DuiLink Privacy Policy
This policy applies exclusively to the DuiLink service (account registration, Google sign-in, digital card management, public URL, QR, NFC, vCard and the DuiLink Android app).
1) Controller and contact
Data controller: Fabio Giuliodori. DuiLink is the service published on duilio.cc. Privacy contact: info@duilink.cc.
2) Data processed
- Account data: email, hashed password, technical timestamps (creation, login, activity).
- Data collected via Google sign-in: email address and basic profile information, when provided by Google.
- Card/MyPage data: first name, last name, email, phone number, company, website, address, social profiles, photo, logo and other optional details entered by the user.
- Technical security data: hosting and application logs, data needed for rate limiting, security, abuse prevention and error diagnostics.
- Service email data: account verification, password resets, operational notifications and messages related to use of the service.
MyPage is a personal page reachable by users who know the link, scan the QR code or use an NFC support configured by the user. The URL is generated with a non-trivial code and the page is not intended for search engine indexing.
Users are responsible for their own or third parties’ personal data entered, published or shared through their MyPage.
Data, links and contacts entered in the MyPage, including social profiles, WhatsApp, email, phone numbers, addresses, images and logos, may become visible to anyone who opens the MyPage through link, QR or NFC.
3) Google sign-in (OAuth)
DuiLink supports sign-in with Google accounts. During Google sign-in, we collect:
- Email address associated with the Google account.
- Basic profile information, when available and provided by Google.
These data are used only to:
- Authenticate the user.
- Create or link the DuiLink account.
- Allow access to the personal area and MyPage.
DuiLink does not use Google-provided data for marketing, profiling or advertising and does not share them with third parties, except technical providers strictly required to deliver the service.
3-bis) DuiLink Android app
The DuiLink Android app displays the DuiLink web service inside an authenticated WebView and adds native actions to copy, share and write the public DuiLink URL to NFC tags. The app does not use NFC to read personal data from third-party tags: the NFC feature locally writes the user's selected public DuiLink URL to the tag.
The app uses Internet access to load DuiLink, keep the sign-in session through technical cookies and open the service pages required by the user. When the user uses Android sharing, the public URL is passed to the operating system and to the app selected by the user to complete the share action.
4) Purposes and legal bases
- Provision of the DuiLink service: accounts, authentication, card publishing, QR, NFC, vCard, password resets and MyPage management.
- Google OAuth sign-in, if chosen by the user.
- Application security, abuse prevention, service protection and technical diagnostics.
- Technical and service communications related to the account.
- Legal bases: performance of the service requested by the user, consent where necessary, compliance with legal obligations and legitimate interest in service security.
5) Retention
Data are retained for the time necessary to provide the service. For inactive accounts, MVP operational policy provides a 12-month retention period followed by a scheduled purge process.
Some technical data, logs or backups may be retained for as long as strictly necessary for security, maintenance, technical recovery or legal obligations.
6) Third-party processing
Data may be processed by strictly necessary infrastructure providers (for example OVH hosting, email services, Google OAuth technical authentication services) as technical processors/sub-processors or providers required for service operation.
Data are not sold to third parties.
When the user enters links to third-party services or uses buttons that open external apps, such as social networks, WhatsApp, email, maps, Android sharing apps or external voluntary contribution platforms, any subsequent processing depends on the service selected or opened by the user.
7) Data subject rights
You can exercise your rights under applicable law by writing to info@duilink.cc. These include access, rectification or updates, deletion where provided for, restriction of processing, objection where provided for, portability where technically applicable, and withdrawal of consent where processing relies on consent. A self-service account/card deletion flow is available in the account area. If you believe processing violates applicable law, you may file a complaint with the competent supervisory authority, including the Italian Data Protection Authority.
8) Cookies
Operational card-opening statistics use daily aggregate counters by link type. These counters contain no IP addresses, emails, individual URLs or visitor identifiers and are retained as aggregate history. The session already used by the website temporarily holds references to prevent repeated counts within 30 seconds and recognise a card redirect within 60 seconds, without adding cookies or building browsing profiles.
DuiLink uses strictly necessary technical session cookies for authentication and security. It does not use profiling or advertising cookies.
| Tool | Use | Indicative duration |
|---|---|---|
| PHP/DuiLink session cookie | Account access, session security and personal area operation. | Session or technical duration configured by the service. |
| Remember/login and OAuth state cookies | Login preference, login flow protection and Google OAuth connection. | Limited to the time required by the feature. |
| localStorage | Temporary builder draft, language preference, MyPage Home installation state when supported by the browser. | Until the user clears browser data or the draft is overwritten/removed. |
| sessionStorage | Temporary navigation handling or preferences valid only during the browser session. | Until the browser session is closed. |
9) Profiling and automated decision-making
DuiLink does not engage in commercial profiling or show behavioral advertising, and does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for the user.
10) Purpose/legal basis/retention matrix
| Purpose | Legal basis | Retention |
|---|---|---|
| Account registration and management | Performance of the service requested by the data subject | For the account lifetime; then according to operational retention policy |
| Google OAuth sign-in | Performance of the service requested by the data subject and consent to Google sign-in | For the account lifetime; then according to operational retention policy |
| Application security (anti-abuse, diagnostics, hardening) | Legitimate interest in service security | For the strictly necessary time related to security purposes |
| Publication of the digital card, QR, NFC, public URL and vCard | Performance of the service requested by the user | While the profile is active or until deletion is requested |
| Technical emails and service communications | Service performance and legitimate operational interest | For the time necessary to manage the account and technical communications |
11) Backup, restore and incident management
We apply operational backup and periodic restore procedures, plus a data breach runbook with decision tracking within the timelines required by applicable law.
12) Privacy request handling (DSAR)
Privacy requests are handled through a dedicated tracked procedure. To exercise your rights, write to info@duilink.cc with subject line "DuiLink privacy request".
13) Periodic cookie/third-party service review
We periodically review third-party components to ensure consistency with this policy about technical cookies and absence of profiling.
14) Service terms
DuiLink use is also governed by the DuiLink Terms, which define content rules, user responsibilities and abuse reporting.
15) Changes to this privacy notice
This notice may be updated over time for technical, regulatory or organizational reasons. The latest version will always be published on this page with the date of last update.