This policy explains how Portium processes personal data through portium.net, the Portium mobile app, and the waitlist and support forms linked from the site.
If a feature later presents a more specific in-product privacy notice, that notice also applies to that feature.
We do not treat your use of the website as blanket consent to personal data processing. Where EU law requires consent, we ask for it separately.
1. Controller and Contact
Controller: Portium
Privacy contact: [email protected]
If Portium appoints a separate data protection officer or an EU representative for this service, we will publish those details here.
2. How We Use Personal Data
Under Articles 13 and 6 GDPR, we explain the categories of data, purposes, legal bases, and retention criteria below.
Website operation, security and abuse prevention
- Data
- IP address, request metadata, browser and device information, timestamps, referral data, and security logs.
- Purpose
- To deliver the website, keep it available, investigate incidents, and prevent fraud or abuse.
- Legal basis
- Article 6(1)(f) GDPR: legitimate interests.
- Retention
- For as long as reasonably necessary for security, availability, and incident response, then deleted or anonymized.
Optional website analytics
- Data
- Cookie identifiers, browser and device data, approximate location, pages viewed, interactions, and timestamps.
- Purpose
- To understand how visitors use portium.net and improve the website.
- Legal basis
- Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive: consent.
- Retention
- Analytics cookies may remain on your device for up to 2 years unless you delete them sooner. Analytics data is retained in Google Analytics for the period configured in our property and reviewed regularly.
Waitlist and support forms
- Data
- The information you choose to submit in forms linked from this site, including email address, device type, and support messages.
- Purpose
- To manage the waitlist, answer support requests, and communicate about the launch or the issue you asked us to handle.
- Legal basis
- Article 6(1)(a) GDPR for waitlist updates you request, and Article 6(1)(b) or 6(1)(f) GDPR for support and account-related requests.
- Retention
- Until the request has been handled, the waitlist campaign ends, or you withdraw consent, unless a longer retention period is legally required.
Portium account access and authentication
- Data
- Email address, username, authentication credentials, session identifiers, email verification and password reset data, and Google account data you choose to share for sign-in.
- Purpose
- To create and secure Portium accounts, let you sign in, verify your email address, and keep your account available.
- Legal basis
- Article 6(1)(b) GDPR: performance of a contract or steps taken at your request before entering into a contract.
- Retention
- For as long as your account is active and for a limited period afterwards where needed for security, dispute handling, or legal compliance.
Portium mobile app
- Data
- Email address, username and display name; the spaces, tracks, points, journal entries and feedback you create; a push notification token and a random per-install device ID; crash reports; and, only if you allow it in the app, usage analytics linked to your account identifier.
- Purpose
- To provide the app and share content with the people you add to a space, deliver notifications, fix crashes, and improve the app.
- Legal basis
- Article 6(1)(b) GDPR for account, content and notifications. Article 6(1)(f) GDPR for crash reports. Article 6(1)(a) GDPR for analytics: you can turn it off at any time in Settings.
- Retention
- While your account is active. Deleted when you delete your account (see section 7). Google keeps Firebase data for its own configured retention period.
Third-party font and icon delivery
- Data
- IP address and browser metadata sent to Google when the website loads Google-hosted fonts or Material Symbols.
- Purpose
- To render the current visual design of the website.
- Legal basis
- Article 6(1)(f) GDPR: legitimate interests.
- Retention
- According to the provider handling those requests. We do not control the provider retention period for those transfers.
4. Recipients
We share personal data only where needed to operate the service, respond to you, or comply with law.
- Google Ireland Limited and Google LLC for Google Analytics when you consent to analytics.
- Google Ireland Limited and Google LLC for Firebase Crashlytics, Analytics and Cloud Messaging in the app.
- Other members of a space you join, who can see the content you add to it.
- Youform when you submit the waitlist or support forms linked from this site.
- Infrastructure, hosting, and security providers acting on our behalf.
5. International Transfers
Some providers we use may process personal data outside the EEA or UK, including in the United States. Where that happens, we rely on a valid transfer mechanism such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or the European Commission's Standard Contractual Clauses with supplementary measures.
6. Your GDPR Rights
- Access the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data when there is no valid reason to keep it.
- Restrict or object to certain processing.
- Receive data you provided to us in a portable format where the law applies.
- Withdraw consent at any time for consent-based processing, including analytics cookies.
- Lodge a complaint with your local supervisory authority in the EEA.
To exercise these rights, email [email protected]. We may ask for enough information to verify your identity before acting on a request.
7. Deleting Your Account
You can delete your account in the app under Settings → Delete account, or by emailing [email protected]. Deletion is immediate and cannot be undone. It permanently deletes your sign-in identity, the spaces you own outside an organisation with all their content, your memberships and your notification tokens. Points and feedback you wrote in spaces owned by others stay for the members of those spaces but are no longer linked to you and appear as "Deleted user". Spaces belonging to an organisation stay with the organisation.
8. Complaints
If you believe our processing of your personal data breaches data protection law, you can complain to your local supervisory authority in the EEA. You can also contact us first at [email protected].
9. Automated Decision-Making
We do not use the website processes described in this policy to make solely automated decisions that produce legal effects or similarly significant effects about you.
10. Linked Third-Party Services
If you follow links from our website to third-party services such as Youform, Google Play, the App Store, or Google sign-in, those providers may also process personal data under their own privacy notices.
- Google Privacy Policy: https://policies.google.com/privacy
- Youform Privacy Policy: https://youform.com/privacy-policy/
11. Changes to This Policy
We may update this policy from time to time. Material changes will be published on this page together with a new revision date.