Version 1.2.0 — Effective date: 19 August 2026
What’s new in this version
- Cloudflare Turnstile is listed as a subprocessor for bot protection on sign-in and sign-up when enabled.
- Describes bot-protection data, short-lived challenge tokens, and related international-transfer notes.
- Removes the former optional IP-reputation security provider wording.
- Cookie section updated to mention Turnstile challenge cookies when bot protection is enabled.
1. Who We Are
This web application is operated by Loading..., Loading... (Loading...). Contact: Loading.... Data Protection Officer: dpo@portfoliorebels.com.
2. Scope
This Privacy Policy applies to registered users aged 18 and over. We process personal data in accordance with the EU General Data Protection Regulation (GDPR). Our primary establishment is in Sweden.
3. Data We Collect and Legal Bases
- Account data (name, email, profile, locations): contract (Art. 6(1)(b) GDPR). The location you provide at sign-up also sets your assumed country for tax purposes, which is compared against the country reported by our payment processor on purchases to detect input errors or misuse; legal obligation and legitimate interests (Art. 6(1)(c) and (f)).
- Authentication data (passkeys, session tokens, IP address): contract and security (Art. 6(1)(b) and (f)).
- Bot-protection data (when Cloudflare Turnstile is enabled on sign-in or sign-up): challenge tokens and related technical data processed by Cloudflare to distinguish humans from automated abuse; legitimate interests in securing the service (Art. 6(1)(f)).
- Payment metadata via Stripe: contract (Art. 6(1)(b)); card data is processed by Stripe.
- Usage and content (portfolios, projects, messages): contract (Art. 6(1)(b)).
- Consent records (legal document version, acceptance date, IP): legal obligation and contract (Art. 6(1)(b) and (c)).
4. Subprocessors
- Google Cloud Platform — hosting (EU regions).
- MongoDB Atlas — database (EU regions).
- Stripe — payments.
- LocationIQ — geocoding and location search.
- Ahasend — transactional email.
- Cloudflare — Turnstile bot protection on authentication entry points when enabled. Processing may involve Cloudflare’s global network under Cloudflare’s data processing terms and appropriate transfer safeguards.
5. Retention
We retain personal data while your account is active. Accounts inactive for 730 days may be deleted after reminder emails. You may export or delete your account in Account settings. Turnstile challenge tokens are short-lived and used only to validate the request; we do not retain them as part of your account profile.
6. International Transfers
We store and process account and application data within the EU/EEA unless otherwise stated for subprocessors above. Where Cloudflare Turnstile processes data outside the EU/EEA, transfers rely on Cloudflare’s applicable transfer mechanisms (such as Standard Contractual Clauses) and security measures.
7. Your Rights
You have the right to access, rectify, erase, restrict, and port your data, and to object where applicable. Export and deletion are available in your account. You may lodge a complaint with IMY (Integritetsskyddsmyndigheten), Sweden.
8. Cookies
We use essential authentication cookies and, when Turnstile is enabled, cookies or similar technologies required for the bot-protection challenge. See our Cookie Policy for details.