Portfolio Chatbot Privacy: What to Check Before You Publish

A portfolio chatbot answers recruiter questions from your own documents, which means its privacy profile is defined by three things: which files it can read, what it is permitted to say about them, and how long the platform keeps what it collects. Evaluate those three variables before publishing, and a conversational portfolio becomes a controlled disclosure channel rather than an open archive of your career.

This guide breaks down each variable, cites the regulatory and technical guidance that applies in the United States, and ends with a checklist you can run against any platform, including ours.

TL;DR

• Access scope is the first control. Prefer platforms that read only the files you explicitly select, not your entire cloud drive.
• A chatbot can infer and combine facts you never stated. Publish only documents you would be comfortable having quoted to a stranger.
• Retention matters as much as encryption. Ask how long chats, uploads and logs persist, and whether you can delete them.
• AI output is a claim to verify, not a certification. Answers that trace to a source document are easier to defend than free-form generation.
• Free tiers are a safe place to test visibility settings before committing to a paid plan.

Table of Contents

• 1. Why portfolio chatbots raise a different privacy question
• 2. Access scope: what the platform can read
• 3. What the model can infer, and why it matters
• 4. Retention and deletion
• 5. Visitor privacy: recruiters are users too
• 6. AI in hiring: notice, bias and verification
• 7. Our perspective
• 8. A pre-publish checklist
• 9. Comparing the main portfolio approaches
• 10. Trying it with low risk
• FAQ
• Sources

1. Why portfolio chatbots raise a different privacy question

A static PDF resume discloses exactly what is on the page. An interactive portfolio does not. A visitor can ask follow-up questions, rephrase them, and probe for detail, so the effective disclosure surface is the full set of documents behind the assistant, not the summary you wrote.

Generic chatbot privacy advice, the kind that tells consumers to avoid typing sensitive details into a chat window, addresses the wrong direction of risk. In a portfolio the owner is the publisher and the visitor is the one asking. Your concerns are therefore:

1. Over-disclosure: the assistant reveals material you did not intend to surface, such as client names, compensation figures or internal metrics.
2. Over-collection: the platform gains access to more of your storage than the portfolio requires.
3. Over-retention: conversation logs and uploaded evidence persist well beyond their usefulness.
4. Misrepresentation: the model produces a confident statement about your history that your documents do not support.

Each has a technical mitigation, and each is worth examining before you share a public link.

2. Access scope: what the platform can read

Most AI portfolio tools ingest documents through a cloud-storage integration. The permission you grant at that moment is the single most consequential privacy decision in the whole setup.

Google’s developer documentation tells app builders to choose the most narrowly focused scope possible and recommends non-sensitive scopes where feasible, because they grant per-file access. The drive.file scope, used with the Google Picker interface, limits an app to files the user explicitly opens or shares with it. A broad scope that views and manages all files is a different category of grant entirely.

In practice, the consent screen tells you which model you are dealing with:

Before connecting any storage account, read the consent prompt line by line. If it requests permission to view or manage all files, ask the vendor why a portfolio needs that.

A practical habit: create a dedicated folder or a small set of files for the portfolio, and keep drafts, offer letters, performance reviews and anything under a non-disclosure agreement outside it.

3. What the model can infer, and why it matters

Selecting the right files does not end the question. Generative models can combine fragments. NIST’s generative AI risk profile notes that these systems may leak, generate or incorrectly infer sensitive information that a user never disclosed directly, including by connecting scattered data points.

For a portfolio, that has concrete consequences:

• A case study mentioning a team size, a launch quarter and a regional office may let a persistent visitor infer a former employer’s unreleased plans.
• Two documents that individually look harmless, say a project timeline and a budget summary, may together reveal contract value.
• An assistant asked about a gap in your history might speculate rather than decline.

The defensive design principle is grounding: the assistant should answer only from linked evidence and say so when the evidence does not cover the question. A system that cites the source document for each answer gives you something to audit. A system that answers from general model knowledge gives you nothing to check.

