Privacy policy

The full identifying details of the data controller are listed in the Legal Notice. You can contact us at: contacto@linkidnfc.com. Legal notice

Depending on how you use LinkID, we collect:

• Account: name, email and password (managed securely by our authentication provider).
• Order: contact email and shipping address, so we can deliver your physical card. Payment is processed directly by Stripe — we never store your card details.
• Card profile: whatever you choose to publish when setting it up — this can include health information, emergency contacts (another person's name and phone number), or your pet's details. This is data you enter voluntarily and choose whether to make public.
• Scans: date, approximate country/city (via IP) and browser type each time a card is scanned, for statistics. We do not identify the person scanning.
• "Found pet" alerts: if someone taps "I found..." on a pet card, we ask for their precise GPS location (with their browser's permission) so we can share it with you and help with the reunion. It's a one-off data point from that person — we don't identify them beyond that location.
• Contact via "Exchange": if someone leaves their details through the "Exchange" button on a professional card, we store their name, email and, if they add them, phone and company, to share with that card's owner from their account dashboard.
• Abuse protection: when you send the contact form, leave your details through "Exchange", or report that you've found someone, we store your IP address alongside a submission counter. Its only purpose is to stop automated mass submissions, which would otherwise make the service unusable for everyone else. It is not linked to your account or combined with any other data, and it deletes itself within a few hours.

Health information or emergency contact details you include in your card's profile are "special category" personal data (GDPR art. 9). By entering them and marking the profile public, you give explicit consent for them to be shown to whoever scans the card, solely to help in an emergency. If you include another person's data (e.g. an emergency contact), you are responsible for having their consent or another valid legal basis for that purpose.

• Managing your account and order: performance of a contract (GDPR art. 6.1.b).
• Showing your public profile: explicit consent (GDPR art. 6.1.a and art. 9.2.a for health data).
• Scan statistics: legitimate interest (GDPR art. 6.1.f).
• Per-IP submission limits on the public forms: legitimate interest in protecting the service from abuse (GDPR art. 6.1.f).
• GPS location when reporting a found pet: explicit consent of the person sharing it, given by granting their browser's location permission (GDPR art. 6.1.a).
• Contacts saved via Exchange: explicit consent of the person filling in the form (GDPR art. 6.1.a).
• Complying with legal obligations (invoicing, tax): legal obligation (GDPR art. 6.1.c).

We use the following providers as data processors, all under a data processing agreement or standard contractual clauses when data is transferred outside the European Economic Area:

• Supabase — database and authentication, including Google sign-in (hosted in the EU, Ireland/eu-west).
• Stripe — payment processing.
• Resend — transactional emails (order confirmation, shipping).
• Vercel — website hosting.

We keep your account and profile data for as long as your account remains active. Order data is kept for the period required by tax and commercial regulations. You can request deletion of your account and profile at any time.

The per-IP submission counters described in section 2 are the exception: they are deleted automatically within a few hours, as soon as they stop serving the one purpose they exist for.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to contacto@linkidnfc.com. You also have the right to file a complaint with the Spanish Data Protection Agency (aepd.es) if you believe the processing does not comply with regulations.

The service is not directed at children under 14. If you become aware that a child under that age has created an account without parental or guardian authorization, please contact us so we can remove it.

We apply reasonable technical and organizational measures to protect your data, including encryption in transit, passwords managed securely by our authentication provider, and restricted access control to our admin panel.