The data controller is Individual Entrepreneur Ildar Ildarkhanov, trading as portfolico. To exercise any of the rights below, or to ask what is held about you, write to hello@prtfl.co.
Uploaded PDF files, the display settings you choose (title, marked images, notes, closing card, share settings), and — if you create an account — your email address and a salted hash of your password. Passwords are never stored in plain text.
portfolico uses only essential local storage: your theme choice, your session token if you sign in, and a note that you dismissed the cookie notice. There are no advertising trackers, no third-party analytics and no third-party cookies.
When someone opens a shared portfolio we record the visit for its author: a timestamp, how long the visit lasted, the furthest page reached, the chosen viewing mode, and the domain the visitor came from (for example t.me or linkedin.com — never the full URL). To avoid counting one person twice we store a one-way salted hash of their IP address and browser string; the IP itself is not kept, the hash cannot be reversed into an identity, and it is discarded after 90 days. No cookie is set on the visitor and the data is never shared or sold. Authors see only totals — never who visited.
An author can mark a link as protected. On such a link the pages carry a visible watermark, and the author may require visitors to enter an email address before the portfolio opens. That address is not verified and is not an account — it is shown in the watermark while the visitor reads and stored with that visit in the author's log, so the author knows who opened the work. Enter an address you are willing to share, or ask the author for an unprotected link. Please note that no website can prevent a screenshot; the watermark exists to attribute copies, not to stop them.
A portfolio appears at /explore only if its author submits it and a moderator approves it. Submissions are reviewed by hand; a decline never affects the private share link. Listing can be withdrawn at any time, password-protected portfolios can never be listed, and a listed portfolio is pulled back into review automatically once it is reported.
Card and billing details are collected and stored by our Merchant of Record, Paddle.com — not by us. We only receive your plan status, the email tied to the purchase, and non-sensitive transaction metadata needed to grant access. We never see or store your full card number.
Files are visible only to people who open your link (and to the password holders, if you set one). We never sell or share your data with third parties, except payment data with Paddle to process your purchase, or when required by law.
You can delete any shared link from your account at any time; the file is removed with it. Expired links are deleted automatically. To delete an account and all its data, use the report/contact link below.
Depending on your jurisdiction (e.g. GDPR, CCPA) you may have rights to access, correct, export or erase your personal data. Requests can be sent via the Report form — they are handled by the operator.