A redaction pass worth doing

Before linking a document, scan it for:

• Client or customer names covered by confidentiality terms
• Revenue, salary, equity or pricing figures
• Internal system names, repository URLs and credentials in screenshots
• Personal details of colleagues, such as names in review comments
• Home address, date of birth and other identifiers that a resume convention already discourages

If an achievement matters but the evidence is sensitive, summarize it in a sanitized document and link that instead. Our own post on showcasing work without compromising privacy covers this tradeoff in more depth.

4. Retention and deletion

Encryption protects stored data from outsiders. It does not answer how much data exists to be protected. The FTC’s December 2024 discussion of security through data management makes the point that collection, storage, retention and sharing practices are themselves security decisions.

Enforcement history illustrates it. In the Blackbaud matter, commissioners observed that hoarding data the company did not reasonably need made the consequences of its breach far larger. In the Alexa case, the FTC alleged that deletion requests were not always honored. Neither concerns a portfolio product, but the lesson transfers: what a vendor keeps is what can leak.

For a portfolio chatbot, ask specifically:

1. Are visitor conversations stored, and for how long?
2. If I unlink a document, are its derived data (text chunks, embeddings, summaries) removed as well?
3. If I delete my account, what is deleted, and on what timeline?
4. Can I export my data before leaving?

The second question is the one most vendors skip. Deleting a source file is not the same as deleting every index built from it.

5. Visitor privacy: recruiters are users too

A public chat window also collects data about the people using it. A recruiter who types a question about your salary expectations or a competing candidate is generating information about their own search. Responsible platforms disclose what is logged about visitors and whether that is shared with the profile owner.

As the owner, consider what you would want if you were the visitor. Prefer a platform whose privacy policy states plainly what is collected from anyone who opens your public link, and avoid any setup that asks recruiters to create accounts merely to read your work.

6. AI in hiring: notice, bias and verification

Portfolio chatbots sit adjacent to a wider regulatory conversation about AI in recruitment. Two points matter for professionals.

First, federal anti-discrimination law applies regardless of whether a human or software performs the screening. The EEOC’s materials for workers describe how AI can be used in screening, resume review and chatbot outreach, and testimony at the commission’s January 2023 hearing argued that people subject to automated selection should be told of its use. Disclosure rules vary by jurisdiction and have continued to evolve, so treat any specific obligation as something to confirm for your state or city.

Second, the vendor’s diligence belongs in your evaluation. Testimony to the EEOC suggested asking AI vendors questions such as how bias is remediated and how training data is collected and audited. A portfolio platform may not train its own foundation model, but you can still ask which models process your documents and whether your content is used to train them.

This is also why verification matters. Treat any AI-generated statement about your impact as a draft to check against evidence. Our guide to ethical use of AI career tools expands on how to keep generated material honest.

7. Our perspective

We built Alloquy around a premise that bears directly on privacy: a career claim is more credible when it is connected to a document, and an assistant is safer when it can answer only from what you have linked. Grounding serves recruiters, who receive answers traceable to evidence, and it serves you, because the boundary of what the assistant can say is the boundary of what you chose to connect.

We see three principles as non-negotiable for any portfolio chatbot, ours included:

• The owner controls the corpus. Nothing should enter the assistant’s knowledge unless you linked or added it.
• Answers should be attributable. If the assistant cannot point to evidence, it should not assert.
• Privacy is a configuration, not a promise. You should be able to see and change what is public.

We also encourage a conservative posture. Start with the documents that carry the least risk, review how the assistant answers questions about them, and expand only when the output meets your standard. Our write-up on answering recruiter questions with evidence shows what grounded answers look like in practice.

— Alloquy Team

8. A pre-publish checklist

Run this list before you share a portfolio link with anyone.

