Privacy Policy

This policy explains what data Ninefolio collects and how it is used. The data controller is Webuild Technologies SRL. For any privacy question or request, reach us via the contact page.

What we collect

• Account data — email address, password (stored hashed by our authentication provider), and optionally your name when you sign up.
• Portfolio content — the texts, photos and videos you upload to build your page. Public pages are visible to anyone once you go live and may be indexed by search engines.
• Guest drafts — if you try the editor without an account, we store your draft under an anonymous account; it is automatically deleted after about 7 days unless you sign up.
• Billing data — handled by our payment processor: your payment method and invoices. We never see or store card numbers; we keep only a customer reference and your plan status.
• Technical data — server logs (IP address, timestamps, errors) kept for security and debugging, retained for a limited period.

How we use it

• To run the service: host your portfolio, show it at your link, process your uploads.
• To handle payments, subscriptions and invoices.
• To keep the platform secure: bot protection, rate limiting, abuse prevention.
• To answer your support requests.
• To understand feature usage via analytics — only if you accepted analytics cookies.

Legal bases

Under the GDPR we rely on: contract (providing the service you signed up for), legitimate interests (security, abuse prevention, improving the service), legal obligation (tax and accounting records), and consent (analytics cookies — which you can withdraw anytime).

What we don't do

• We don't sell your data.
• We don't use your content for anything other than displaying your portfolio.
• We don't set non-essential cookies without your consent.

Where data lives

We use a small number of specialist providers to run Ninefolio: a database and authentication service, a media storage service, a payment processor (we never see or store card numbers), a bot-protection service, and — only if you consent — an analytics service. Each of them processes data solely to provide their service to us, under a data processing agreement.

International transfers

Some of our providers process data outside the EEA (for example in the US). Where that happens, transfers are covered by recognised safeguards — the EU Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework.

How long we keep it

• Account data and content — for as long as your account exists.
• Guest drafts — about 7 days, then deleted automatically.
• Server logs — a limited period, for security and debugging.
• Invoices and transaction records — as long as tax law requires.

Your rights

You can access, correct, delete or export your data, restrict or object to processing, and withdraw consent at any time — see Data Deletion or reach us via the contact page. If you are in the EU, you also have the right to complain to your data protection authority.

California residents

If you live in California, the CCPA/CPRA gives you the right to know what personal information we collect (listed above), to access, correct or delete it, and not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising, and we haven't in the past 12 months. To exercise any of these rights, reach us via the contact page — we verify each request and respond within the time the law requires. You can also designate an authorized agent to make a request for you.

Cookies

Essential cookies are required for the service to work: your login session, bot protection on signup, and a cookie remembering your consent choice for 12 months.

Optional analytics cookies are set only if you accept them in the cookie banner. Analytics runs with IP anonymization to show us page views and feature usage; this data is never sold and never used for advertising. If you decline, no analytics scripts are loaded at all.

Children

Ninefolio is not directed at children under 18 and we don't knowingly collect their data. If you believe a child under 18 has an account, contact us and we'll delete it.

Changes

We may update this policy; material changes will be announced on this page and, where appropriate, by email.