Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Full name, email address, username, and password. We never store the password itself, only a bcrypt hash of it: a one-way code that can check a password but can't be turned back into it. If you sign in with Google, you have no ARTdeck password.
• Profile Information: Bio, avatar/profile picture, contact details, social media links
• Portfolio Content: Projects, experience, education, skills, images, and other content you create
• Subscription Information: Billing details, payment information (processed by Stripe), subscription tier
• Two-Step Verification: If you turn it on, we store the secret key your authenticator app uses and your backup codes. Both are encrypted before they are stored.
• Passkeys: If you add a passkey, we store its public key, the name you give it, and technical details your device reports, such as whether the passkey syncs between your devices. The private key never leaves your device.
• API Keys: If you create an API key (currently only ARTdeck administrators can), we store its name, its permissions, its first few characters and when it was last used. We store a one-way hash of the key, never the key itself.
• Suggestions: Ideas you post on the suggestions board, any images you attach, and your votes

1.2 Automatically Collected Information

• Session Data: When you sign in, we create a session that keeps you signed in. It may record the IP address and browser (user agent) you signed in from, and a session cookie (HTTP-only, secure) links your browser to it.
• IP Address for Security: We use your IP address to count sign-in attempts and other requests, so we can block abuse (rate limiting).
• Technical Data: Error logs, performance metrics, and bug reports you choose to send from the dashboard

Section 7 says how long each of these is kept.

1.3 Visit Statistics (Umami)

We count page views across ARTdeck, including public portfolio and links pages, with Umami, an analytics tool we run ourselves on Railway. For each page view it records which page was viewed and its title, the referring page, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city). The location is worked out from your IP address, which Umami does not store. Umami sets no cookies. We use these statistics to see how ARTdeck is used, on the basis of our legitimate interest. No automatic deletion is set up, so they are kept until we delete them.

2. Visitors to Portfolio Pages

You don't need an ARTdeck account to look at a portfolio. When you open a portfolio or links page hosted on ARTdeck, we record the visit for the portfolio's owner. For each visit we store:

• Which page you viewed (the portfolio or its links page)
• The date and time of the visit
• The full address of the page that linked you there (the referrer), if your browser sends it

We don't store your IP address or browser details with the visit, we don't set cookies on portfolio pages, and we don't try to work out who you are. Like any website, the services that deliver the page see your IP address while they do so (see section 5.3).

Separately, our Umami statistics count every page view on ARTdeck, portfolio pages included. Section 1.3 says what they record.

Why: so portfolio owners can see how often their pages are viewed and which sites send visitors there. Owners whose plan includes analytics see view totals, a 30-day chart, the top referring sites, and the time and referrer of the latest visit. ARTdeck's administrators see the same kind of totals across all portfolios.

Legal basis: legitimate interest (GDPR Article 6(1)(f)). Portfolio owners and ARTdeck have a legitimate interest in knowing how often a portfolio is viewed and where its visitors come from. We keep the data small so it doesn't outweigh your privacy.

How long we keep it: visit records are deleted 12 months after the visit. Each portfolio also has a running total of views, a single number with no details about any visitor, which is kept while the portfolio exists.

Because we don't store anything that identifies you, we usually can't find your own visits to show you or delete them. You can still contact us with any question about them.

3. How We Use Your Information

We use your information to:

• Provide and maintain the portfolio builder service
• Create and host your public portfolio website
• Process your subscription and billing
• Send important account notifications and service updates
• Provide customer support and respond to inquiries
• Prevent fraud, abuse, and ensure platform security
• Comply with legal obligations
• Improve our services based on usage patterns (anonymized)

4. Legal Basis for Processing (GDPR Article 6)

Under GDPR Article 6, we process your personal data based on:

• Contract Performance: Account services, portfolio hosting, billing, and subscription management
• Legal Obligations: Tax records, billing documentation, and regulatory compliance (Bokføringsloven)
• Legitimate Interests: Security, fraud prevention, service improvement, and visit statistics (see sections 1.3 and 2)
• Consent: Optional Google OAuth and marketing communications (you can withdraw consent anytime)

5. How We Share Your Information

5.1 Public Information

Your published portfolio (username, bio, projects, social links) is publicly accessible by design. You control what content to publish and can unpublish at any time.