Access

• [ ] The consent screen requests access to selected files, not the entire drive.
• [ ] A dedicated folder or file set holds only portfolio material.
• [ ] NDA-covered and employer-confidential documents are excluded or sanitized.

Content

• [ ] Every linked document has been scanned for names, figures and credentials.
• [ ] You have asked the assistant questions a hostile visitor would ask, including about salary, layoffs and your reasons for leaving, and reviewed the answers.
• [ ] Claims in generated text can each be traced to a document.

Retention and control

• [ ] You know how to unpublish the profile quickly.
• [ ] You know whether unlinking a file removes derived data.
• [ ] The privacy policy states what is collected from visitors and how long it is kept.

Review cadence

• [ ] You revisit permissions after each job change.
• [ ] You remove outdated evidence that no longer represents your work.

The adversarial test deserves emphasis. Spend ten minutes trying to make your own assistant say something you would not want repeated. What it does under pressure is what a determined visitor will see.

9. Comparing the main portfolio approaches

Not every format needs a chatbot. Choose according to the sensitivity of your work.

An evidence-linked profile earns its place when your best material is sitting in documents that a resume cannot summarize, such as design reviews, product specs, postmortems and metrics decks. In those cases, the interactive format lets you disclose selectively and on demand, which can be more protective than a long public case study. For examples of how others structure this, see our review of real AI portfolio examples.

10. Trying it with low risk

If you want to test a conversational portfolio without committing sensitive material, begin with a small, sanitized set of documents. Alloquy offers a free profile where you can link evidence, see how the assistant answers, and adjust what you publish. Plan details are on the pricing page. Start with two or three low-risk documents, run the adversarial test from the checklist, and expand from there.

For recruiters, the same discipline applies in reverse. Our piece on recruiter prescreen portfolios describes the items that most reliably prove resume claims without requiring candidates to hand over confidential files.

FAQ

Can a portfolio chatbot see all my Google Drive files?

It depends on the permission you grant. Google recommends that apps request the narrowest scope available, and a per-file scope limits an app to documents you explicitly choose. Read the consent screen before approving, and decline anything that asks to view or manage every file if you only need to share a few.

Can the AI reveal confidential information I did not intend to share?

It can only draw on material you connect, but it may combine details across documents in ways you did not anticipate. NIST’s guidance on generative AI warns about inference from scattered data. Remove sensitive figures and names from linked files, then test the assistant with probing questions before sharing the link.

Is my data used to train AI models?

That varies by platform and by the model provider behind it. Look for a clear statement in the privacy policy, and ask the vendor directly whether your documents or visitor conversations are used for training. If the answer is vague, treat it as a reason to link fewer documents.

What happens to my data when I delete a document or my account?

Ask specifically whether derived data, such as text chunks and indexes built from the file, is removed too. The FTC has treated unnecessary retention as a security concern, so a good vendor documents its deletion practices. Export anything you need before closing an account.

Do employers have to tell me if AI evaluates my application?

There is no single federal rule that covers every case, and requirements differ by state and city. The EEOC has published guidance for workers on AI in employment, and discrimination laws apply to automated tools. For a specific situation, check your state’s rules or consult an employment attorney.

Sources

• Choose Google Drive API scopes, Google for Developers
• NIST AI 600-1: Generative Artificial Intelligence Profile
• FTC: Lenses of security, data management, software development and product design
• FTC: Blackbaud joint statement of Commissioners Khan, Slaughter and Bedoya
• FTC Consumer Advice: Amazon and Alexa users’ privacy
• EEOC: Employment Discrimination and AI for Workers
• EEOC testimony of Adam T. Klein
• EEOC testimony of Gary D. Friedman

Recommended

• 3 Ways to Add a Grounded Portfolio Chatbot Recruiters Trust
• Secure Portfolio Sharing: 5 Checks Before Sending Work to Recruiters
• Portfolio Mistakes Recruiters Catch: Fix Clutter, Prove Impact
• Portfolio QR Code for Professionals: Quick How-To