Privacy Policy

1. Information we collect

• Account information: your name, email address, and password (stored only in hashed form). If you sign in with Google, we receive the name, email address, and profile picture associated with your Google account.
• Profile information: anything you choose to add, such as your bio, location, role, skills, social links, portfolio images, and profile and cover photos.
• Content you create: projects, presentations, forms, contracts, boards, moodboards, messages, posts, and comments — along with files you upload to them.
• Information from your clients: when you send a form, a presentation, or a contract, the people you send it to may submit answers, comments, or a signature. You choose what to ask them; we store it on your behalf.
• Usage and technical information: IP address, browser and device type, pages visited, and timestamps. For electronic signatures we also record the date, time, IP address, and browser of each signature, because that record is what makes the signature verifiable.
• Payment information: subscription payments are processed by our payment provider. We receive the plan, the status, and the last digits of the card. We never receive or store full card numbers.

2. How we use your information

• to provide, operate, and maintain the Service;
• to create and secure your account, and to authenticate you;
• to deliver what you asked us to deliver — sending a form to your client, publishing a presentation, emailing a contract for signature;
• to send you service messages: payment confirmations, signature requests and reminders, password resets, and replies from support;
• to send you product news and tips, which you can stop at any time using the unsubscribe link in any such email;
• to detect, investigate, and prevent fraud and abuse;
• to comply with legal obligations.

We do not sell your personal information, and we do not use your content to train machine learning models.

3. How we share information

We share personal information only with service providers that make the Service work, and only under confidentiality obligations:

• Supabase — database, authentication, and file storage;
• Vercel — application hosting;
• Resend — delivery of transactional email;
• Pagar.me — subscription payment processing;
• Google — only when you choose to sign in with Google.

We may also disclose information when required by law, or to protect the rights, safety, and property of Tifólio or others.

Your public profile — your name, role, bio, portfolio work, and links — is visible to other users and to the public. Anything you publish there, you are publishing.

4. Your privacy rights

Several U.S. states — including California, Virginia, Colorado, Connecticut, and Texas — give residents rights over their personal information. Rather than granting these rights only where a statute currently requires it, we extend them to everyone who uses the Service, regardless of where you live. You may:

• know what personal information we hold about you, and access it;
• correct information that is inaccurate;
• delete your account and the personal information in it;
• obtain a copy of your information in a portable format;
• opt out of marketing email at any time;
• be free from retaliation — we will not degrade the Service or charge you a different price for exercising any of these rights.

You can delete your account yourself, at any time, from Settings. To exercise any other right, write to contato@tifolio.com.br. We respond within 45 days, and will tell you if we need longer. We may ask you to verify your identity before acting, so that nobody can use these rights to reach someone else's data.

You may authorize an agent to make a request on your behalf; we will ask for proof of that authorization.

5. Notice for California residents

Under the California Consumer Privacy Act, as amended ("CCPA/CPRA"), we disclose the following about the preceding twelve months.

We have collected the categories of personal information listed in section 1, which correspond to these statutory categories: identifiers; personal information under Cal. Civ. Code § 1798.80; commercial information; internet or other electronic network activity; geolocation data inferred from IP address; and audio, electronic, or visual information contained in files you upload. We collect it from you directly and from your use of the Service, and we use it for the purposes in section 2. We disclose it to the service providers in section 3 for business purposes.

We have not sold or shared personal information as those terms are defined by the CCPA/CPRA, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link; if that ever changes, this Policy will change with it, before the practice starts.

We do not use or disclose sensitive personal information for purposes that would require offering you a right to limit it.

6. Where your information is processed

Tifólio is a Brazilian company. Your personal information is stored and processed on infrastructure that is located outside the United States, including in Brazil, and it is accessible to our team in Brazil.

Privacy laws in Brazil are not identical to those in the United States. By using the Service, you understand that your information will be transferred out of the country where you live. We apply the same protections described in section 7 wherever your information is held.

7. Security

We apply technical and organizational measures to protect your information, including row-level access control in the database, encryption in transit, hashed passwords, isolation of privileged credentials from anything that reaches the browser, signed and expiring links for shared documents, and restrictions on file uploads.

No system is completely secure, and we will not claim otherwise. We work continuously to reduce risk, and if a breach affects your personal information we will notify you as required by applicable law.

8. How long we keep information

We keep your information for as long as your account is active. When you delete your account, we delete your personal information and your content, except where we must keep records to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Signed contracts are an exception, and deliberately so. A signature record that disappears is a signature that cannot be proven. We retain the signed document and its verification record for as long as it may be needed as evidence by any party to it — including the people who signed but never had a Tifólio account.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to contato@tifolio.com.br and we will delete it.

10. Cookies

We use cookies that are necessary for the Service to work — keeping you signed in, remembering your language, and holding your access to a password-protected document. We also use analytics cookies to understand how the Service is used in aggregate.

You can block or delete cookies in your browser settings. Blocking the necessary ones will stop you from staying signed in.

11. Changes to this Policy

We may update this Policy. When the change is material, we will notify you by email or in the Service before it takes effect. The date at the top always reflects the current version.

12. Contact

For anything about this Policy or your personal information, write to contato@tifolio.com.br.

Tifólio Tecnologia — CNPJ 35.014.292/0001-04
Rua José Izidoro Biazzetto, 1210 — Curitiba, PR, Brasil