Privacy policy

Account data

E-mail, name, language, password (stored only as an Argon2 hash), Google, GitHub or LinkedIn sign-in identifiers if you use them, date you accepted the terms.

Legal basis: performance of the contract (providing the service).

Your page content

What you type or import: occupation, city, texts, services, projects, links, FAQ, photos and images. Once published, this content is public; that is its purpose.

Imports: public GitHub repositories, the LinkedIn export and the PDF resume you provide are read to prepare a draft; only that draft is kept, and it is never published without your review.

Messages from your visitors

The contact form on your page sends the visitor’s name, e-mail and message to the page owner. They are kept in the owner’s dashboard.

Visit statistics

For each visit to a published page: the page viewed, the referring site (domain name only), a source category (search engine, AI engine, social network, direct), the country (2-letter code) and the device type (mobile or desktop).

No IP address, no cookie, no visitor identifier. Legal basis: legitimate interest (showing owners their page’s audience).

Visibility score

To measure whether your page is cited, your name, occupation, city and services are sent, as questions, to the enabled engines: OpenAI (ChatGPT), Perplexity, Google (Gemini), Anthropic (Claude) and Brave Search. Their answers are analysed and kept with your score history.

The free test on the home page sends the name and occupation you enter to the same engines; the result is kept for 24 hours to avoid repeating the same request. It may be protected against bots by Cloudflare Turnstile.

Payments

Card payments are processed by Stripe and Mobile Money payments by Flutterwave. Portrait never receives or stores your card or payment phone numbers; we keep the plan, amount, currency, status and date of each payment.

Legal basis: performance of the contract and our accounting obligations.

Recipients and processors

Vercel (website hosting), our server host (API and database), our file storage, our e-mail delivery service, Stripe and Flutterwave (payments), OpenAI, Perplexity, Google, Anthropic and Brave (visibility score), Cloudflare (Turnstile), and search engines that receive the address of your published pages through IndexNow.

Some of these providers are located outside Rwanda and the European Union, notably in the United States.

Retention

For as long as your account exists. If you ask for deletion, your pages go offline at once and everything is permanently erased 30 days later (files included). Payment records required for accounting are kept for the legal period.

Your rights

Access, rectification, erasure, portability, objection and restriction. From your dashboard you can export all your data as JSON and delete your account.

You may also contact the competent data protection authority: in Rwanda, the National Cyber Security Authority (NCSA), under Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy; in the European Union, your country’s authority (in France, the CNIL).

Security

Encrypted connections (HTTPS), hashed passwords, revocable sessions, cross-site request and rate-limit protection, strict isolation of each account’s data.