POLITIQUE DE CONFIDENTIALITÉ

1. DATA CONTROLLER INKIT GROUP (SASU, RCS Meaux 101 748 762), 19 rue Simone Veil, 77610 Fontenay-Trésigny, France, operator of the NILINK brand. Contact: contact@nilink.app. 2. DATA COLLECTED AND PURPOSES • Account: email, username (optional, public if enabled), display name, bio, city, country, optional social links. Used to create and manage your NILINK account. • Order: shipping address, order contents, for processing and delivery. • Payment: processed directly by Stripe. NILINK never receives or stores your card number. • Shipping: carrier and tracking number, to track your parcel. • Transactional emails: order, payment, shipment, and transfer confirmations. Sent only for these specific events. • NFC scans: when a chip linked to one of your Pieces is scanned, NILINK records an aggregated event (country, city, date), never a raw IP address or visitor identity. As the owner, you only see totals (scan count, last 7 and 30 days, country or city if volume allows), never a visitor-by-visitor detail. • Ownership history: each Piece keeps a history of its successive owners (transfers, activations). This is a product feature, the digital passport, never a hidden process. • Public profile: only if you enable it yourself, and only for the Pieces you individually choose to make visible. • Admin log: actions taken by the NILINK team on your account or Pieces (linking a chip, shipping, etc.) are logged for traceability and security, never accessible to third parties. NILINK does not use any audience-measurement or behavioral-analytics tool. 3. COOKIES No audience-measurement or advertising cookies. Only strictly necessary cookies are set: a session cookie for authentication, a language-preference cookie (French or English). See the "Cookie Policy". 4. SUB-PROCESSORS • Supabase, Inc.: database hosting and authentication. • Vercel Inc.: application hosting. • Stripe: card payment processing. • Our transactional email provider. 5. DATA RETENTION Your account data is kept for as long as your account is active, then deleted or anonymized within a reasonable period after account deletion. Order-related data (billing) is kept for 10 years in accordance with French accounting and tax obligations (Article L123-22 of the Commercial Code), regardless of your account's status. 6. YOUR RIGHTS Under the GDPR, you have a right of access, rectification, erasure, restriction, and data portability, as well as the right to lodge a complaint with the CNIL (www.cnil.fr). To exercise these rights: contact@nilink.app. Your NILINK account already includes a deletion feature directly accessible in your Settings.