Last updated: July 2026
This policy explains what personal data Proofolio collects, why we collect it, how we use it, and your rights under UK GDPR. We have written it in plain English deliberately — if anything is unclear, contact us and we will explain it.
Proofolio is operated as a sole trader business based in the United Kingdom. Our ICO registration number is [ICO NUMBER — ADD WHEN REGISTERED]. You can contact us at privacy@proofolio.pro for any data-related queries.
We collect the minimum data needed to provide the service. Here is what we collect and why:
When you use Proofolio, we collect your WhatsApp phone number, business name, trade type, and service area. We use this to create and maintain your portfolio page and to deliver your marketing content back to you via WhatsApp. Legal basis: performance of a contract.
You send us photos of your work via WhatsApp. We process these images to generate your marketing cards, captions, and video. EXIF data (including GPS location) is stripped from all images on receipt before any processing. Your original photos are stored securely to power your portfolio page. Legal basis: performance of a contract.
When a visitor submits an enquiry through your portfolio page, they provide their name, phone number, location, and job description. This data is captured by Proofolio and delivered directly to you as the contractor. We act as a data processor for this data on your behalf — you are the data controller for enquiries about your business. Legal basis: legitimate interests (connecting customers with service providers).
When a customer submits a review via a unique review link, they provide their name and review content. Only their first name and last initial are ever displayed publicly on the portfolio page. Full names are stored securely and never shared publicly. Legal basis: legitimate interests (providing review functionality).
We do not store payment card details. Payment processing is handled by our payment provider and we only receive confirmation of payment status. Legal basis: performance of a contract.
Your data is stored in Supabase, a cloud database service with servers located in the European Union. Supabase acts as a data processor on our behalf under a Data Processing Agreement. All data is encrypted in transit and at rest.
WhatsApp messages are delivered via Twilio, an official WhatsApp Business Solution Provider. Twilio acts as a data processor on our behalf. Message content passes through Twilio infrastructure in accordance with their data processing terms. Twilio is SOC 2 Type II certified.
Contractor account data and portfolio pages are retained for as long as your account exists. If you cancel your subscription, your portfolio page remains live and your data is retained unless you specifically request deletion.
Customer enquiry data is retained for 12 months from the date of submission, after which it is automatically deleted.
Review data is retained indefinitely. If a contractor removes a review from their portfolio page, the review stops being displayed publicly but the record itself is kept — we are required to keep an auditable trail of why any review was removed and who requested it.
If you ask us to erase a review you submitted, we remove everything in it that identifies you — your name and the text you wrote — and keep only the non-identifying remainder, such as the star rating, the dates, and which job it related to. Once your name and words are gone, what is left is no longer personal data about you, so your erasure request is met in full while the audit record survives. We separately log that an erasure request was received and actioned, recording only the date and the review reference — never your name or contact details.
When an account is closed, the contractor's own content — job photos, generated cards, videos, captions and enquiry records — is deleted outright, including the image and video files themselves. Customer reviews left for that business are not deleted. They are anonymized the same way an individual erasure request anonymizes one: the reviewer's name and words are removed, and the rating, the dates, which job it related to, and the record of any removal request are kept. We keep that remainder because a business closing its account must not be able to erase the record of why a review was removed. Once the identifying detail is gone it is no longer personal data about anyone.
Two qualifications we would rather state than leave implied. Deleted data survives in our encrypted nightly database backups for up to 14 days, until those backups rotate out on their normal schedule; we do not restore individual records from them. Server logs may also contain WhatsApp numbers for a period after deletion.
Job photos are retained for as long as your account is active. You can request deletion of specific job photos at any time by contacting us via WhatsApp or email.
We do not sell your data. We do not share your data with advertisers. We share data only with the following processors who help us deliver the service:
Proofolio uses only essential cookies — small files placed on your device that are strictly necessary for the website to function. We do not use advertising cookies, tracking cookies, or analytics cookies.
Essential cookies we set:
Essential cookies do not require your consent under UK GDPR. If we introduce analytics or other non-essential cookies in future, we will update this policy and add a cookie consent mechanism.
You have the following rights regarding your personal data:
To exercise any of these rights, contact us at privacy@proofolio.pro. We will respond within 30 days. If you are unhappy with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
Proofolio delivers its service via WhatsApp. By using Proofolio, you interact with WhatsApp which is operated by Meta Platforms Ireland Limited. WhatsApp's own privacy policy applies to your use of the WhatsApp application and governs how Meta handles your data within WhatsApp. Proofolio is not responsible for Meta's data practices. You can review WhatsApp's privacy policy at whatsapp.com/legal/privacy-policy.
We will update this policy when our data practices change. If changes materially affect your rights, we will notify you via WhatsApp before they take effect. The date at the top of this page always shows when it was last updated.
For any privacy-related questions, data requests, or complaints:
Email: privacy@proofolio.pro
ICO registration: [ICO NUMBER — ADD WHEN REGISTERED]