Privacy policy

The full identifying details of the data controller are listed in the Legal Notice. You can contact us at: contacto@linkidnfc.com. Legal notice

Depending on how you use LinkID, we collect:

• Account: name, email and password (managed securely by our authentication provider).
• Order: contact email, shipping address and phone number, so we can deliver your physical card and the carrier can notify you about the delivery. If you buy as a company and provide it, we also keep the company name and tax ID so they appear on the invoice. We use this data to issue the invoice for each purchase and email it to you. Payment is processed directly by Stripe — we never store your card details.
• Card profile: whatever you choose to publish when setting it up — this can include health information, emergency contacts (another person's name and phone number), or your pet's details. This is data you enter voluntarily and choose whether to make public.
• Scans: date, approximate country/city (via IP) and browser type each time a card is scanned, for statistics. We do not identify the person scanning.
• "Found" alerts: if someone taps "I found..." on a pet, person or belongings card, we ask for their precise GPS location (with their browser's permission) so we can share it with you and help with the reunion. It's a one-off data point from that person — we don't identify them beyond that location.
• Contact via "Exchange": if someone leaves their details through the "Exchange" button on a professional card, we store their name, email and, if they add them, phone and company, to share with that card's owner from their account dashboard.
• Contact form: your name, your email, the subject you choose and the message you write, plus your browser language, which is only used to tailor the reply. The message is sent by email to our mailbox; it is not stored in our database.
• Abuse protection: when you send the contact form, leave your details through "Exchange", or report that you've found someone, we store your IP address alongside a submission counter. Its only purpose is to stop automated mass submissions, which would otherwise make the service unusable for everyone else. It is not linked to your account or combined with any other data, and it deletes itself within a few hours.

Health information or emergency contact details you include in your card's profile are "special category" personal data (GDPR art. 9). They are only published if you tick the explicit consent box in the health section of the editor; we store the date you do so. By doing so you consent to them being shown to whoever scans the card, solely to help in an emergency. You can withdraw consent at any time by deleting that information from the profile or turning off its visibility. If you include another person's data (e.g. an emergency contact), you are responsible for having their consent or another valid legal basis for that purpose.

• Managing your account and order: performance of a contract (GDPR art. 6.1.b).
• Showing your public profile: explicit consent (GDPR art. 6.1.a and art. 9.2.a for health data).
• Scan statistics: legitimate interest (GDPR art. 6.1.f).
• Per-IP submission limits on the public forms: legitimate interest in protecting the service from abuse (GDPR art. 6.1.f).
• GPS location when reporting a found pet: explicit consent of the person sharing it, given by granting their browser's location permission (GDPR art. 6.1.a).
• Contacts saved via Exchange: explicit consent of the person filling in the form (GDPR art. 6.1.a).
• Answering the enquiries you send through the contact form: consent of the person sending it (GDPR art. 6.1.a). If the enquiry concerns an order of yours or a purchase you are considering, also performance of a contract or pre-contractual steps taken at your request (GDPR art. 6.1.b).
• Complying with legal obligations (invoicing, tax): legal obligation (GDPR art. 6.1.c).

We use the following providers as data processors, all under a data processing agreement or standard contractual clauses when data is transferred outside the European Economic Area:

• Supabase — database and authentication (hosted in the EU, Ireland/eu-west).
• Stripe — payment processing.
• Resend — transactional emails (order confirmation, shipping) and delivery of contact form messages to our mailbox.
• Vercel — website hosting.
• DeepL — automatic Spanish-English translation of the free-text fields you write on your cards (tagline, description, notes, rules, job title, medical information and similar), and your pet’s details. You can turn it off on each card. On personal-protection and workplace-safety cards, which may include health data, nothing is sent unless you tick the optional box that allows it (art. 9.2.a GDPR). Names, addresses, phone numbers, emails and links are never sent.
• ImprovMX — forwarding to our mailbox of the emails you send to our @linkidnfc.com addresses.
• Holded — invoicing and accounting: receives your name or your company name, email, phone number, address and tax ID (if you provide it), plus the products and amounts of your purchase, to issue the invoice and email it to you.
• The carrier that delivers your order — receives your name, delivery address and phone number, solely to carry out the delivery.

We keep your account and profile data for as long as your account remains active. Order and invoice data is kept for 6 years from the end of the financial year of the purchase, which is the period set by the Spanish Commercial Code (art. 30) and also covers the 4 years required by tax law (art. 66 of the General Tax Act). Even if you delete your account, the order is kept for that period, blocked and used only to meet those obligations or handle claims; after that, we delete it. You can request deletion of your account and profile at any time.

Contact form messages are kept for as long as needed to answer your enquiry and, afterwards, for as long as they may be needed to respond to possible claims.

The per-IP submission counters described in section 2 are the exception: they are deleted automatically within a few hours, as soon as they stop serving the one purpose they exist for.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to contacto@linkidnfc.com. You also have the right to file a complaint with the Spanish Data Protection Agency (aepd.es) if you believe the processing does not comply with regulations.

The service is not directed at children under 14. If you become aware that a child under that age has created an account without parental or guardian authorization, please contact us so we can remove it.

We apply reasonable technical and organizational measures to protect your data, including encryption in transit, passwords managed securely by our authentication provider, and restricted access control to our admin panel.