Privacy Policy

1. Introduction

Welcome to PortalFlow ("we," "our," or "us"). PortalFlow is a client management SaaS platform that empowers freelancers and agencies to share files, manage project tasks, send invoices, and communicate with clients via secure, custom-branded client portals.

We are committed to protecting your personal information and your clients' data. This Privacy Policy explains what information we collect, how we process and protect it, and the rights available to you regarding your data.

2. Information We Collect

We collect information in the following categories:

• Account Information: When you register for a PortalFlow account, we collect your name, email address, password hash, and optional profile information.
• Client Portal Content: Data uploaded or generated within client portals, including client names, project tasks, uploaded files/documents, invoice line items, and portal messages.
• Billing & Payment Data: Payment processing is handled by authorized third-party gateways (Stripe and Cryptomus). We do not store raw credit card numbers or secret crypto wallet keys on our servers.
• Log & Device Data: Information automatically collected by browser servers, such as IP addresses, browser types, operating systems, and page request timestamps.

3. How We Use Your Information

Your data is used solely for operating and enhancing the PortalFlow platform:

• To provide, maintain, and secure your client portals and dashboard services.
• To generate secure, tokenized portal links so your clients can view project progress without registration.
• To process subscription payments and issue invoices.
• To communicate service updates, billing alerts, and customer support responses.
• To detect and prevent fraudulent access, abuse, or unauthorized system activities.

4. Data Storage & Security

We implement industry-standard administrative, physical, and technical safeguards to protect your information:

• Database & Storage: Hosted on Supabase infrastructure with TLS encryption in transit and AES-256 encryption at rest.
• Client Access Tokens: Client portals use secure 32-character hexadecimal tokens ensuring only individuals with the specific portal link can access project details.
• Payment Security: Transactions are processed in PCI-DSS compliant environments via Stripe and cryptographically verified Webhooks via Cryptomus.

5. Third-Party Services & Data Sharing

We do not sell, rent, or trade your personal data or your clients' information to third-party advertisers. We only share necessary data with trusted service providers:

• Supabase: For user authentication, database management, and file storage.
• Stripe & Cryptomus: For processing subscription payments and invoice payouts.
• Vercel / Netlify: For hosting web application infrastructure and API routes.

6. Your Rights & Data Retention

Depending on your location (including under GDPR or CCPA), you hold the following rights:

• Access & Export: Request a copy of your personal account data and portals.
• Correction & Deletion: You may edit or delete your portals, files, tasks, and account at any time directly in your dashboard or by contacting us.
• Data Retention: We retain account data as long as your account is active. Upon account deletion, project data is permanently purged.

7. Updates to This Policy & Contact

We may update this Privacy Policy periodically. Notice of material changes will be posted on this page with an updated revision date.

If you have any questions regarding this Privacy Policy or data privacy at PortalFlow, please contact us at: