Privacy Policy

Account information. When you sign up, our authentication provider stores your email address and a securely hashed password — we never store your password in plain text and can't read it back.

Profile information you choose to publish. Everything you fill in on your dashboard is visible on your public profile — you control exactly what's there:

• Name, job title, company, phone number, and email
• A tagline, a bio, and one custom call-to-action button
• A list of custom links, and social handles you connect (Instagram, Facebook, TikTok, LinkedIn, X, Threads, Pinterest, and others)
• Your profile photo and any portfolio project images, descriptions, and links
• Your chosen profile template

Card and claim data. Each physical card carries a short, unique code; claiming a card links that code to your account. The card itself stores only that code — no personal data is written to the NFC chip.

Anonymous visit counts. When someone taps or scans your card, we log the card's code and a timestamp so we can show you a view count. We do not log the visitor's IP address, device information, or identity — there is nothing to tie a view back to a person.

Device-trust login data. If you choose to remember a device for faster sign-in, we store a device identifier, an optional label you give it, and a salted hash of a one-time PIN — never the PIN itself.

Keychain orders. If you order a Social Media Keychain, we collect the customer name, phone/email you provide, and the social profile links you submit so we can program the keychain.

• To operate and display your public profile when your card is tapped or scanned
• To let you generate a “save to contacts” vCard from your profile
• To show you your own card’s view counts
• To fulfill physical card and keychain orders
• To respond to support requests

We do not sell your personal data, and we do not use your profile content for advertising or ad targeting.

Your public profile page is, by design, visible to anyone who taps or scans your card or who has its link — that's the point of the product. You control every field that appears on it, and nothing is published unless you enter it yourself.

Your account email, password, and dashboard are private to you. Konek+ administrators can access account-level data only as needed to provide support or investigate abuse, and are themselves subject to the same database-level access controls described below — not just an app-level login screen.

• Every table in our database enforces row-level security (RLS) at the database layer, not just in the application, so a request can only read or write rows it is authorized for — independent of any bug in the app itself
• Data is encrypted in transit (TLS) between your device, our servers, and our database
• Account passwords are hashed by our authentication provider; device-trust PINs are stored only as salted hashes
• Uploaded images (avatar, portfolio) are stored in access-scoped storage tied to your account

We are not currently ISO 27001 or SOC 2 certified ourselves, and we won't claim otherwise. Our infrastructure providers — Supabase and Vercel — maintain their own independent compliance programs as our sub-processors; details are available directly from those providers. We will update this section if and when Konek+ itself completes an independent certification.

• Supabase — database, authentication, and file storage
• Vercel — application hosting
• Cloudinary — image hosting for site and marketing assets

• We keep your account and profile data for as long as your account is active
• Deleting your account removes your profile and portfolio items, and unlinks any cards from it (they revert to unclaimed)
• Anonymous view-count records are kept in aggregate and periodically pruned; they can never be tied back to a visitor’s identity because we never collected one

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can already do most of this yourself from your dashboard — edit or remove any profile field, delete portfolio items, or download your vCard.

For anything else, including full account deletion, contact us at privacy@konek.plus. If you're in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.

Konek+ is not directed to children, and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we'll remove it.

Our infrastructure providers may process and store data outside your country of residence. Where required, we rely on the safeguards those providers offer for cross-border transfers.

We'll update the date at the top of this page whenever this policy changes. For material changes, we'll make reasonable efforts to notify account holders directly.

Questions about this policy or your data: privacy@konek.plus. See also our Terms of Service.