Privacy Policy

The controller of your personal data is [TO FILL: legal name of the operator] ([TO FILL: NIF/CIF]), [TO FILL: registered address], Madrid, Spain. For anything about your data, write to [TO FILL: privacy email, e.g. privacy@folio.app].

We don't sell your data, show ads, or use it for marketing without asking you first.

When you upload a CV, its text is sent to Google's Gemini service to pick out your fields and skills. When a client describes a project idea, that text is sent to Gemini to draft a brief. Google processes this for us as a service provider and doesn't use it to train its models. The results are suggestions shown to you; no decision about you is made by AI alone. You can object to the CV analysis by not uploading a CV or by asking us to delete it.

We check every company that wants to post projects, in two stages. This protects students from fake or fraudulent offers and makes sure we deal with someone who can act for the company.

A student startup (an IE student's own startup that isn't registered yet) has no CIF or registry extract. Instead we ask for the founder's IE email, which we write to once to confirm the founder is an IE student, and before the first payment only the founder's ID. The IE email isn't shown to students or anyone else, and is kept and deleted like the documents below.

• Legal basis: our legitimate interest in keeping the marketplace safe from fraud (GDPR art. 6.1.f), and taking the steps you ask for before entering into our contract (art. 6.1.b).
• Who sees them: only you and Folio's review team. Documents are stored in a private storage area that other users, including students, can't open. Students only see your company name, logo, description and the verified badge.
• What we don't do: we don't share them with anyone else, use them for marketing, or make the verification decision automatically. A person reviews every company.
• Where: with our database and storage provider, Supabase ([TO FILL: Supabase region, e.g. EU (Frankfurt)]), encrypted in transit and at rest.
• How long: while your company account is open, so we can re-check details if something changes or a dispute comes up. When you close the account, they're deleted within 30 days, unless we need them to deal with a legal claim already under way.
• Your control: you can replace or remove the documents yourself until your first payment. After that, ask us at [TO FILL: privacy email, e.g. privacy@folio.app] to see, correct or delete them.
• Progress records: we note when each verification step is completed (for example when the details were filled in or the documents uploaded), to see where companies get stuck and make the process easier.

Other Folio users

• Clients see the profile of students who apply to their projects, including the CV and course certificates, through a private link that expires after an hour.
• Students see client profiles and the projects they post.
• The two sides of a project see their messages, files, deliveries, the brief and the credential.

Anyone with a credential link

Each credential has a verification page that anyone with the link can open. It shows the student's name, the project, the client, the rating and review, and the signatures. The link is long and random, so it is only found if someone shares it.

Service providers

These companies process data for us under contract, only on our instructions:

Independent services

PayPal handles payments and payouts as its own controller, under its own privacy statement. LinkedIn and GitHub do the same when you sign in or connect your account.

When the law requires it

We share data with authorities, courts or advisers when the law requires it, or to protect our users or Folio.

Some providers above are based in the United States or may process data there. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. Ask us for a copy of the safeguards.

• Your account and profile: while your account is open. When you close it, we delete it within 30 days (backups roll over within a further 30 days).
• Company verification documents: while the company account is open, then deleted within 30 days of closing it (see Company verification).
• Credentials: deleted with the student's account, after which the verification link stops working.
• Projects, messages and files you share with another user: kept while either side's account is open, so the other side keeps their record, then deleted.
• Payment records: kept for 6 years, as Spanish commercial and tax law requires.
• Technical logs: up to 90 days.

You can ask us to:

• give you a copy of your data, or send it to you in a portable format;
• correct it (you can also edit most of it on your profile);
• delete it, or restrict how we use it;
• stop using it where we rely on legitimate interest.

Email [TO FILL: privacy email, e.g. privacy@folio.app] from the address on your account. We reply within one month. If you're unhappy with how we handle your data, you can complain to the Spanish data protection authority, the AEPD, or the authority where you live.

Data is encrypted in transit, passwords are stored hashed, files such as CVs and documents are private and only shared through short-lived links, and database rules limit each user to their own data. No system is perfect: if a breach affects you, we'll tell you and the authorities as the law requires.

Folio is for people aged 18 and over. We don't knowingly collect data from anyone younger; if we learn we have, we delete it.

We only use the cookies Folio needs to work, such as keeping you signed in. See the Cookie Policy.

If we change how we use your data in a significant way, we'll tell you by email or in Folio before it applies. The date at the top shows the current version.