Folio

GDPR overview

The privacy policy devotes a section to the GDPR and names Folio as data controller. EU and EEA residents are offered six rights - access, update or deletion, rectification, objection, restriction, portability in a structured machine-readable format, and withdrawal of consent - all exercised by writing to service@folio.la, with an identity check possible before any answer. The right to complain to a supervisory authority in the EEA is stated explicitly. Beyond that, implementation is thin: no data protection officer is named, no Article 27 representative is designated, no dedicated privacy mailbox exists, and the transfer of personal data to the United States is asserted without naming standard contractual clauses or any other adequacy mechanism. No DPA is published.

Who owns the data?

Under the terms, you keep every right to the content you upload or publish through Folio. Publishing it, however, grants Folio a licence to use, modify, publicly perform, publicly display, reproduce and distribute that content on and through the service, including making it available to other users. Folio may monitor and edit user content at its discretion, but is not obliged to. Everything belonging to the service itself remains Folio's exclusive property. Feedback is treated differently: all intellectual property in it passes to the company, or failing that an exclusive, irrevocable and perpetual licence. For personal data, Folio declares itself the data controller.

Reuse rights

The terms draw a clear line. Content you create keeps its rights with you, so you may reuse your own demos, captures and exports freely, without asking Folio. Everything else on or delivered through the service is Folio's property or used with permission, and may not be distributed, modified, transmitted, reused, downloaded, reposted or copied for commercial purposes or personal gain without prior written consent. The demo gallery follows the same logic: the walkthroughs shown there feature third-party products, and Folio explicitly disclaims any affiliation with the brands involved. On the personal-data side, Folio uses what it collects to run and improve the service, bill you, support you and send commercial messages you can decline, and it shares it with named providers including Microsoft Clarity, Microsoft Advertising, Google Analytics, GitHub, Stripe and Slack.

Data retention & training

Hosting summary

Folio states that personal data is transferred to and processed in the United States, and warns users located elsewhere that submitting information means agreeing to that transfer. No hosting provider, data centre or region is named, and no European hosting option is offered. The commitment stays generic: reasonable steps to keep data secure, and no transfer to an organisation or a country without adequate controls in place, with the usual caveat that no transmission or storage method is completely secure. Enterprise customers are offered custom data retention policies, which implies some configurability at that tier, but nothing is documented publicly. On the public side, the marketing site runs on Webflow behind Cloudflare, with static assets served from cdn.prod.website-files.com and cdn.folio.la; the resolved address is an anycast node, so it reveals nothing about where the application servers actually sit.