Privacy
Data Privacy
Privacy Policy - flint
Status: June 2026
1. Controller & contact
Controller responsible for data processing:
Caroline Janson
Wolfganggasse 25
1120 Vienna
Austria
Email: caro@flintcards.com
For questions about data privacy and exercising your rights, contact us at caro@flintcards.com.
2. What data do we process?
We process the following categories of data:
2.1 When registering as a card holder:
- First name
- Age
- Email address
- Password (hashed, not readable)
- Photo(s) - up to 3 photos
- Bio text (max. 300 characters)
- Tags (e.g. intentions, interests)
- IP address (automatically, at login)
- Timestamp of registration and last activity
2.2 When registering as a recipient:
- First name
- Last name
- Email address
- Password (hashed)
- Photo
- Place of encounter (free text or postal code)
- IP address
- Timestamp of registration
2.3 When using the chat system:
- Chat messages and their contents
- Timestamps of messages
- Data at the time of the message
2.4 Automatically collected data:
- IP address
- Browser type and version
- Operating system
- Referrer information
- Pages you visit
- Time you spend on each page
2.5 Special data:
Biometric data (photos): You consent to the upload of photos. These are treated as data pursuant to GDPR Art. 9 (special category).
3. On what legal basis do we process your data?
Art. 6 para. 1 GDPR - lawfulness of processing:
| Data | Legal basis |
|---|---|
| Registration data (name, email, password, age) | Performance of a contract (Art. 6 para. 1 b GDPR) - necessary for providing the platform |
| Photos/Bio | Consent (Art. 6 para. 1 a GDPR & Art. 9 para. 2 a GDPR) - you explicitly consent during upload |
| Chat contents | Performance of a contract (Art. 6 para. 1 b GDPR) - necessary for the chat function |
| IP address, timestamps | Legitimate interest (Art. 6 para. 1 f GDPR) - security and abuse prevention |
| Analytics | Consent (Art. 6 para. 1 a GDPR) - through cookie banner or settings |
4. To whom do we pass on your data?
4.1 Data processors (processors pursuant to Art. 28 GDPR):
We use the following service providers who process your data on our behalf:
| Service provider | Function | Region | DPA status |
|---|---|---|---|
| Hetzner | Hosting of the website database, auth, storage | EU (Helsinki) | ✅ Agreed |
| Mollie | Payment information | Netherlands and international | ✅ Agreed |
All data processors have contractually assured that they process your data only on behalf of flint and act in compliance with GDPR.
4.2 Recipients outside processing:
- Other users of the platform: Your profile (name, age, photos, bio, tags) is shown to other users only when they scan your QR code.
- Authorities: Only upon legal request (e.g. court, law enforcement).
5. How long do we store your data?
| Data type | Storage period | Note |
|---|---|---|
| Registration data (if active) | As long as the account exists | After account deletion |
| Photos | As long as the account exists | After deletion |
| Chat histories | As long as the account exists | After deletion |
| Email logs (Privateemail) | As long as the account exists | After deletion |
| Server logs (Hetzner) | 14days |
6. What rights do you have?
Under the GDPR you have the right to:
Art. 15 GDPR - right of access:
You can request a copy of all data that we store about you at any time. Contact us at caro@flintcards.com. We respond within 30 days.
Art. 16 GDPR - right to rectification:
If your data is incorrect, you can correct it yourself through the platform or notify us.
Art. 17 GDPR - right to erasure (“right to be forgotten”):
You can request deletion of your account and your data at any time. After confirmation, your data will be deleted immediately. Exceptions: data that flint needs to fulfill legal obligations or legitimate interests.
Art. 18 GDPR - right to restriction:
You can request that we temporarily restrict the processing of your data (e.g. while you contest a correctness).
Art. 20 GDPR - right to data portability:
You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another provider.
Art. 21 GDPR - right to object:
You can object at any time to the processing of your data insofar as it is based on legitimate interest (Art. 6 para. 1 f).
Art. 22 GDPR - automated decisions:
You have the right not to be subject exclusively to automated decisions that produce legal effects concerning you. (flint does not make such decisions today, but may change this in the future - see point 14.)
To exercise these rights, contact: caro@flintcards.com.
7. Cookies & Analytics
7.1 Necessary cookies:
- At the current time no cookies are used
8. Data security
We protect your data through:
- Encryption: Passwords are hashed with bcrypt. Data in transit is encrypted with TLS 1.2+.
- Access control: Only authorized persons have access to databases.
- Regular backups: Daily backups for emergency recovery.
- Security updates: Regular patching and monitoring of security vulnerabilities.
Note: No system is 100 % secure. If we detect a data breach, we inform you and the data protection authority without delay pursuant to GDPR Art. 33-34.
9. Special data: photos
Photos are biometric data pursuant to GDPR Art. 9 (special categories). Your consent is required.
During upload you confirm:
- The photo shows you yourself.
- You have the right to upload the photo.
- You allow flint to store the photo in accordance with this privacy policy and to display it to other users.
Your photos are:
- Displayed only when other users scan your QR code or you have mutually accepted each other.
- Not used for advertising or marketing unless you expressly consent.
- Deleted when you delete your account.
10. Chatting & message logs
Private chats:
- Messages between you and other users are private.
- We store chat histories for functionality, not for monitoring.
- Chat contents are automatically deleted after account deletion.
Reporting & abuse:
If you report a chat as inappropriate, we store the report to investigate abuse. Reported content is reviewed and, if necessary, deleted.
11. Complaint procedure
Right to complain:
You have the right to lodge a complaint with the competent data protection authority if you believe that flint has violated your rights.
Austrian Data Protection Authority:
Austrian Data Protection Authority (DSB)
Wickenburggasse 8
1080 Vienna
Email: dsb@dsb.gv.at
Phone: +43 1 52 052-0
Website: www.dsb.gv.at
You can also lodge a complaint with your local data protection authority (if you do not live in Austria).
12. Changes to this privacy policy
We may update this privacy policy at any time to reflect changes in our practices or legal requirements. Major changes will be communicated to you by email at least 30 days before they take effect.
Last status of this privacy policy: June 2026
13. Contact for data privacy questions
For questions about this privacy policy or to exercise your rights, contact:
Caroline Janson
Postal address:
Wolfganggasse 25
1120 Vienna
Austria
Response time: We respond to requests within 30 working days (according to GDPR deadline: 30 days).
Status: June 2026
Austrian law & GDPR