Draft. This page is waiting for legal review and some company details are still being filled in. The way the service handles your data, described here, is accurate today.

Privacy Policy

Version 2 November 2026

The short version

We collect what we need to run your account and show your portfolio. Nothing more.
We don't sell your data, and we don't show ads.
Visitors to your portfolio aren't tracked: no cookies, no profiles.
You can download everything or delete your account from Settings → Account at any time.

1. Who we are

Nipra Portfolio is run by [Registered company name], [Registered office address, India] ("we", "us"). For the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the personal data described here. Questions: [privacy@yourdomain].

2. What we collect, and why

Data	Why we need it
Email, username, password (stored only as a one-way hash)	To create your account, sign you in and send account emails.
Portfolio content and files you upload	To build and show your portfolio. Content you publish is public (or visible to anyone with your private link) because that is what you asked us to do.
Devices you sign in on: IP address, browser, sign-in and last-seen times	To keep your account secure and let you sign out other devices.
Security logs (sign-ins, password and username changes)	To detect and investigate misuse of your account.
What you agreed to, and when (including the IP address at the time)	To show we have your consent, as the DPDP Act requires.
Feedback and reports you send us	To answer you and improve the service.
Visits to your portfolio	To show you how many people visited, downloaded your resume or clicked your links. For each visit we keep the day, the site the visitor came from, their country and device type (phone, tablet or computer), and which site a clicked link goes to. These are kept for 7 days, then only daily totals remain. To tell new visitors from repeat ones we use a hash of IP and browser salted with the date, kept for at most a day. We never store IP addresses or who visited.

We process this data to provide the service you signed up for and on the basis of your consent, given when you create your account. Product news emails are optional and you can turn them off in Settings → Account.

3. Safety checks on published pages

When you publish, we check your page automatically for things like phishing links and pages posing as banks or well-known companies. Links on your page are sent to Google Safe Browsing to check them against its list of unsafe sites. If something looks wrong, a person on our team reviews the page before it goes live and we email you either way. When you choose a password, we check it against known data breaches using Have I Been Pwned: only the first five characters of its hash leave our servers, never the password.

We don't sell or rent your personal data. We use these service providers (Data Processors) to run the service, each only for the purpose listed:

Railway: hosting for our servers and database.
Cloudflare: file storage (R2), content delivery, and bot protection (Turnstile) on the sign-up and report forms.
Resend: sending account emails.
Google Safe Browsing: checking links on published pages.
Razorpay: processing payments, once paid plans launch. We never see or store your card or UPI details.

Some of these providers process data outside India. We only use providers that protect it to the standard the DPDP Act requires. We will disclose data to authorities only when the law requires it.

5. How long we keep it

Your account and content: until you delete your account.
After you ask to delete your account, it goes offline straight away. We erase it 14 days later; signing in before then cancels the deletion.
Your old username is held for 90 days after erasure so nobody can impersonate you with it. We keep only the name itself.
Data download files: deleted 24 hours after they are ready.
Database backups: kept for 30 days, then overwritten. Erased accounts disappear from backups when that time is up.
Security logs: up to 2 years, to investigate misuse.

6. Your rights

Under the DPDP Act you have the right to:

Access a summary of your data and how we use it. Download your data any time.
Correct and update it, which you can do in the builder and settings.
Erase it by deleting your account in Settings → Account.
Withdraw consent. This is as easy as giving it: delete your account, or turn off optional emails. Withdrawing doesn't affect what we did before.
Nominate someone to exercise these rights if you die or become unable to. Email us with their details.
Complain to our Grievance Officer (below), and then to the Data Protection Board of India if you aren't satisfied.

We answer requests within 30 days.

7. Security

Passwords are hashed with Argon2, connections are encrypted, two-factor sign-in is available, and uploaded files are scanned and re-encoded before anyone sees them. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

8. Age

You must be 18 or older to use Nipra Portfolio. We don't knowingly collect data from children; if we learn an account belongs to someone under 18, we delete it.

9. Cookies

We use one essential cookie to keep you signed in. See the Cookie Notice.

10. Changes

If we change this policy in a way that affects you, we will ask you to accept the new version the next time you sign in. The version date is at the top of this page.

11. Grievance Officer

[Grievance Officer name]
[Registered company name], [Registered office address, India]
[grievance@yourdomain]

We acknowledge complaints within 24 hours and resolve them within 15 days.