1. Privacy at a glance
Pfcard.link is a free service that lets users create a public profile page with their links. We do not use any analytics or advertising services (no Google Analytics, no tracking pixels, no advertising cookies), and profile pages do not embed any third-party content that loads without you taking action.
Below we explain which personal data we nevertheless process, for what purpose, on what legal basis and for how long. Personal data is any data that can be used to identify you personally.
2. Controller
The controller responsible for data processing on this website is the operator named in the “Controller” box. For any questions about data protection and to exercise your rights, you can reach us using the contact details given there.
3. Your rights
Within the scope of the law, you have the right at any time to:
- access the data we hold about you (Art. 15 GDPR),
- have inaccurate data rectified (Art. 16 GDPR),
- have your data erased (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- data portability, i.e. receive the data you provided in a common, machine-readable format (Art. 20 GDPR),
- withdraw consent you have given, with effect for the future (Art. 7(3) GDPR); processing carried out before the withdrawal remains lawful,
- lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).
Right to object (Art. 21 GDPR)
Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
4. Providing the website
Hosting
This website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The server is located in a netcup data centre in Nuremberg, Germany. All data arising from operating the website – such as server log files, account data, profile content, uploaded images and visitor statistics – is stored and processed on netcup's servers. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our service reliably. Where data from your user account is concerned, Art. 6(1)(b) GDPR is an additional legal basis. For more information, see netcup's privacy policy.
Server log files
Every time this website is accessed, the server automatically records information transmitted by your browser: IP address, date and time of the request, page requested, referring page (referrer), browser type and version, and operating system. This data is technically necessary to display the website to you and to keep it running securely (e.g. to fend off attacks and analyse errors). The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 30 days at the latest.
Cloudflare
We use the network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare acts as a so-called reverse proxy: all requests to this website, including profile pages, first pass through Cloudflare's servers and are only then forwarded to our server. In doing so, Cloudflare processes in particular your IP address, the address requested, the time and technical information about your browser (e.g. the user agent) in order to deliver the website quickly and protect it against attacks and abuse. For this purpose, Cloudflare may also set technically necessary security cookies (e.g. “__cf_bm” or “cf_clearance”).
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website quickly, reliably and securely. Cloudflare may also process data in the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). For more information, see Cloudflare's privacy policy.
5. Cookies and local storage
We do not use cookies for analytics, statistics or advertising. We only use cookies that are strictly necessary for the features you use. Storing them on your device does not require consent (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); the further processing is based on Art. 6(1)(b) GDPR (user account) or Art. 6(1)(f) GDPR (secure operation, your language choice).
| Cookie | Purpose | Storage period |
|---|---|---|
| Session cookie (name ends in “-session”) | Links your requests to a session, e.g. to keep you logged in to your account or to process form input. | 2 hours after your last activity |
| XSRF-TOKEN | Protects forms against cross-site request forgery attacks. | 2 hours after your last activity |
| remember_web_… | Only if you choose “Remember me” when logging in: keeps you logged in. | until you log out, at most approx. 400 days |
| lang | Stores the language you selected with the language switcher. | 1 year |
For each session, we store the session data on the server in our database, including your IP address, your browser's user agent and the time of your last activity. Expired sessions are deleted automatically on a regular basis.
In the user area, the display mode you choose (light, dark or system) is stored in your browser's local storage. This setting never leaves your device.
You can configure your browser to refuse or delete cookies. Without the session cookie, however, you cannot log in.
6. Registration and user account
When you create an account, we process your username, your email address and your password. We only store the password as a cryptographic hash, never in plain text. We also store when your account was created and last changed, and when you were last active in the user area.
We use this data to provide your account, to log you in and, on request, to email you a link to reset your password. For the reset, we store your email address together with a hashed one-time token that expires after 60 minutes. The legal basis is Art. 6(1)(b) GDPR. Username, email address and password are required for an account; without them we cannot provide one.
We keep your account data until you delete your account. You can delete your account yourself at any time in the settings; this deletes your account, your links, your journal posts and the designs you published in the Theme Store.
7. Your public profile
Everything you add to your profile – username, profile picture, status text, background image and colours, links, journal posts and, if set, your favourite Spotify song – is publicly accessible to anyone at pfcard.link/username and can be found by search engines. Profiles with at least one link are included in our sitemap for search engines. Uploaded images are stored on our own server. The legal basis is Art. 6(1)(b) GDPR, as publication is the purpose of the service you use. Please only publish content you want to share publicly.
If you publish a design in the Theme Store, other logged-in users can see that design together with your username.
8. Visitor statistics for profile owners
So that profile owners can see how often their page is visited, each time a profile page is accessed we store a SHA-256 hash of your IP address (not the IP address itself), your browser's user agent, the referring page (referrer), the time and the profile visited. When you click a link on a profile, we store a hash of your IP address, the link clicked and the time.
Profile owners only see aggregated figures (e.g. total visits and distinct visitors in the last 30 days), never individual entries. We do not use cookies for this and do not create cross-site usage profiles. The hash is pseudonymous, not anonymous: it makes it possible to recognise repeated visits from the same IP address as such.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of profile owners, lies in measuring the reach of a profile page in a simple, data-minimising way. You can object to this processing under Art. 21 GDPR.
9. Icons of linked websites
The small icons (favicons) next to the links on a profile are not loaded by your browser from the respective websites, but by our server. It retrieves them via Google's favicon service, transmitting only the domain name of the linked website, and caches the result for up to 7 days. Your IP address or any other data about you is not transmitted to Google or to the linked websites.
10. Spotify player
Profile owners can show a favourite song from Spotify. On the profile page you first only see a preview area served by our server; no data is transmitted to Spotify at this point. Only when you click on it is the Spotify player (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden) loaded into the page from open.spotify.com. Spotify then receives, among other things, your IP address, information about your browser and the page visited, and may use cookies or similar technologies. If you are logged in to Spotify in your browser, Spotify can associate the visit with your Spotify account. Spotify may also process data in countries outside the EU, such as the USA.
The legal basis is the consent you give by clicking on the preview area (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It only applies to that page view; the next time you visit, the player will again only load after a click. For more information, see Spotify's privacy policy.
In the user area under “Widgets”, the Spotify player for the song you selected is loaded directly as a preview as soon as you open the page. The information above applies accordingly.
11. Links to other websites
Profiles contain links to third-party websites. You only leave our service when you click such a link; the operator of the target page is solely responsible for data processing there. This also applies to the share buttons in the user area (e.g. X, Facebook, WhatsApp, LinkedIn): they are plain links that only connect to the respective service when clicked.
12. Contact by email or phone
If you contact us by email or phone, we process your details (e.g. name, contact details, content of your request) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to your user account, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the data once your request has been fully dealt with, unless statutory retention obligations apply.
13. General information
Storage period
Unless a more specific storage period is stated in this privacy policy, we only keep personal data for as long as necessary for the respective purpose. If you make a justified request for erasure or withdraw your consent, we delete your data unless statutory retention obligations or other legally permissible grounds prevent this; in the latter case, the data is deleted once these grounds no longer apply.
No automated decision-making
We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.
SSL/TLS encryption
For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the padlock icon. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps; complete protection of data against access by third parties is not possible.
Objection to advertising emails
We hereby object to the use of the contact details published in accordance with the imprint obligation for sending unsolicited advertising and information material.
Changes
We update this privacy policy when our service or the legal situation changes. The version published here applies.
Parts of this privacy policy are based on a template by e-recht24.de.