Privacy Notice

1. Data Controller Information

This Privacy Notice explains how [INSERT COMPANY / ENTITY NAME] ("we", "us", or "our") collects, uses, and shares personal data when you use the mono NFC Card platform and digital portfolio service.

If you have questions regarding this notice or wish to exercise your data subject rights, please contact our Data Protection Officer / Privacy Team at [INSERT PRIVACY EMAIL].

2. Personal Data We Collect

We collect and store information in the following categories:

3. Third-Party Service Providers (Subprocessors)

To provide this application securely and reliably, we engage trusted technical service providers who process data strictly on our behalf:

• Supabase Inc.: Relational database (PostgreSQL), user authentication, and secure encrypted cloud asset storage.
• Netlify Inc.: Application hosting, edge compute functions, and encrypted HTTPS delivery.
• Resend Inc.: Transactional email delivery for account email verification, visitor inquiries, and card expiration reminders.
• Upstash Inc.: Serverless Redis caching used strictly for IP rate-limiting to prevent brute force and denial-of-service attacks.

4. Purposes of Processing

We process your personal data for the following purposes:

• To activate and link your physical NFC hardware card to your digital portfolio.
• To render your chosen public portfolio to visitors who scan your card.
• To relay networking inquiries and contact exchanges directly to your email.
• To manage subscription validity, process renewal proofs, and protect service integrity.

5. Data Retention & Archival

Your portfolio remains live during your active validity term and for a 14-day grace period following expiration. After the grace period, your public portfolio transitions to an inactive state where no personal information is displayed to visitors and search engines are instructed not to index the page.

Accounts remaining inactive for more than 90 days past validity expiration become eligible for permanent deletion to minimize unneeded data storage.

6. Your Rights: Self-Service Export & Deletion

You have full control over your personal information directly within your account:

• Right to Data Portability / Export: You can download a complete JSON archive of your personal profile, contacts, project data, and payment logs at any time from your Account Settings.
• Right to Erasure / Deletion: You can permanently delete your account at any time. Confirming deletion immediately wipes your profile, cascades deletion through all database records, unlinks your card, and recursively removes all photos and receipts from storage buckets.
• Right of Rectification: You can edit any field of your profile instantly via the dashboard.

7. Data Security

We implement industry-standard security controls including Row Level Security (RLS) policies at the database layer, encrypted HTTPS transmission, private storage buckets for payment proofs with short-lived signed URLs (5-minute expiry), and cryptographic hashing of activation codes.