Privacy Policy

1. Data Controller

The data controller responsible for your personal data is profilekit.me, operated from Spain. For any questions regarding your data, you can contact us at privacy@profilekit.me.

2. Data We Collect

• Account data: email address, username, display name, and avatar when you create an account.
• Profile content: bio, links, social media handles, and any other content you add to your public profile page.
• Usage data: anonymized page views and interaction data collected through Vercel Analytics (only with your consent).
• Payment data: payment information is processed directly by Stripe. We do not store your credit card details.

3. Legal Basis for Processing

• Contract performance: processing your account data is necessary to provide the service you signed up for.
• Consent: analytics cookies are only activated with your explicit consent, as required by the LSSI-CE.
• Legitimate interest: ensuring security and preventing fraud.

4. How We Use Your Data

• To provide, maintain, and improve the service.
• To process payments and manage subscriptions through Stripe.
• To analyze usage patterns and improve user experience (with consent).
• To ensure security and prevent abuse.
• To communicate important service updates.

5. Third-Party Services

We use the following third-party services to operate profilekit.me:

• Supabase: authentication and database hosting (EU region).
• Stripe: payment processing. Subject to Stripe's Privacy Policy.
• Vercel Analytics: privacy-friendly, anonymized website analytics (only with consent).
• Google Fonts: fonts are downloaded at build time and served from our own domain. No requests are made to Google's servers at runtime.
• Embedded content: user profiles may embed content from YouTube, Vimeo, Spotify, and other platforms. These embeds may set their own cookies.

6. Cookies

We use cookies as described below. Non-essential cookies are only activated with your explicit consent, in compliance with the LSSI-CE.

7. Data Retention

We retain your account data for as long as your account is active. When you delete your account, all associated personal data is permanently removed within 30 days. Analytics data is anonymized and cannot be linked back to you. Payment records may be retained as required by applicable tax and accounting laws.

8. Your Rights (GDPR Art. 15–22)

Under the GDPR, you have the following rights regarding your personal data:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: restrict processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: withdraw consent for analytics cookies at any time via the cookie settings.

To exercise any of these rights, contact us at privacy@profilekit.me. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. International Data Transfers

Some of our third-party service providers may process data outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Children's Privacy

profilekit.me is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

12. Contact

If you have any questions about this Privacy Policy or your personal data, please contact us at privacy@profilekit.me.

Terms of Service