Official Legal Document

Privacy Policy

Translated from Spanish. In case of discrepancy, the Spanish version prevails.

Last updated: October 7, 2026

Privacy Commitment Summary

At Passfolio (operated at getpassfolio.com, app.getpassfolio.com and their associated domains), privacy and cryptographic security are the foundation of our product.

We never sell or trade your data or your clients' information.
Your secrets and passwords are stored using AES-256-GCM authenticated encryption.
The Google OAuth integration is used strictly to authenticate your identity and create your session.

1. Identity of the Controller

The controller of the personal data collected through the Passfolio platform is Victor Luna Just, owner of Passfolio, domiciled in the Argentine Republic. For any inquiry, exercise of rights or legal request, you can contact us at:

Contact and privacy email:privacidad@getpassfolio.com

2. Data We Collect

We collect only the information strictly necessary to provide the secure access and project management service:

A. Traditional Registration Data

Username or alias, email address and a password cryptographically hashed with a secure algorithm (bcrypt with dynamic salt). Passfolio never stores or knows your master password in plain text.

B. Data Obtained through Google OAuth

If you choose to sign in or sign up using your Google account, we request access to the basic profile scopes:

openid: Unique Google user identifier.
https://www.googleapis.com/auth/userinfo.email: Your primary email address.
https://www.googleapis.com/auth/userinfo.profile: Your name and profile photo to personalize your user interface.

C. Vault Data

Credential titles, usernames, service URLs, custom fields and passwords. Every password and sensitive piece of data is encrypted with AES-256-GCM before being persisted in the database. Passfolio cannot read your credentials without the corresponding cryptographic key.

D. Technical and Log Data (Logs)

Anonymous or truncated IP address, browser type, and date and time of access, solely to prevent brute-force attacks, detect unauthorized sign-ins and ensure the integrity of the platform. We also use Vercel Web Analytics to count visits to the public pages: it sets no cookies, doesn't identify anyone, and never receives app addresses or delivery, transfer or invitation links.

3. Google Data Policy Compliance Statement (Google Limited Use)

Passfolio's use and transfer to any other application of information received through Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

"Passfolio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

No advertising use: Google user data is not used or transferred to serve ads, advertising retargeting or ad personalization.
No unauthorized transfer: We do not transfer data received from Google to third parties, unless strictly necessary to provide or improve the core functionality of the application or to comply with applicable law.
No training of general-purpose AI models: Google data is not used to train language models or artificial intelligence algorithms unrelated to the service.
Restricted human access: No Passfolio employee or developer reads your Google user data unless you grant explicit consent for technical support or it is required by law.

4. Purpose of Data Processing

We use your data for the following exclusive purposes:

Authenticating your identity and keeping your secure session open through encrypted JWT tokens.
Providing the features for organizing projects, credentials, cards and shared workspaces.
Processing charges and subscriptions (through Paddle, without Passfolio storing full payment card numbers).
Notifying you about important security changes, suspicious sign-ins or critical system updates.

5. Security and Encryption Measures

We implement rigorous technical and organizational measures to safeguard your information:

Encryption in Transit: All communications take place over forced HTTPS connections with TLS 1.3.
Encryption at Rest: Confidential data is encrypted using the industry-standard AES-256-GCM algorithm with unique initialization vectors (IV) per record.
Multi-tenant Isolation: Each workspace (Tenant) has strict segregation at the database level to prevent cross-access.
Secure Cookies: Authentication cookies have the HttpOnly, Secure and SameSite=Lax attributes to neutralize XSS and CSRF attacks.

6. Data Retention and Deletion

We keep your data only while your account remains active or as necessary to provide the service. You have the right at any time to:

Revoke Google access: You can disconnect Passfolio from your Google account at any time from Google's official security page: myaccount.google.com/permissions.
Request for Full Deletion (Right to Be Forgotten): You can request the permanent deletion of your account and all associated credentials by sending an email to privacidad@getpassfolio.com. Your request will be processed within a maximum of 72 business hours.

7. Changes to this Policy

We may update this Privacy Policy periodically to reflect improvements to the platform, legislative changes or new security requirements. We will notify any substantial change by publishing the updated version on this page with its effective date.

8. Legal Contact

If you have questions about this Policy or the processing of your personal data, you can contact our legal and privacy team at:

Victor Luna Just, owner of Passfolio

Buenos Aires, Argentine Republic

Email: privacidad@getpassfolio.com