Privacy policy

Last updated October 12, 2026. This policy describes how the portal handles personal information, in plain language.

Who we are

This portal is operated by HyperNerd Inc., 2910 W. Magnolia Blvd, Burbank, CA 91505, USA ("we", "us") on behalf of each design firm that runs a portal here (the "firm"). The firm is the controller of the project information in its portal; we host and process it on the firm's instructions.

What we collect

• Demo requests: the address you give for a demo link, and how often you visit the demo and how many of its pages you open, so we know what prospects look at and can follow up. It is deleted a year after your last visit, or sooner if you ask.
• Account details: your name, email address, role and, if you sign in with Google, the identifier they provide. No passwords are stored; sign-in is by your identity provider or by a one-time link or code sent to your email.
• Project records you and your colleagues enter: specifications, documents, photos, notes, orders, invoices, proposals, time and expenses, and their history.
• Use of the portal: pages visited and actions taken, with the time, your account and your browser's type, so the firm and we can support you and keep the service secure. The firm chooses how long this log is kept, between 30 and 365 days. Each device you sign in on is kept with its network address and browser so you can see and end your sessions; a session ends after 30 days without a visit and its record goes a day after it ends.
• Email the portal sends: the address and text of each alert, invitation and document it emails, so the firm can see what went and send it again.
• Messages: what you send through Contact support, and email the firm forwards into a project.

Why

To run the portal for the firm; to send the notifications you or your role are set up to receive; to answer support requests; to keep the service secure and find faults; to meet legal obligations. We do not sell personal information and do not use it for advertising.

Cookies

The portal sets a session cookie so you stay signed in, and may keep small preferences (such as a folded panel) in your browser. There are no advertising or cross-site tracking cookies. From time to time PortSpace counts, for its own use, which kinds of page a firm's staff open and a few steps they take (a project created, a proposal sent), to see where the portal is hard to use: the kind of page only (never a project, a name or anything typed), the role, and an id that changes every month; never clients or contractors, and a firm can switch it off in Settings. See the cookie note. On the public pages (the home page, features, pricing and sign-up) we count visits ourselves, with no cookie: only the page, the day and the website that linked to it, never who you are, your address or your browser.

Who sees it

People the firm has given access to its portal, according to the role and project access the firm sets. Client contacts see only what the firm shares with them. Service providers process data on our or the firm's instructions: hosting, email delivery, our AI providers where the firm has switched those features on, and any payment platform, accounting system or chat workspace the firm connects; see the full list of sub-processors. We disclose information when the law requires it.

Where and how long

Data is stored on a dedicated server in a European data center (Hetzner, Germany), behind Cloudflare, with nightly backups copied off-site to Cloudflare R2. Project records are kept for as long as the firm keeps its portal; the firm can delete projects and remove people, and when a firm asks us to close its portal the data is kept thirty days for export, then deleted from the service; the nightly off-site backups that still hold it are used only to recover the service after a fault, and go as the backup history is trimmed. The activity log is kept for the period the firm chooses, between 30 and 365 days. The log of emails sent is kept a year; sign-in links and codes are deleted 30 days after they are used or run out (a personal welcome link made by PortSpace for one person is kept, without the link itself once put away, as the record of who was given access, until it is deleted), invitations 90 days after they are accepted or run out, and alerts ninety days after they are read. When someone's personal details are removed (they ask, or an administrator removes a former colleague), their name and address are replaced throughout the portal; a signature typed to accept a proposal is kept as the record of what was agreed. Nightly backups are kept off-site on Cloudflare R2 night by night, with the latest night also on the server.

Your rights

You may ask to see, correct or delete personal information about you, or object to how it is used. Ask the firm first, since it controls its portal; if you cannot reach them, write to us at [email protected] and we will pass it on. Where a law gives you further rights (for example in the EU, UK or California), we honor them.

Security

Connections are encrypted, and so are the secrets the service holds on the firm's behalf (keys, tokens, two-factor seeds); the database and uploaded files are on the server's own drives, not encrypted at the disk level, with access limited to its operator. Access is limited to the people the firm has invited. No system is perfect; if we learn of a breach affecting you we will tell the firm and, where required, you. How the service is run, in detail.

Changes and contact

We will post changes here with a new date. Questions to [email protected].