Privacy Policy

1. Information We Collect

We collect only the personal information necessary to deliver, maintain, and secure our services. This information falls into three categories:

2. How We Use Your Information

We process personal information for the following specific purposes:

• To create and manage your NFCraft user account.
• To manufacture, customize, and calibrate physical NFC business cards.
• To publish and display your digital business profile at your designated subdomain.
• To route dynamic QR codes and NFC card taps to your active profile or chosen destination.
• To send critical transactional messages, such as email verifications and password reset links.
• To provide customer support and respond to inquiries.
• To maintain platform security, prevent abuse, and enforce tenant isolation.

3. Legal Bases for Processing

Under Section 12 of Republic Act No. 10173, our processing of personal data relies on the following lawful bases:

• Performance of a Contract: Processing is necessary to provide the services described in our Terms and Conditions, including account management, profile hosting, and card pairing.
• Legitimate Interests: Processing is required to protect platform security, prevent unauthorized access or fraud, and maintain operational stability.
• Consent: For information that you voluntarily choose to publish on your public digital profile, and for voluntary inquiries sent via our contact form.
• Compliance with Legal Obligations: Processing required to comply with applicable Philippine tax, accounting, commercial, or regulatory obligations.

4. Public Digital Profiles and Search Visibility

Information in your private dashboard remains confidential and accessible only through your authenticated login. However, when you choose to publish a digital profile, the information placed on that profile becomes publicly visible to anyone who taps your NFC card, scans your QR code, or navigates to your public link.

NFCraft includes a search engine visibility control in your dashboard settings. When disabled, your published profile emits a noindex, nofollow directive instructing major search engines not to index your profile in public search results.

5. Third-Party Service Providers

We do not sell, rent, or trade personal information to advertisers or data brokers. We share data only with verified infrastructure providers who support our core operations under strict confidentiality and security terms:

• Supabase: Provides cloud database hosting, user authentication, asset storage, and Row Level Security enforcement.
• Vercel: Provides web application hosting, edge network routing, SSL/TLS certificates, and content delivery.
• Resend: Provides transactional email delivery for account confirmations and password resets.

6. Cookies and Local Storage

NFCraft uses only essential first-party session and authentication cookies issued by our authentication infrastructure (such as secure session tokens). These are strictly necessary for you to log in, navigate between dashboard pages, and maintain your active session.

We do not use third-party tracking pixels, advertising cookies, or cross-site tracking scripts.

7. Data Security Safeguards

We maintain reasonable physical, technical, and organizational measures pursuant to National Privacy Commission guidelines to protect personal data from accidental loss, unauthorized access, or unlawful alteration:

• Multi-Tenant Row Level Security: Database-level access controls strictly isolate customer data, preventing any user from accessing another account's records.
• Encrypted Transmission: All data transmitted between your browser and our servers is encrypted using modern TLS (HTTPS).
• Sandboxed Previews: Customer-designed digital profile previews run in isolated sandboxed environments to prevent cross-site scripting.
• Credential Protection: Account passwords are automatically salted and hashed before storage.

8. Data Retention

We retain personal data for as long as your account remains active and as necessary to deliver our services, resolve disputes, and comply with statutory requirements. When you delete a card, unpublish a profile, or request account termination, associated records and pairings are removed or deactivated from active operational databases.

[Note: Specific retention schedules for transactional and backup records are subject to owner confirmation: registered retention schedule.]

9. International Data Transfers

Our cloud service providers (Vercel and Supabase) operate secure data centers that may store or process data outside the Philippines (such as Singapore or the United States). By using NFCraft, you acknowledge that your information may be processed in facilities that maintain industry-standard security certifications (SOC 2, ISO 27001).

10. Your Privacy Rights Under Philippine Law

Under Section 16 of the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights as a data subject:

• Right to be Informed: The right to know how your personal data is collected, handled, and processed.
• Right to Access: The right to request reasonable access to your personal information in our possession.
• Right to Rectification: The right to correct inaccurate or outdated information through your account dashboard.
• Right to Erasure or Blocking: The right to request the suspension, withdrawal, or deletion of your personal data upon legitimate grounds.
• Right to Object: The right to object to processing based on consent or legitimate interests.
• Right to Data Portability: The right to obtain a copy of your personal data in an electronic, structured format.
• Right to File a Complaint: The right to file a formal complaint with the National Privacy Commission (NPC) if you believe your privacy rights have been violated.

11. Children's Privacy

NFCraft is intended for professionals, businesses, and individuals who are at least 18 years of age or the age of legal majority in their jurisdiction. We do not knowingly collect personal information from individuals under 18 years of age.

12. External Links and Destinations

Published digital profiles and dynamic QR codes may link to third-party websites or services (such as external social media profiles, payment pages, or portfolios). NFCraft is not responsible for the privacy practices, content, or policies of external sites.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect service updates or regulatory developments. When revisions are made, the "Last updated" date at the top of this document will be updated. For material changes, we will provide notice through the dashboard or by email where appropriate.

14. Contact Information

To exercise your privacy rights, request data correction or deletion, or ask questions regarding our privacy practices, please contact us: