Privacy Policy
Last updated: October 9, 2026
Your privacy matters to us. This policy explains what personal data Chatfolio collects, why, how it is used and protected, and the rights you have. It applies to our website, our applications and any Chatfolio you create or interact with.
1. Who we are
Chatfolio is operated by Chatfolio, Dhaka, Bangladesh (“we”, “us”). For the personal data described in this policy we act as the data controller, except where noted in section 5.
Privacy questions and requests: privacy@chatfolio.net.
2. Information we collect
Information you give us
- Account data — name, email address and sign-in credentials (or the identifier returned by a third-party sign-in provider).
- Profile content — your CV/résumé, work history, skills, projects, availability and any other material you upload or type so that your Chatfolio can answer questions about you.
- Billing data — for paid plans, your plan, billing country and transaction references. Card or wallet details are handled by our payment processor; we do not store full payment card numbers.
- Communications — messages sent through our contact form, feedback widget or support email.
Information from visitors who chat with a Chatfolio
- The questions and messages a visitor (for example a recruiter) types into a Chatfolio, the AI replies, and any contact details the visitor chooses to share.
Information collected automatically
- Usage and device data — pages viewed, referring page, approximate location (derived from IP address), browser, device and operating system, and timestamps.
- Cookies and similar technologies — see section 8.
- Security logs — IP address and request metadata used to detect abuse.
We do not knowingly collect sensitive categories of data (such as health, religion or biometric data). Please do not include them in your profile content.
3. How and why we use information
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Provide the service: create your account, build and run your Chatfolio, answer visitor questions | Performance of a contract |
| Process payments, prevent fraud, keep records | Contract; legal obligation; legitimate interests |
| Secure the service, prevent abuse, debug and improve reliability | Legitimate interests |
| Measure site usage and improve the product (analytics) | Consent where required by law; otherwise legitimate interests |
| Respond to your messages and support requests | Legitimate interests; contract |
| Send service and billing notices | Contract; legitimate interests |
| Comply with law and enforce our terms | Legal obligation; legitimate interests |
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
4. AI and large language models (LLMs)
Chatfolio uses third-party large language model providers to turn your profile content into an AI assistant and to generate replies to visitors' questions. This is how we handle that data:
- What is sent. Your profile content, the visitor's question and the relevant conversation context are sent to the LLM provider solely to produce a response.
- No training on your data. We do not use your profile content or conversations to train or fine-tune general-purpose AI models, and we use providers and settings under which your inputs and outputs are not used to train their models.
- Your Chatfolio only. The “AI training” feature indexes your content so your Chatfolio can answer from it. That index is used only for your Chatfolio and is not shared with other users.
- Retention at providers. Providers may retain inputs briefly (typically for abuse monitoring) as set out in their agreements with us, after which they are deleted.
- Limits of AI. AI output can be inaccurate. Review what your Chatfolio says about you. Please avoid including information you do not want shared with visitors, because the assistant may repeat anything in your profile content.
- Automated decisions. We do not make decisions about you that produce legal or similarly significant effects solely through automated processing. Chatfolio does not score, rank or reject candidates.
6. International transfers
We and our providers may process data in countries other than your own, including countries that may not have equivalent data protection laws. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.
7. Data retention
- Account and profile content: kept while your account is active, then deleted or anonymised within 30 days of account deletion.
- Visitor chat history: kept while your account is active so you can review it, unless you delete it earlier.
- Billing records: kept as required by tax and accounting law.
- Security logs: kept for a limited period, typically up to 12 months.
- Backups: overwritten on a rolling schedule after deletion.
We may keep information longer where needed to resolve disputes, enforce our terms or comply with law.
9. How we protect your data
- Encryption in transit (HTTPS/TLS) and encryption at rest for stored data.
- Access controls, least-privilege access and authentication for staff and systems.
- Security headers including a strict Content Security Policy on this website.
- Vendor due diligence and data-processing agreements with providers.
- Logging, monitoring and a process for responding to security incidents.
No system is perfectly secure. If a breach affects your personal data, we will notify you and regulators as required by law, typically without undue delay and, where the GDPR applies, within 72 hours of becoming aware for regulators. To report a vulnerability, email privacy@chatfolio.net.
10. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy (including in a portable format);
- correct inaccurate or incomplete data;
- delete your data (“right to be forgotten”);
- restrict or object to certain processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- not be subject to solely automated decisions with significant effects;
- lodge a complaint with your local data protection authority.
California and other US states. You may request to know, delete, correct or obtain a copy of your personal information, and opt out of “sale” or “sharing” (we do neither). We will not discriminate against you for exercising these rights. You may use an authorised agent to submit requests.
To exercise a right, email privacy@chatfolio.net. We may need to verify your identity and will respond within the time required by law (generally 30–45 days). Most profile data can also be edited or deleted directly from your account.
11. Children
Chatfolio is intended for people aged 16 and over, and is not directed to children. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Third-party links
Our site may link to or embed third-party services (for example YouTube video, payment pages or support widgets). Their privacy practices are governed by their own policies, and we are not responsible for them.
13. Changes to this policy
We may update this policy. We will change the “Last updated” date and, for material changes, notify you by email or in the product before they take effect.
14. Contact us
Chatfolio, Dhaka, Bangladesh
Email: privacy@chatfolio.net