Privacy Notice
CASFolio is operated by Camilo Quirós Mendoza. This notice explains how CASFolio handles personal information when students, coordinators, and schools use casfolio.net.
Our commitments
- We do not sell or rent student or school personal information.
- We do not use records for targeted advertising, behavioural profiling, or AI-model training.
- Students and other rights holders keep ownership of their work.
- We use records only to provide, secure, maintain, and support CASFolio, follow lawful school instructions where applicable, and comply with law.
Information we process
CASFolio processes account details such as a name, email address, authentication information, role, language and preferences. Student portfolio records may include activities, hours, reflections, evidence metadata and files, learning outcomes, goals, and portfolio exports. School use may include class membership and coordinator comments. Security and service logs may include IP address, browser, device, timestamps, and request details.
Students should not upload unnecessary sensitive information. Reflections and evidence may nevertheless contain sensitive information, so CASFolio protects submitted records as confidential portfolio content.
Access and sharing
Students control their accounts and decide whether to create a public share link. Public sharing is off by default. A link may be viewed by anyone who receives it until it expires or is revoked; downloaded copies cannot be recalled. Authorized coordinators can access only students in their active assigned class. A coordinator loses live access when the student leaves or the class is archived.
Providers and international processing
CASFolio uses Supabase for authentication, database, and private Storage; Vercel for hosting; Resend for transactional email; and Cloudflare for delivery and backups where configured. Providers may process data outside the student’s country. For a school deployment, applicable transfer safeguards and provider details are specified in the school agreement and data processing agreement before records are shared.
Retention, export, and deletion
Records remain while an account is active. Students can request a free account export and may delete their account in Settings. Deletion removes application records, owned stored files, share links, and the authentication account. Backup retention and legal exceptions are described in the school security schedule; a restored backup must not reactivate a deleted account.
Your rights and school requests
You may ask to access, correct, export, or delete your information through account settings or by contacting contact@casfolio.net. Schools should use the authorized contacts identified in their agreement. CASFolio will assist schools with valid privacy requests involving school-directed processing.
Security and incidents
CASFolio uses authenticated access, role checks, encrypted transport, private file storage, expiring signed URLs, and backups. No online service is risk-free. If a personal-data incident affects a school, CASFolio will notify its designated contact within 24 hours of discovery and provide updates without undue delay, subject to applicable law.
Children and updates
CASFolio is designed for IB students and may be used by minors under school or parent/guardian arrangements. We apply the heightened protections required by applicable law. We will publish material changes with a new version and notify affected account holders or schools where appropriate.
Change history
Version 2026-09-14 replaces the previous template notice with CASFolio-specific commitments on school access, sharing, exports, deletion, analytics, and incident notification.
Contact
Privacy questions: contact@casfolio.net. Legal operator: Camilo Quirós Mendoza, operating as CASFolio, Alvarado, Veracruz, Mexico.