Legal
Privacy Policy
Last updated: 4 October 2026
Madefolio ("we", "us", "our") is a UK-based platform that helps trade and home improvement businesses turn completed projects into marketing content, manage enquiries and reviews, and publish content to social media. This policy explains what personal data we collect, why we collect it, how we protect it and the rights you have over it. We act as the data controller for the personal data described here.
1. Who this policy covers
This policy covers two groups of people:
- Subscribers — trade businesses and their team members who create a Madefolio account.
- Visitors and end customers — people who visit a subscriber's public Madefolio portfolio page, send an enquiry through one, or are sent a review request by a subscriber.
If you are a customer of one of our subscribers (for example, someone who had work done on their home or garden), that business is separately responsible for your data as its own controller. This policy explains how we handle your data on their behalf.
2. Account information
When you create an account we collect:
- Your name and email address.
- Your password, which is stored only as a secure cryptographic hash — we never see it in plain text.
- Your business details, such as your business name, location, services, phone number, tagline and logo, which you choose to add to your workspace and public portfolio.
We use this to create and secure your account, identify you when you sign in, and show your business on your public portfolio page. The legal basis is the performance of our contract with you.
3. Project and customer information
To build marketing content, you upload details about each project, which may include:
- Project details: name, type, location, dates, and the written story of the work.
- Customer details you choose to add: your customer's name, email address and location.
Customer details are used only to create and send review requests on your behalf and to attribute reviews. They are never shown publicly except as part of a review your customer has chosen to leave. You remain the controller of your customers' data; we process it on your instructions.
4. Uploaded images
Photos you upload (before, during and after shots) are stored in private cloud storage. They are served only through expiring signed links and are publicly visible only where you publish a project to your portfolio or attach photos to marketing content. You can remove a project from your portfolio at any time, which removes its photos from public view, or delete the photos entirely.
5. Testimonials and reviews
Reviews are collected when your customers respond to a review request you send through Madefolio. A review may include the reviewer's name, location, star rating and written comments. A review appears on your public portfolio only if you choose to show it. Reviewers can ask us to remove their review at any time using the contact details at the end of this policy.
6. Enquiries
When someone sends an enquiry through a portfolio page, we collect the name, email address and message they provide. We pass the enquiry to the business that owns the portfolio, and email it to the account owner on their behalf. Enquiries are retained so the business can follow up and so we can prevent spam and abuse. If you sent an enquiry and want it deleted, contact the business directly, or contact us and we will remove it.
7. Marketing content generated for you
Madefolio generates social posts, case studies and related marketing content from your project information using AI. We process your project data to provide this feature. Generated content is stored in your workspace so you can edit, copy, publish or delete it. Content you publish to your portfolio is public by design.
8. Social media integrations (Facebook, Instagram, Meta)
Madefolio lets you connect your Facebook Page and Instagram professional account so you can publish content you choose directly to them. This section explains exactly what happens with Meta data.
- What we request. When you connect, you authorise Madefolio through Facebook Login and grant these permissions:
pages_show_list(to list the Pages you manage),pages_manage_posts(to publish posts to your Page),instagram_basic(to identify the Instagram account linked to your Page) andinstagram_content_publish(to publish posts to Instagram). We request no other Meta permissions. - What we store. Your name and email from Facebook Login, the names and IDs of the Facebook Pages you choose to connect, the Instagram accounts linked to them, and the access tokens needed to publish. Access tokens are encrypted with strong encryption before storage and are held only on our servers — they are never sent to your browser or exposed in any interface.
- What we do with it. We use the tokens solely to publish posts you choose to publish or schedule, to show the live link to a published post, and to detect when access has expired or been revoked. We do not read your messages, comments, followers, insights or any other Meta data, and we do not post anything unless you choose to publish or schedule it.
- Sharing with Meta. Connecting your accounts means data is exchanged directly between Madefolio and Meta (Facebook platform APIs). Meta handles that data under its own privacy policy. Madefolio does not share your project content, customer data or enquiry data with Meta except for the specific content you choose to publish.
- Disconnecting. You can disconnect Facebook or Instagram at any time from Settings → Connections in your Madefolio account. Disconnecting immediately deletes the stored Page and Instagram account details and their access tokens from our systems. Any posts you have already published remain on Facebook and Instagram, as they belong to your accounts there. You can also revoke Madefolio's access from your Facebook settings at any time (Settings → Apps and Websites), which has the same effect.
9. Cookies
Madefolio uses only the cookies and local storage that are strictly necessary for the service to work: keeping you signed in, securing your session against abuse, and remembering your preferences. We do not use advertising cookies or cross-site tracking cookies. Public portfolio pages set no tracking cookies.
10. Analytics
We collect basic, aggregated usage analytics — such as which pages are visited and how features are used — to understand what is working and improve the product. Where practical, this data is aggregated or pseudonymised. We also count anonymous views of public portfolio pages so subscribers can see how their portfolio performs; these counts are not linked to identifiable individuals.
11. Third-party services we use
We share personal data only with the providers needed to run the service, each bound by data-processing agreements:
- Hosting and databases — to store accounts, projects, photos and reviews securely.
- Authentication — to sign you in securely, including optional Google sign-in.
- Email delivery — to send you transactional email such as enquiry notifications, review requests and account emails.
- AI processing — to generate marketing content from your project information. Project content sent for generation is not used to train the underlying models.
- Meta (Facebook/Instagram) — solely for the social publishing described in section 8.
We never sell personal data, and we do not share it with advertisers.
12. Data storage and security
Data is stored in managed cloud infrastructure with encryption in transit (TLS) and at rest. Access to production data is restricted to authorised personnel and protected by role-based access controls. Social media access tokens are encrypted before storage. Photos are kept in private storage and served through expiring signed links. We review our security practices regularly, and if a personal data breach ever affects you, we will notify you and the Information Commissioner's Office (ICO) as required by law.
13. Data retention
We keep personal data only as long as needed for the purposes above:
- Account and business data — for as long as your account is active.
- Projects, photos and generated content — until you delete them, or for a short period after you close your account, after which they are permanently deleted.
- Enquiries and review requests — kept so businesses can follow up, then deleted when no longer needed.
- Social media tokens and account details — deleted immediately when you disconnect the integration (see section 8).
When you request account deletion (see our data deletion page), we delete or anonymise your personal data within 30 days, unless we must keep something longer for legal, accounting or fraud-prevention reasons.
14. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (the 'right to be forgotten').
- Restrict or object to our processing.
- Receive your data in a portable, machine-readable format.
- Withdraw consent where we rely on it (for example, for optional email).
- Complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.
To exercise any right, contact us using the details below. We respond within one month.
15. International transfers
Some of our service providers process data outside the UK. Where that happens, we rely on recognised safeguards — such as the UK International Data Transfer Addendum or equivalent adequacy arrangements — and only use providers that offer protection in line with UK data-protection law.
16. Children
Madefolio is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, contact us and we will delete it.
17. Changes to this policy
We may update this policy as the service evolves. If a change materially affects your rights, we will tell you in advance by email or through a notice in the app. The date at the top always shows the current version.
18. Contact us
Questions, requests or complaints about your data — including anything about our Meta/Facebook/Instagram integration — can be sent to:
See also our data deletion instructions.