Privacy Policy

BumpLnk respects your privacy.

This Privacy Policy explains what personal information we collect, why we process it, how it may be shared, how long it may be retained, and the choices and rights available to you.

BumpLnk acts as the personal information controller for information that BumpLnk determines how and why to process.

Depending on how you use BumpLnk, we may process:

• Account information: email address, username, display name, authentication information, and account type.
• Policy agreement records: account identifier, policy release version, and the time your agreement was recorded.
• Profile information: biography, profile and cover images, social links, websites, custom links, contact information, and other content you add.
• Business information: business name, address, telephone number, hours, map information, services, links, digital menu items, prices, menu images, and photos you submit for menu import.
• NFC information: card identifier, card type, activation or claim status, profile association, and information needed to manage the card-account relationship.
• Order information: meetup arrangements, product and customization details, proof approvals, handover date, payment confirmation, ownership evidence, and replacement or purchase-support information. We currently take payment after in-person handover, without online checkout or advance payment.
• Support communications: information provided for support, refunds, complaints, security issues, or other inquiries.

Do not upload sensitive personal information unless it is genuinely necessary and appropriate for your intended profile.

BumpLnk is built around shareable digital profiles. Information you intentionally publish may be publicly accessible, including your username, name or business name, images, biography, links, location, contact details, hours, and other information you choose to display. Assume public profile information can be viewed, copied, shared, or saved by others.

When you access BumpLnk, we and our service providers may process technical information such as IP address, browser type, device information, operating system, timestamps, requested pages, diagnostic logs, and security events. We use this information to operate the service, prevent abuse, investigate errors, and protect accounts. The application also uses Vercel Web Analytics and Speed Insights to measure page usage and site performance, including page URLs, referrers, device/browser categories, and performance measurements. Avoid placing private information in URLs. If our analytics or tracking practices change, we will update this Policy and provide any notices or choices required by law.

We may process personal information to:

• provide, maintain, and improve BumpLnk;
• create and authenticate accounts;
• activate and manage NFC cards;
• provide and display digital profiles;
• generate editable menu drafts from photos and publish menus you approve;
• record and verify agreement to a policy release;
• process orders and customer requests;
• deliver support and respond to inquiries;
• prevent fraud and abuse and protect accounts and infrastructure;
• diagnose technical problems and enforce our Terms;
• communicate important account or service information;
• comply with lawful requests and legal obligations; and
• establish, exercise, or defend legal claims.

Depending on the circumstances, we may process personal information because it is necessary to provide a service or perform a contract, you have provided valid consent, it is necessary to comply with a legal obligation, or it is necessary for a legitimate business interest that is not overridden by your rights and freedoms. Where processing relies on consent, you may withdraw consent subject to applicable law and processing that remains necessary under another lawful basis.

A BumpLnk NFC card may contain or reference an identifier used to locate or connect to a BumpLnk profile. We use card information to determine card status, establish authorized association, prevent unauthorized claims, and route taps to the correct experience. A card identifier is not a password; account security is handled separately through authentication systems.

Our current application uses Supabase for database, authentication, and file storage; Vercel for hosting, Web Analytics, and Speed Insights; and Resend for service email delivery. Google authentication is optional, and Google provides identity details such as your email, name, and avatar when you sign in with it.

If you choose photo menu import, the normalized menu photo and import instructions are sent to Google Gemini to produce a draft. The application requests that the interaction not be stored, but this does not guarantee that Google keeps no operational or security records. Provider processing and retention are also governed by its applicable terms. Only use photos you are authorized to submit and remove unnecessary personal or sensitive details first. Ordinary manual menu editing does not require this photo import.

Providers process information needed to deliver their services. We may disclose information when required by valid law or reasonably necessary to protect BumpLnk, its users, or the integrity of the service. We do not sell personal information. Our current meetup sales do not use a website payment processor.

Some providers may operate infrastructure outside the Philippines. Personal information may therefore be processed or stored in other countries. Where applicable, we take reasonable steps to use providers and arrangements intended to provide appropriate safeguards.

We retain personal information only as long as necessary for the purpose for which it is used. Account, profile, menu, and policy agreement records are normally retained while your account exists. Account deletion removes the account's policy agreement records; it is not a permanent archive of your identity. Separate purchase and support records may need to remain to fulfill replacement commitments, meet accounting or legal requirements, prevent fraud, or resolve a specific dispute. Retention is assessed by the applicable obligation, unresolved issue, and whether identifiable information is still necessary. Residual provider backups and security logs follow the relevant provider's retention and deletion arrangements and may not disappear immediately with active account deletion. We do not promise an unverified fixed backup-deletion period. Contact us for information about a specific record or request.

We use reasonable technical and organizational safeguards intended to protect personal information against unauthorized access, alteration, loss, misuse, and disclosure. Measures may include authentication controls, database restrictions, encrypted network connections, authorization rules, infrastructure controls, and limited administrative access. No internet-based service can guarantee absolute security. Contact us immediately if you believe your account or information has been compromised.

BumpLnk uses cookies or similar browser technologies for authentication, security, session management, preferences, and website operation. Vercel Web Analytics is designed to measure usage without analytics cookies; Speed Insights measures site performance. These tools are currently integrated, rather than merely planned. Their data processing is described above. Any additional consent or controls legally required for a processing activity will be provided separately; acknowledging this Policy is not blanket consent to every use of personal information.

Under the Philippine Data Privacy Act and applicable NPC rules, data subjects may have rights to:

• be informed about processing;
• access personal information;
• object to certain processing;
• correct inaccurate information;
• request erasure or blocking in appropriate circumstances;
• obtain data portability where applicable;
• withdraw consent where consent is the basis of processing;
• seek damages in circumstances recognized by law; and
• file a complaint with the National Privacy Commission.

Rights may be subject to lawful limitations or exceptions. To exercise a right, contact hello@bumplnk.click. We may verify your identity before fulfilling a request.

You may use account deletion in your dashboard or on the policy review screen, or contact BumpLnk. You do not need to accept a new policy version to delete your account; identity verification is still required. Deletion disables your public profile and associated card routing and removes associated content from active systems. Possession of a physical card does not preserve hosting after deletion or automatically entitle it to reassignment. Separate records and residual provider copies may remain only as described in the retention section.

BumpLnk profiles may link to third-party websites and services. This Policy does not govern those third parties. When you leave BumpLnk, the destination service's privacy policy applies.

BumpLnk accounts are currently intended for users at least 18 years old. We do not knowingly offer account registration directly to children. If you believe a minor has provided personal information contrary to this Policy, contact us so the matter can be reviewed.

We may preserve or disclose information where reasonably necessary to comply with applicable law, a valid court order, subpoena, lawful government request, or other legal obligation. We may also process information to protect the rights, security, or integrity of BumpLnk and its users, subject to applicable law.

We may update this Policy when our products, technology, providers, or legal obligations change. The current version shows its effective date at the top. Where a change materially affects how personal information is processed, we may provide additional notice when appropriate.

Privacy contact: hello@bumplnk.click.

You may also contact or file an appropriate complaint with the National Privacy Commission of the Philippines regarding rights provided by the Data Privacy Act.