Privacy Policy

Personal Information: When you sign up for Portfolio Pro, we collect:

• Email address (for account creation and communication)
• Name (for personalization)
• GitHub profile information (if you sign in with GitHub)
• Google profile information (if you sign in with Google)

Usage Information: We automatically collect:

• Learning progress and completion status
• Code submissions and project work
• Platform interaction data
• Device and browser information
• IP address and location data

Payment Information: Processed securely through Stripe. We don't store credit card information.

• Provide and improve our educational platform
• Track your learning progress and provide personalized recommendations
• Send important updates about your account and our service
• Process payments and manage subscriptions
• Provide customer support
• Analyze platform usage to improve our content and features
• Comply with legal obligations

We do not sell, trade, or rent your personal information. We may share information only in these limited circumstances:

• Service Providers: With trusted third parties who help us operate our platform (e.g., Stripe for payments, Supabase for data storage)
• Legal Requirements: When required by law or to protect our rights and users' safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with advance notice)

We implement industry-standard security measures:

• Encryption in transit and at rest
• Secure authentication through OAuth providers
• Regular security audits and updates
• Limited access to personal data on a need-to-know basis
• Secure hosting infrastructure with SOC 2 compliance

Under GDPR (if you're in the EU/EEA) and CCPA (if you're in California), you have comprehensive rights regarding your personal data:

We use cookies and similar technologies to provide and improve our services. You have full control over non-essential cookies.

We retain your personal data only as long as necessary for the purposes outlined in this policy or as required by law.

Our services are primarily hosted in the United States. If you're accessing our service from outside the US, your information may be transferred to, stored, and processed in the US or other countries.

Portfolio Pro is not intended for children under 16 years of age (or 13 in countries where that's the minimum age). We do not knowingly collect personal information from children.

• Age Verification: Users must be at least 16 years old to create an account (13 with verifiable parental consent)
• Parental Consent: For users aged 13-15, we require verifiable parental consent before collecting any personal data
• Discovery of Underage Users: If we learn we've collected data from a child without proper consent, we will delete it within 30 days

Parents or guardians who believe their child has created an account without permission should contact privacy@portfoliopro.dev.

We use automated decision-making and profiling in limited circumstances to enhance your learning experience:

• Learning Recommendations: AI algorithms suggest lessons and projects based on your progress and skill level
• Code Quality Assessment: Automated analysis of your code submissions for feedback
• Difficulty Adjustment: Platform adapts content difficulty based on your performance

Your Rights: Under GDPR Article 22, you have the right to:

• Not be subject to solely automated decisions
• Request human review of automated decisions
• Express your point of view on automated decisions
• Contest automated decisions

Note: Our AI-powered features are designed to assist, not make final decisions about your learning outcomes. Human review is always available upon request.

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify Authorities: Report to relevant data protection authorities within 72 hours (GDPR requirement)
• Notify You: Inform affected users without undue delay via email
• Provide Details: Describe the nature of the breach, likely consequences, and measures taken
• Remediation: Take immediate steps to secure systems and prevent further breaches

We maintain comprehensive security monitoring and incident response procedures to minimize breach risks.

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service offerings.

• Material Changes: We will notify you via email at least 30 days before significant changes take effect
• Minor Updates: Non-material changes will be posted on this page with an updated "Last updated" date
• Consent Required: For changes requiring new consent under GDPR, we'll request explicit opt-in

We encourage you to review this Privacy Policy periodically. Continued use of our service after changes constitutes acceptance, except where additional consent is required.

If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a concern:

Portfolio Pro uses artificial intelligence (AI) systems for code review, personalized learning recommendations, and content suggestions. In compliance with the EU AI Act (Regulation 2024/1689) and AI transparency best practices:

AI Training Data:

• Third-Party Models: We use OpenAI's GPT-4 models, which are trained on publicly available internet data (we do not control this training data)
• Your Data: Your code submissions are sent to OpenAI for analysis but are NOT used to train their models (per our Data Processing Agreement with OpenAI)
• Internal Models: Our learning recommendation algorithms are trained on aggregated, anonymized user progress data (not personal information)

AI Limitations & Risks:

• Not Always Accurate: AI code reviews may contain errors, miss bugs, or suggest suboptimal solutions
• Potential Bias: AI models may exhibit biases present in their training data (e.g., favoring certain programming styles or frameworks)
• Context Limitations: AI cannot fully understand your project requirements, business logic, or specific use cases
• Not a Substitute: AI assistance does not replace human learning, code review by peers, or professional development practices

Human Oversight & Your Rights:

• No Fully Automated Decisions: AI does not make final decisions about your grades, certifications, or account status (human review is always involved)
• Right to Explanation: You can request an explanation of how AI suggestions or recommendations were generated
• Right to Contest: You can disagree with AI-generated feedback and request human review at any time
• Opt-Out Options: You can disable AI code reviews in your settings (though this may limit some features)

Bias Mitigation Measures:

• Regular audits of AI outputs for fairness and accuracy
• Diverse training data for our internal recommendation models
• User feedback mechanisms to report biased or inappropriate AI responses
• Transparency reports published annually on AI performance and bias metrics

In addition to GDPR (EU/EEA) and CCPA (California), we comply with privacy laws in other jurisdictions:

This Privacy Policy complies with:

• GDPR (EU General Data Protection Regulation 2016/679) - For EU/EEA users
• UK GDPR (UK Data Protection Act 2018) - For UK users
• EU AI Act (Regulation 2024/1689) - AI transparency and accountability requirements
• CCPA/CPRA (California Consumer Privacy Act) - For California residents
• COPPA (Children's Online Privacy Protection Act) - For users under 13
• ePrivacy Directive (Cookie Law) - For EU/EEA users
• LGPD (Brazilian General Data Protection Law) - For Brazilian users
• PIPEDA (Canada Personal Information Protection) - For Canadian users
• Privacy Act 1988 (Australian Privacy Principles) - For Australian users

Lawful Basis for Processing (GDPR):

• Consent (Art. 6(1)(a)): Analytics, marketing communications, optional cookies
• Contract (Art. 6(1)(b)): Account creation, service delivery, payment processing
• Legal Obligation (Art. 6(1)(c)): Tax records, security monitoring, fraud prevention
• Legitimate Interests (Art. 6(1)(f)): Platform improvements, security, customer support