Privacy policy

1. Controller

The controller for data processing on this website within the meaning of the GDPR is:

Tumasyan UX Consulting Shiraz Tumasyan
St.-Veit-Str. 53
81673 Munich
Germany
Email: hello@wonfolio.com

2. What we process

• Account data: your email address, for signing in by magic link or with a Google account (legal basis: Art. 6(1)(b) GDPR — contract).
• Content data: what you enter (questionnaire answers, testimonials, uploaded portfolio and CV files), images you upload, and the texts generated from them (Art. 6(1)(b) GDPR).
• Payment data: when you take out a subscription, through our payment provider Stripe (see section 3).
• Usage data: aggregated, cookieless audience measurement (see section 4).
• Server log data: technically necessary data such as IP address and the date and time of access (Art. 6(1)(f) GDPR — legitimate interest in secure operation).

3. Processors and third parties

To provide the service we use carefully selected providers, with whom data processing agreements under Art. 28 GDPR are in place:

• Supabase — authentication, database and image storage. Hosting region: eu-central-1 (Frankfurt, Germany).
• Vercel — hosting, delivery of the application and audience measurement (see section 4).
• Anthropic — processing of your inputs to generate text, and to translate testimonial questionnaires. Your content is transmitted to the Anthropic API to produce the case study. The provider states that content submitted through the API is not used to train models.
• Stripe — payment processing. Your payment details (for example card data) are processed exclusively by Stripe; we neither receive nor store them.
• Resend — sending system emails (where enabled): the welcome email, and a notification to the requesting person when a testimonial is submitted. Transmitted are the email address, subject and message body. The testimonial answers themselves are not part of that notification.
• Google — only if you choose to sign in with a Google account. Google then transmits your email address and basic profile information to us. If you sign in by magic link instead, no data is exchanged with Google.
• Sentry — error reporting, so that faults are noticed and fixed rather than silently endured. When something goes wrong, a technical report is transmitted: the error, the page it happened on, and browser and device type. Processing takes place in Sentry’s EU data region. The content you are working on — your drafts, your answers, the testimonials you have received — is not part of these reports.

Where data is transferred to a third country (for example the USA), this takes place on the basis of the EU standard contractual clauses or an adequacy decision.

4. Audience measurement

We use Vercel Web Analytics to evaluate use of the website statistically. Measurement is cookieless: no cookies are set and no cross-device profiles are built. Aggregated information such as the page visited, referrer, approximate region of origin, and browser and device type is collected. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-preserving audience measurement). You may object to this processing under Art. 21 GDPR.

View counts for published case studies and portfolios are stored as a single number per page per day. No visitor records, IP addresses or cookies are involved.

5. Published case studies

When you publish a case study, the resulting page is accessible at a public address without signing in and may be indexed by search engines. Publication happens only at your instigation and you can withdraw it at any time in your account. Please do not publish personal data of third parties — such as the names of contacts or of people who gave testimonials — without a legal basis or their consent.

6. Testimonials (statements from clients)

Users can ask for a testimonial through a personal link. If you fill in such a form, we process the data you provide — your name, optionally your role and company, and your answers — on behalf of the person who sent you the link.

In the form you choose how your answers may be used: for publication with your name and company, exclusively for personal presentations and interviews, or exclusively as feedback to the person who asked. The legal basis is your express consent (Art. 6(1)(a) GDPR); your choice is recorded with a timestamp.

Your choice is shown to the requesting person every time they view your answers. How the answers are actually used is decided by that person, who in this respect is the controller within the meaning of the GDPR; we record your choice and display it, but do not enforce it technically.

You can withdraw your consent at any time. Contact the person who asked you for the testimonial, or write to hello@wonfolio.com. After withdrawal your statement is removed from all public pages. The lawfulness of processing carried out before withdrawal is unaffected.

7. Retention

We store your data for as long as your account exists. You can delete individual case studies at any time, and delete your account entirely yourself (in your account under “Portfolio” → “Account”). Doing so irreversibly removes your case studies, your portfolio, testimonials you received and images you uploaded, and cancels any running subscription. Personal data is deleted unless statutory retention obligations apply — in particular commercial and tax retention periods for invoice data.

8. Your rights

Under the GDPR you have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object (Art. 21 GDPR).

A message to hello@wonfolio.com is enough to exercise your rights. You also have the right to lodge a complaint with a supervisory authority — for the controller named above this is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27, 91522 Ansbach, Germany).

9. Cookies

We use only technically necessary cookies, required for signing in and for operating the application. No consent banner is required for these under § 25(2) no. 2 TDDDG. We do not use marketing or tracking cookies.