Privacy Policy

Mahayat ("we", "our", or "us") operates Creative Portfolio at creativeportfolio.online. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

This policy is governed by the General Data Protection Regulation (GDPR — EU 2016/679), the Lei Geral de Proteção de Dados (LGPD — Lei 13.709/2018, Brazil), the UK GDPR, and other applicable data protection laws depending on your location. Where these laws apply to you, you have specific rights described in Section 8.

By using Creative Portfolio, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

We collect the following categories of personal data:

We use your data to:

• Create and manage your account
• Provide, operate, and improve the platform
• Process payments and manage subscriptions
• Send transactional emails (account creation, password reset)
• Respond to support requests
• Analyse usage to improve user experience
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for automated profiling or decision-making that produces legal effects.

We process your personal data under the following legal bases, in accordance with the GDPR (Art. 6), UK GDPR, and LGPD (Art. 7):

• Contract (GDPR Art. 6(1)(b) / LGPD Art. 7(V)): to fulfil our obligations when you create an account or subscribe to a plan
• Legitimate interest (GDPR Art. 6(1)(f) / LGPD Art. 7(IX)): for platform security, portfolio analytics (country and device type only), and service improvement
• Consent (GDPR Art. 6(1)(a) / LGPD Art. 7(I)): for cookies and optional communications — you may withdraw at any time by contacting us
• Legal obligation (GDPR Art. 6(1)(c) / LGPD Art. 7(II)): to comply with applicable laws including tax and financial record-keeping

We use trusted third-party providers to operate the platform. They process your data only as needed to provide their services and are bound by their own privacy policies:

• AWS S3 / Cloudflare R2 — cloud file storage
• Lemon Squeezy — payment processing and subscription management
• Google OAuth — optional sign-in with Google
• Cloudinary / Cloudflare R2 — image CDN and delivery

We do not share your data with any third party for advertising purposes.

We retain your personal data for as long as your account is active or as necessary to provide the service. After account deletion, we permanently erase your account data within 30 days, unless a longer retention period is required by law (e.g. financial records — up to 7 years depending on jurisdiction).

Portfolio analytics (visit counts, country, and device type) are retained for up to 2 years from the date of collection, after which they are permanently deleted.

Discovery proposals (name and email of senders) are retained for up to 2 years or until the associated portfolio is deleted, whichever occurs first.

Anonymised and aggregated data (which cannot identify you) may be retained indefinitely for analytical purposes.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/HTTPS), secure password hashing (bcrypt), and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority (ANPD in Brazil; the applicable EU/UK data protection authority for European users) within 72 hours of becoming aware of it, as required by the GDPR (Art. 33) and LGPD (Art. 48 / ANPD Resolução CD/ANPD nº 2/2022). Where required, we will also notify affected users without undue delay.

If you suspect a security breach involving your account, contact us immediately at support@creativeportfolio.online.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data ("right to be forgotten")
• Restriction: limit how we process your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: at any time, where processing is consent-based

To exercise any of these rights, contact us at info@creativeportfolio.online. We will respond within 30 days.

We use cookies and similar tracking technologies to operate the platform. For full details on what cookies we use and how to manage them, please read our Cookie Policy.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you by email or by a prominent notice on the platform. Continued use of the service after changes constitutes your acceptance of the updated policy.

In accordance with the LGPD (Art. 41) and GDPR (Art. 37), Mahayat has designated a Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais) responsible for overseeing compliance with applicable data protection laws and serving as the point of contact for data subjects and supervisory authorities.

To contact our DPO / Encarregado:
privacy@creativeportfolio.online

For any privacy-related questions or requests, please contact us:

Mahayat
General: info@creativeportfolio.online
Support: support@creativeportfolio.online
DPO / Encarregado: privacy@creativeportfolio.online