Privacy Policy

Last updated: July 17, 2026

1. Data controller

2. What data we process

Depending on how you use the service, we may process:

  • Public LinkedIn profile data that a visitor asks to turn into a card: display name, headline, summary, location, public profile photo, experience, education, skills, languages, and derived data (for example, estimated years of experience or playful inferences such as approximate age).
  • Generated card data: display name, country, club/company, position, overall rating, attributes, and related metadata stored to serve the card.
  • Technical data: IP address and headers needed to limit abuse (rate limiting). These are not stored as a user database.
  • Opt-out: the LinkedIn username for which generation and display of a card has been requested to stop.

We do not ask visitors for registration, email, or a password to use the service.

3. Purposes

  • Generate and display the requested card for entertainment.
  • Temporarily store the card to serve it efficiently.
  • Protect infrastructure against abusive use.
  • Handle exclusion (opt-out) requests and exercise of data-subject rights.

4. Legal basis

  • Pre-contractual measures / performance of the service requested by the visitor who enters a username or URL (Art. 6(1)(b) GDPR) for processing necessary to generate that card.
  • Legitimate interest (Art. 6(1)(f) GDPR) in offering a playful product based on information already public on LinkedIn, applying technical usage limits, and keeping an opt-out record so we do not regenerate cards for anyone who has requested exclusion. The data subject may object at any time.

5. Data sources

Profile data comes from public LinkedIn sources and, where applicable, from technical providers that help obtain or normalize that public information (for example, backup reading/scraping services). We do not access private LinkedIn data using the visitor’s credentials.

6. Recipients and processors

To provide the service we use providers acting as processors or infrastructure vendors, including:

  • Vercel (hosting and site delivery).
  • Supabase (PostgreSQL database for cards and opt-outs).
  • AI providers via LiteLLM / nan.builders (attribute derivation and scoring).
  • Optional providers for fetching public profiles (e.g. Jina Reader or Proxycurl) when used as fallback.

We do not sell personal data. Only the data needed for each technical purpose is shared.

7. International transfers

Some providers may process data outside the European Economic Area. In that case, GDPR safeguards apply (for example, standard contractual clauses or equivalent measures offered by the provider).

8. Retention

  • Cards may remain in an in-memory cache with a limited TTL and/or in the database while they serve the product, until deleted via opt-out, regeneration, or maintenance.
  • Opt-out records are kept as long as needed to honor the requested exclusion.
  • Technical rate-limiting data is used ephemerally for service security.

9. Data subject rights

You may exercise rights of access, rectification, erasure, objection, restriction and, where applicable, portability, as well as withdraw consent if processing were based on it, by writing to adriansaezbeltra@gmail.com.

To request deletion of a card and prevent regeneration for a LinkedIn username, use the opt-out page. This only affects data stored by Linkefut; it does not delete or modify your LinkedIn profile.

You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

10. Minors

The service is not directed at children under 14. If you become aware that a minor’s information has been processed without a lawful basis, contact us so we can delete it.

11. Changes

We may update this policy to reflect legal or product changes. The update date appears at the top of this page.