Privacy policy

Who we are

Vitrine ("we") operates Vitrine, a service for creating and publishing professional portfolios. Contact us about privacy at support@example.com.

What we collect

• Account details: your name, email address and, if you set one, a password (stored only as a one-way Argon2 hash). If you sign in with Google we receive your name, email address and Google account identifier.
• Portfolio content: everything you add to your profile — such as experience, projects, photos and contact details. Content is private until you publish it; published content is public unless you make the page unlisted.
• Files you upload: images and documents for your portfolio, and payment receipts for bank transfers (receipts are private and visible only to you and our billing staff).
• Billing records: orders, invoices and payment status. Card payments are processed by our payment provider; we never receive or store full card numbers.
• Security logs: sign-in events and administrative actions, with IP addresses stored as salted hashes.

Analytics on published portfolios

We count page views, referring sites, device types and link clicks so owners can see how their portfolio performs. We do not use advertising trackers or third-party analytics cookies. Visitors are counted with a daily-rotating salted hash that cannot be reversed into an IP address and cannot link visits across days. Browsers that send Do Not Track or Global Privacy Control signals are not counted. Analytics events are deleted after 400 days.

Cookies

We use only essential cookies: a session cookie to keep you signed in, and short-lived cookies that protect sign-in and two-factor flows. We do not use advertising cookies.

Optional AI writing assistance

If you choose to use the writing assistant, the text you submit is sent to our AI provider to generate suggestions. It is used only to answer your request. You can use every other feature without it.

Emails

We send account, security and billing emails. Renewal reminders and other notifications can be switched off in your settings where they are not essential to your account.

How long we keep data

• Your account and content: until you delete your account. Deletion takes effect after a 14-day grace period in which you can cancel.
• Invoices and payment records: retained as required for accounting and tax purposes, with personal details minimised once the account is deleted.
• Delivered email bodies: removed after sending; delivery records after 180 days.

Your rights

You can view and correct your information in the dashboard, download a copy of everything you have entered (Settings → Export data), and delete your account at any time. To exercise other rights, contact support@example.com.

Security

Passwords are hashed with Argon2id, two-factor authentication is available, sensitive secrets are encrypted at rest, and access by our staff is role-restricted and logged.

Changes

We will post any changes to this policy on this page and, for significant changes, notify account holders by email.