Search Engine Indexing: Public portfolio pages may be indexed and cached by search engines (Google, Bing, etc.) and third-party archives. When you unpublish or delete content, it is immediately removed from our platform, but de-indexing by search engines can take days to weeks.

5.2 Other ARTdeck Users

If you post on the suggestions board, other signed-in ARTdeck users can see your suggestion together with your name (or your username, if you haven't added a name) and your profile picture. The suggestions board is not public.

5.3 Service Providers

We use these companies to run ARTdeck. The table shows what each one does, where it processes data, and the safeguard for any transfer out of the EEA (European Economic Area).

5.4 Legal Requirements

We may disclose your information if required by law, subpoena, or to protect our rights and safety.

6. Data Security

We implement security measures to protect your data:

• Encrypted data transmission (HTTPS/TLS) and storage
• Secure password hashing (bcrypt, cost factor 12)
• Access controls so users can only access their own data
• Rate limiting to prevent abuse
• Regular security updates and vulnerability monitoring
• Restricted access to personal data (admin-only with audit logs)

7. Data Retention

We retain your personal information as long as your account is active or as needed to provide services. Some data has a shorter, fixed period:

• Sign-in Sessions: A session, with the IP address and browser details it may record, is kept until you sign out or it expires. It expires 7 days after it was last renewed (we renew it at most once a day while you use ARTdeck), or after 1 day if you signed in without "Remember me". Expired sessions are deleted within a day.
• Portfolio Visit Records: Deleted 12 months after the visit (see section 2).
• Rate-Limit Counters: The counters keyed by IP address expire within an hour.
• Logs: Our application logs are set up to replace IP addresses, email addresses and Stripe customer IDs with "[REDACTED]" before they are written. The logs are stored by our hosting provider, Railway, for a limited period.
• Error and Bug Reports: Kept by Sentry for up to 30 days.
• Umami Visit Statistics: No automatic deletion is set up, so they are kept until we delete them (see section 1.3).

When you delete your account:

• Immediate Deletion: Your email, password hash, profile content, portfolio data, and images are immediately deleted from active systems
• Cached Images: Resized copies of your images can stay for up to a day on our servers and in the browsers of people who viewed them
• Username Reservation: Your username is retained for 30 days to prevent account hijacking or impersonation. After 30 days, the username becomes available for registration
• Backups: Deleted data in automated backups may persist up to 90 days before being permanently purged
• Billing Records: If you had a paid subscription, billing records, invoices, and tax documentation will be retained for 5 years as required by Norwegian Bokføringsloven (Bookkeeping Act). This includes only transaction details, amounts, and dates, not your portfolio content

8. Your Privacy Rights (GDPR Compliance)

If you are in the European Economic Area (EEA), UK, or other regions with similar privacy laws, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to certain data processing
• Right to Restrict Processing: Limit how we use your data
• Right to Withdraw Consent: Withdraw consent for data processing at any time

To exercise these rights, please contact us at artdeck@bizziprops.no. We will respond to your request within one month. For complex requests, this may be extended by up to two additional months, and we will inform you of any such extension within the initial month.

9. Cookies and Tracking

We use only essential cookies, plus a few items in your browser's storage that remember choices you made, such as light or dark mode:

• Authentication Cookies: HTTP-only, secure cookies set by our authentication system to keep you signed in and to complete Google sign-in, two-step verification and passkey sign-in
• No Tracking Cookies: We do not use advertising or analytics cookies. Umami (section 1.3) sets no cookies.

Our Cookie Policy lists every cookie and storage item, what it does and how long it lasts.

10. Children's Privacy

Our service is not intended for children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

11. International Data Transfers

Our database and uploaded files are stored in the EU. Some of our service providers are based in the USA or handle data in other countries outside the EEA. The table in section 5.3 shows where each one processes data and the safeguard used for transfers out of the EEA. Data is also encrypted in transit and at rest.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on this page
• Updating the "Last Updated" date
• Sending you an email notification for material changes

Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Privacy Contact: artdeck@bizziprops.no

For Norwegian Residents: You have the right to lodge a complaint with Datatilsynet (Norwegian Data Protection Authority) at datatilsynet.no or by mail to Postboks 458 Sentrum, 0105 Oslo, Norway.

For Other EEA Residents: You may lodge a complaint with your local data protection authority if you believe we have not adequately addressed your concerns.