in ⚠ FILL IN: Neon region and our file storage in ⚠ FILL IN: Cloudflare R2 location. Our application hosting and error monitoring, and every AI provider named above, operate from the United States, and DeepSeek — if enabled — from China. If you are in the UK or the EEA, using SmartPortfolio means your data is transferred outside that area.

Those transfers rely on the standard contractual clauses and transfer terms in each provider’s data processing agreement: ⚠ FILL IN: confirm a signed DPA is in place with each provider. Write to us at the address above for a copy of the relevant terms.

We keep your account and portfolio data until you delete it. Concretely:

• Deleting a portfolio removes the record immediately, and in the same request deletes the images and the résumé file it used from storage — unless another portfolio on your account still points at the same file, in which case that file is kept.
• Unpublishing stops the public page and the résumé download at once. The content stays in your account until you delete it.
• Deleting your account unpublishes every portfolio first, then deletes your portfolio records, your settings, your AI usage records, any beta or waitlist entry, every file stored under your account, and finally the login identity itself. There is no self-serve delete button yet: email us and an operator runs it. We complete verified requests within 30 days and normally much sooner.
• Backups.Deleted data can persist in our database provider’s automated backups for up to ⚠ FILL IN: Neon backup retention window before those backups roll off. Restored backups are re-purged.
• Logs and error reports are held by our hosting and monitoring providers for ⚠ FILL IN: Vercel and Sentry log retention windows. Rate-limit counters expire within minutes.

If you are in the UK or the EEA you have the rights below, and we honour them for everyone regardless of where you live:

• Access — a copy of the personal data we hold about you, and confirmation of how it is used.
• Rectification — correction of anything inaccurate. Most of it you can edit yourself in the editor.
• Erasure — deletion of your account and its content, as described above.
• Portability — your portfolio content and uploaded files in a machine-readable form (JSON plus the original files), on request.
• Objection — you can object to processing we base on legitimate interests; tell us your grounds and we stop unless we can show compelling ones of our own.
• Restriction — you can ask us to pause processing while a dispute about accuracy or lawfulness is resolved. In practice this means unpublishing and freezing the account.
• Withdrawal of consent — where we ever rely on consent, you can withdraw it at any time, with no effect on processing already carried out.
• Complaint to a supervisory authority— you can complain to the data protection regulator where you live or work. If you are in the UK that is the Information Commissioner’s Office. Our lead supervisory authority is ⚠ FILL IN: lead supervisory authority for the controller.

To use any of them, email parvezrobinn@gmail.com from the address on your account. If we cannot tie the request to an account we will ask for something that does. We reply within 30 days; if a request is genuinely complex we will tell you inside that window and may extend it by up to two further months, as the law allows. There is no charge unless a request is repetitive or excessive. Requests are carried out by hand today — there is no self-serve control for erasure or export in the product yet.

Traffic is served over HTTPS. Résumé files are held in a private bucket that is not reachable by URL: the only way to a file is our own endpoint, which serves it solely for a published portfolio. Portfolio records are readable only through server-side code that checks ownership on every request, and links in published content are sanitised before rendering.

No system is perfectly secure, and we cannot guarantee absolute security. If you believe you have found a vulnerability, please tell us at the address above before disclosing it elsewhere.

SmartPortfolio is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date on this page. If a change means we start using your data in a materially different way — a new AI provider, a new purpose — we will say so before it takes effect.

Questions about this policy, or any request under “Your rights”: parvezrobinn@gmail.com. Postal address: ⚠ FILL IN: registered address.