Privacy Policy

Last updated: April 2026

PortalSync Inc. ("PortalSync", "we", "us", or "our") operates the PortalSync platform, a document collection tool for consultants and their clients. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your data.

By using PortalSync you agree to the collection and use of information as described here.

1. Information We Collect

Account information — When you register as a consultant we collect your name, email address, and password (stored as a bcrypt hash). If you sign up via Google OAuth we receive your name and email from Google.

Portal and client data — Consultants create portals and invite clients. We store portal names, task descriptions, and client email addresses as entered by the consultant.

Uploaded files — Files submitted by clients through a portal are stored in AWS S3. File metadata (name, size, upload timestamp, uploader identifier) is stored in our database.

Usage data — We collect standard server logs (IP address, browser user-agent, pages visited, timestamps) for security, debugging, and product improvement purposes.

Cookies and session tokens — We use session cookies managed by Auth.js to keep you signed in. Password-protected portals set a short-lived cookie to remember portal access.

2. How We Use Your Information

Provide the service — authenticate users, create portals, notify clients, store and serve uploaded files.
Send transactional emails — portal invitations, task completion notifications, and account-related messages.
Improve the product — aggregate usage analytics to understand how features are used.
Security and compliance — detect abuse, investigate incidents, and meet legal obligations.

We do not sell your personal data to third parties.

3. Data Sharing

| Recipient | Purpose | |-----------|---------| | AWS (S3) | File storage | | MongoDB Atlas | Database hosting | | Google (OAuth) | Optional sign-in provider | | Email provider | Transactional email delivery |

Each sub-processor is bound by a data processing agreement and processes data only as instructed by PortalSync.

4. Data Retention

Active accounts — data is retained for the lifetime of the account.
Deleted accounts — personal data is purged within 30 days of account deletion.
Uploaded files — files are removed from S3 when the portal is deleted or the consultant explicitly removes them.
Server logs — retained for 90 days.

5. Your Rights

Depending on your jurisdiction you may have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Erasure — request deletion of your account and associated data.
Portability — receive your data in a machine-readable format.
Object — opt out of certain processing activities.

To exercise any of these rights, email us at privacy@portalsync.io.

6. Security

We use HTTPS for all data in transit, bcrypt for password hashing, and AWS S3 server-side encryption for stored files. Access to production infrastructure is restricted to authorized personnel.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using industry-standard practices.

7. Children's Privacy

PortalSync is intended for professional use. We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected such data, please contact us immediately.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of PortalSync after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have any questions about this Privacy Policy, please contact:

PortalSync Inc. Email: [EMAIL_ADDRESS]