Legal
Privacy policy
This policy says what the Cablefolio website at cablefolio.com collects about you, why, how long it is kept, and who else handles it. The privacy notice for people who use the Cablefolio app — a client's portal sign-in, or someone opening a shared report — follows it, under "In the Cablefolio app".
Last updated
Who we are
Cablefolio is operated by Secure Coast Network Solutions. For anything in this policy, write to support@cablefolio.com or use the support page.
What the website collects
Reading the website needs nothing from you: there is no account, no cookie, and no tracking. The website collects personal information only when you send it.
- Early access. When you join early access, we keep the email address you give and, if you add them, your company and your role, with the time you asked. We use them to tell you about Cablefolio's launch and your early access, and for nothing else. They are kept until you ask us to remove them.
- Support and contact messages. When you write to us through the contact form, we keep your name, your email address, the topic you chose, and your message, with the time it arrived, so we can answer and follow up. Ask us and we delete it.
- "Was this helpful?" An answer on a help article stores the article and yes or no, with the time. Nothing about who answered is stored.
- Stopping abuse. To limit how often one network can send the forms, each form request records a one-way hash of the sender's IP address with the time. The address itself is never stored, and these records are deleted after 24 hours.
A copy of each early-access request and contact message is emailed to our own inbox so we see it promptly.
Spam protection
The early-access and contact forms are protected by Cloudflare Turnstile, which checks that a person, not a script, is sending them. To do that, Cloudflare processes information about your browser and device, as its Turnstile privacy addendum describes. Turnstile runs only on those two pages.
Analytics
When it is turned on, the website counts visits with Cloudflare Web Analytics, which does not use cookies or local storage and does not follow you across sites. It records which pages are visited, where visitors came from, and the browser, device type, and country, as totals. No analytics or advertising cookies are ever set.
Cookies and what your browser keeps
The website sets no cookies. If you choose a light or dark theme with the theme button, your browser remembers that choice in its local storage, on your device only; nothing else is stored there.
Server logs
The website's server writes one line for each form request: the time, the address asked for, the answer it gave, how long it took, and Cloudflare's request id. The line never includes your IP address, your name, your email address, or your message. Cloudflare, which hosts the website, also processes IP addresses to deliver pages and protect the site from attacks.
Who else handles it
Nothing is sold, and nothing is shared for advertising. Cloudflare hosts the website, stores the form submissions in its database service, delivers the notification emails, runs Turnstile, and, when turned on, Web Analytics, as our service provider.
Your rights
You can ask to see what we hold about you, to have it corrected, or to have it deleted, and you can withdraw from early access at any time. Write to support@cablefolio.com. Depending on where you live, you may also have the right to complain to a data protection authority.
Children
The website and Cablefolio are for businesses and are not directed at children.
Changes
When this policy changes, the new version is published here. The Cablefolio changelog records changes to the product.
In the Cablefolio app
Privacy notice
This notice is for two kinds of people who use Cablefolio without being part of the team that runs it: a client with a portal account, and anyone who opens a shared report or a one-time link. It says what the app records about you, how long it keeps it, and who else handles it. The team that gave you access runs this copy of Cablefolio and decides what happens to its records; ask them about anything here.
If you have a portal account
Your account holds your username, your role (a client account, limited to your own company's records), and, if they have been added, your display name, email address, and profile picture. Your password is never stored: only a salted, slow hash of it is. If you turn on a second factor, its secret is stored encrypted.
Each time you sign in, the app keeps a session record: when you signed in, when it last saw you, your browser's description of itself (its user agent), and your IP address. A session ends 7 days after you last used it, and 30 days after you signed in at the latest. Signing out deletes its record at once; an ended session's record is deleted the next time anyone signs in.
The app also writes a security log entry for each sign-in, failed sign-in, sign-out, and password change, with the time, your IP address, and your browser. The team reads this log to keep accounts safe. The app never edits or deletes it, and it has no expiry date.
What you send through the portal is kept as part of your company's records: service requests and the team's replies, and the logins you send when the team asks for one. A login you send is encrypted the moment it arrives, and only the team's managers can open it.
If you open a shared report or a one-time link
No account is involved, so nothing about you is known by name. Opening a shared report, its photo gallery, or a one-time link writes a security log entry with the time, your IP address, your browser, and which link it was (by the first characters of its address, never the whole of it). A shared report also counts how often it has been opened and when it was last opened. A one-time link records when it was opened, and it never opens again.
Everyone
To stop people guessing passwords and link addresses, each attempt to sign in or to open a link is counted against the IP address it came from, and a sign-in attempt also notes the username typed. Those records are deleted after 24 hours.
Every request the app's server answers writes one line to its operating log: the time, the address asked for (never its query), the answer it got, how long it took, Cloudflare's request id, and the account if one was signed in. The line does not include your IP address, and a link's secret is cut to its first characters.
Cookies and what your browser keeps
The app sets one cookie when you sign in, pm_session, which keeps you signed in. While a sign-in waits for its second-factor code, a second cookie, pm_mfa, holds that step for a few minutes. Both are only sent to this site and cannot be read by the page's scripts. There are no analytics, advertising, or tracking cookies, and no third-party scripts.
Your browser also keeps the colour theme you chose and, so the app opens without a signal, a copy of the app's own files. Neither holds anything about you.
Who else handles it
Nothing is sold, and nothing is shared for advertising. The app runs on Cloudflare, which hosts it, stores its database and files, makes its PDF reports, and sends its password-reset emails, as the team's service provider. Mapbox, a mapping service, is sent the addresses of the properties the team records — as one is typed, and when it is saved — to find them on a map, and a property's location to draw the map pictures on the team's pages, with the positions of the photos that recorded where they were taken. The team may also send its security log entries — including the IP address and browser they record — to services of its own choosing (webhooks).
Your choices
You can change your password and your profile from your profile page, and sign out at any time. To see, correct, or remove what the app holds about you, or to have your account closed, ask the team that gave you access.