Privacy Policy

CPDfolio is operated by [ENTITY NAME] (ABN [ABN]). We are committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

This Privacy Policy explains how we collect, use, disclose, and store your personal information when you use CPDfolio to maintain your CPD records.

What information we collect

Information you provide to us

• Account information: When you create an account, we collect your name, email address, and password.
• Scheme registration details: Your professional registration number, chosen CPD scheme (such as Engineers Australia or financial adviser credentials), and practice areas.
• CPD activity records: Details of your continuing professional development activities, including activity descriptions, dates, hours or units completed, categories, practice areas, and your reflections on each activity.
• Evidence files: Certificates, receipts, confirmation emails, and other documentation you upload to support your CPD activities.
• Professional Development Plan: Your learning goals and competency development plans.
• Payment information: Billing details processed through our payment provider, Stripe. We do not store your complete credit card number.
• Firm membership information: If you join a firm account, we collect details of your firm membership, engagement dates, and your relationship to the firm.

Information we collect automatically

• Usage information: Anonymous page view events to understand how our service is used. We deliberately do not collect IP addresses, user agents, visitor identifiers, or search terms.
• Session data: Essential session cookies required for authentication and security.

Information from AI processing

When you forward an email to your CPDfolio address, we send the email's text to Anthropic's Claude AI to extract activity details (title, date, hours, category) and create a draft entry for your review. Attachments on forwarded emails are not sent to Anthropic or kept; we keep only their names, types and sizes.

When you upload certificates in Audit Rescue, we send the file name, the text read from the file and any notes you add to Anthropic to create draft entries. Anthropic processes this content in the United States, as described under Overseas disclosure.

How we use your information

We use your personal information to:

• Provide and maintain your CPD record, including tracking your progress against your scheme's requirements and generating audit pack exports.
• Process your subscription payments and manage your billing.
• Send you service-related communications, including reminders about cycle rollover dates, subscription renewals, and firm-related notifications if you're a member of a firm account.
• Improve our service by analysing anonymous usage patterns.
• Respond to your support requests and provide customer service.
• Comply with our legal obligations, including record retention requirements and handling audit or regulatory requests you initiate.
• Process forwarded emails and Audit Rescue uploads using AI to draft activity entries (only when you use those features).

How we share your information

Where we host your information

Our application servers and database, which hold your account and CPD records, are hosted in Germany on Hetzner infrastructure, managed through Laravel Forge.

With service providers (sub-processors)

We engage the following sub-processors to help us provide CPDfolio:

• Stripe: Payment processing for subscriptions and one-off purchases. Based in the United States. View Stripe's privacy policy at stripe.com/privacy.
• Cloudflare R2: Secure file storage for your evidence certificates and documents. Cloudflare operates globally and does not guarantee storage in any particular country, so files may be stored outside Germany and outside Australia. View Cloudflare's privacy policy at cloudflare.com/privacypolicy.
• Postmark: Email delivery for account notifications, reminders, and firm communications, and receipt of the emails you forward to your CPDfolio address. Based in the United States. View Postmark's privacy policy at postmarkapp.com/privacy-policy.
• Anthropic: AI processing of forwarded emails and Audit Rescue uploads to extract CPD activity details. Based in the United States. Content is processed by Claude AI, with data handled according to Anthropic's privacy policy at anthropic.com/privacy.
• PostHog: Anonymous, cookieless usage analytics to understand how our service is used. Data is processed in the European Union. View PostHog's privacy policy at posthog.com/privacy.

These service providers are contractually obligated to handle your personal information securely and only for the purposes we specify.

With your firm (if applicable)

If you join a firm account through CPDfolio:

• Your firm's administrators can view your CPD progress, activity records, and audit packs during your engagement period.
• When you leave a firm, their access ends immediately. They retain only a dated continuity snapshot covering your engagement period.
• Your full CPD record remains yours and continues independently of any firm membership.

With regulators (only at your direction)

We do not submit CPD records to regulators on your behalf. You control when and how your audit pack is shared with Engineers Australia, ASIC, your licensee, or any other regulatory body. CPDfolio generates the pack for you; you remain responsible for lodgement and compliance with your obligations.

Overseas disclosure

Your account and CPD records are stored and processed overseas in Germany. Some of our service providers also operate outside Australia, which means your personal information may be disclosed to other recipients overseas:

• Germany: Application servers and database (Hetzner, via Laravel Forge).
• United States: Stripe (payment processing), Postmark (email delivery), and Anthropic (AI processing).
• European Union: PostHog (anonymous analytics).
• Global infrastructure: Cloudflare operates globally and files may be stored overseas.

When we disclose personal information overseas, we take reasonable steps to ensure the recipients handle your information in accordance with the Australian Privacy Principles. However, you acknowledge that overseas recipients may not be subject to the same privacy obligations as Australian entities, and you may not be able to seek redress under the Privacy Act if there is a breach by an overseas recipient.

Data retention and deletion

We retain your personal information for as long as your account remains active, and for a period after account closure to:

• Comply with legal record retention requirements.
• Resolve any disputes or enforce our agreements.
• Provide you with access to your historical records if you return.

If you delete your account:

• Your CPD activity records and personal information are permanently deleted from our active systems within 90 days.
• Evidence files stored on Cloudflare R2 are deleted.
• Backup copies may persist in our backup systems for up to 12 months for disaster recovery purposes, after which they are permanently deleted.
• Anonymised usage analytics are retained indefinitely, as they contain no personal information.

Your rights

Under the Australian Privacy Principles, you have the right to:

Access your information

You can access your personal information at any time through your CPDfolio account. If you require a copy of your data in a specific format, contact us at hello@cpdfolio.com.

Correct your information

You can update most of your personal information through your account settings. If you identify any inaccuracies or need assistance with corrections, contact us.

Delete your information

You can delete your account and all associated personal information at any time through your account settings. Account deletion is immediate and cannot be undone.

Withdraw consent

If you wish to withdraw consent for specific processing activities (such as the AI evidence extraction service), you can stop using those features or contact us for assistance.

Security

We implement appropriate technical and organisational measures to protect your personal information:

• Data is encrypted in transit using TLS.
• Evidence files are stored securely on Cloudflare R2 with time-limited signed URLs for access.
• Passwords are hashed using industry-standard algorithms.
• We conduct regular security reviews of our systems and practices.
• Access to your personal information is restricted to authorised personnel only.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Cookies and analytics

CPDfolio uses only essential session cookies required for authentication and security. We do not use advertising or tracking cookies.

We count anonymous page events (such as a page view or a button click) in our own database, hosted with the rest of the service. These events carry no cookies, IP addresses, user agents, account identifiers or search terms.

We also use PostHog for anonymous, cookieless analytics. PostHog is configured in cookieless mode and does not collect IP addresses, user agents, or visitor identifiers. Analytics data is processed in the European Union.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email or through a notice in your CPDfolio account. The "Updated" date at the top of this policy indicates when it was last revised.

Your continued use of CPDfolio after any changes indicates your acceptance of the updated Privacy Policy.

Complaints and contact

If you have any questions, concerns, or complaints about how we handle your personal information, please contact us at:

Email: hello@cpdfolio.com
[ENTITY NAME]
ABN [ABN]

We will investigate your complaint and respond within a reasonable timeframe, generally within 30 days.

Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response to your privacy complaint, you may lodge a complaint with the OAIC:

Website: www.oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au