edcilo Bookmarks

Privacy Policy

Last updated: 2025-07-04

1. 1. Identity of the Data Controller

EDC Bookmarks is operated by Eduardo Cifuentes López (hereinafter, "the Owner"), with registered address in Mexico. For any matters related to this Privacy Policy or the processing of your personal data, you may contact us via email at: me@edcilo.com.

2. 2. Personal Data We Collect

To provide the bookmark management service, we collect the following personal data:

  • Identity data: full name and email address.
  • User content: bookmark URLs, titles, descriptions or notes, hierarchical groups, and custom tags.
  • Billing data (stored locally): Stripe Customer ID, Stripe Subscription ID, subscription status, and billing periods.

3. 3. Data We DO NOT Collect

For your peace of mind, it is important that you know what data we DO NOT collect or store:

  • Credit or debit card data: This data is processed directly by Stripe, our PCI DSS Level 1 certified payment provider. EDC Bookmarks never has access to card numbers, security codes, or expiration dates.
  • Analytics or tracking data: We use Google Analytics 4 (GA4) via Google Tag Manager (GTM) only if you grant your explicit consent through the cookie banner. The data collected is anonymous and aggregated (pages visited, conversion events). No personally identifiable data is collected through this tool. If you reject analytics cookies, no tracking scripts are loaded.
  • Third-party cookies for advertising purposes: We do not display advertising or use cookies to track your behavior across sites.
  • External browsing data: We do not track your activity on other websites.

4. 4. Purposes of Data Processing

Your personal data is processed exclusively for the following purposes:

  • Providing the bookmark management service: storing, organizing, searching, and displaying your saved links, groups, and tags.
  • Processing payments and managing subscriptions: activating the trial period, processing recurring charges, managing payment method changes, and maintaining billing history through Stripe.
  • Sending transactional emails: registration confirmations, trial expiration alerts, successful or failed payment notifications, cancellation confirmation, and communications related to your account administration.
  • Improving the service: analyzing aggregated and anonymous general service usage to identify areas for improvement and fix errors.

5. 5. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds, in accordance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations:

  • Express consent: By creating an account and accepting this Privacy Policy, you grant your consent for the processing of your data according to the purposes described herein.
  • Contract performance: The processing of billing data and payment processing is necessary to fulfill the contractual relationship arising from your subscription.
  • Legitimate interest: We maintain security and fraud prevention measures based on our legitimate interest in protecting the service and our users, provided that this interest does not override your fundamental rights and freedoms.

6. 6. Third-Party Data Recipients

To operate the service, we share certain data with the following service providers. All have been selected under strict security and regulatory compliance criteria:

  • Supabase (supabase.com): PostgreSQL database and user authentication provider. Stores your name, email address, password (encrypted via hash), and all your account content (bookmarks, groups, tags). Its infrastructure is located in the United States. See their privacy policy: https://supabase.com/privacy
  • Stripe (stripe.com): Payment processing and subscription management provider. Receives your name, email address, and credit/debit card data directly (EDC Bookmarks does not have access to the latter). Complies with PCI DSS Level 1. See their privacy policy: https://stripe.com/privacy
  • Resend (resend.com): Transactional email delivery service. Receives your email address and language preference to send notifications related to your account and subscription. See their privacy policy: https://resend.com/legal/privacy-policy
  • Vercel (vercel.com): Hosting and Content Delivery Network (CDN) provider. All HTTP traffic between your browser and EDC Bookmarks passes through their servers, which involves logging IP addresses and HTTP headers as part of their technical operation. See their privacy policy: https://vercel.com/legal/privacy-policy
  • Google Fonts (fonts.google.com): Web typography service. To display the Inter and JetBrains Mono fonts, your IP address is sent to Google's servers. See their privacy policy: https://policies.google.com/privacy
  • Google Favicons API: Favicon retrieval service. When you save a bookmark, the domain name is sent to Google to retrieve the site's icon. See their privacy policy: https://policies.google.com/privacy
  • Google Analytics / Google Tag Manager (analytics.google.com): Web analytics service. Only activated if you grant your explicit consent. Collects anonymous and aggregated data about site usage (pages visited, conversion events). No personally identifiable data is sent. See their privacy policy: https://policies.google.com/privacy

7. 7. International Data Transfers

The service providers mentioned in the previous section operate infrastructure in various jurisdictions, primarily in the United States of America. Your data may be transferred, stored, and processed on servers located outside Mexico.

These international transfers are carried out under the contractual safeguards and security certifications maintained by each provider. By using EDC Bookmarks, you agree that your data may be transferred and processed in such jurisdictions under the conditions set forth in this Privacy Policy.

8. 8. Cookies and Local Storage

We use the following cookies and local storage mechanisms exclusively for the functioning of the service. We DO NOT use marketing, advertising, or third-party tracking cookies:

  • sb-*-auth-token (Cookie): Supabase session token in JWT format. Essential for keeping your session active and authenticating your requests to the server. Type: Essential. Duration: Session duration.
  • NEXT_LOCALE (Cookie): Stores your language preference (English or Spanish). Allows us to display the interface in your chosen language. Type: Functional. Duration: 1 year.
  • theme (localStorage): Stores your visual theme preference (light, dark, or system default). Type: Functional. Duration: Persistent until manually cleared.
  • edc-bookmarks-trial-dismissed (localStorage): Indicates whether you have dismissed the trial period information alert. Prevents it from being shown repeatedly. Type: Functional. Duration: Persistent until the trial period expires.
  • edc-bookmarks-canceling-dismissed (localStorage): Indicates whether you have dismissed the subscription cancellation information alert. Type: Functional. Duration: Persistent until the cancellation period ends.
  • cookie-consent (localStorage): Stores your decision about the use of analytics cookies (accepted or rejected). Type: Functional. Duration: Persistent until manually cleared.
  • _ga, _ga_* (Google Analytics Cookies): Only set if you accept analytics cookies. Used to distinguish users and sessions. Type: Analytics (consent required). Duration: Up to 2 years.

9. 9. ARCO Rights and Data Portability

In accordance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), you have the right to exercise the following ARCO rights (Access, Rectification, Cancellation, and Opposition):

  • Access: Know what personal data we have about you and how we process it.
  • Rectification: Request the correction of inaccurate or incomplete data.
  • Cancellation: Request the deletion of your personal data when you believe it is not being processed in accordance with the law.
  • Opposition: Object to the processing of your data for specific purposes.

Additionally, we offer the right to data portability. You can export all your bookmarks in CSV format from the Settings section of your account at any time.

To exercise any of these rights, send a request via email to me@edcilo.com, clearly stating the right you wish to exercise. We will respond to your request within a maximum of 20 business days, as established in the LFPDPPP.

10. 10. Account Deletion

You may delete your account at any time. Currently, the automatic deletion feature from the Settings section is under development. In the meantime, you may request account deletion by sending an email to me@edcilo.com with the subject "Account deletion request".

Once your request is received:

  • We will process the deletion within a maximum of 30 calendar days.
  • All your personal data, bookmarks, groups, tags, and settings will be permanently deleted.
  • Shared links generated from your account will be immediately deactivated.
  • Billing data will be retained only during the period required by applicable tax legislation, after which it will be deleted.

We recommend exporting your bookmarks in CSV format before requesting deletion, as this process is irreversible.

11. 11. Security Measures

We implement technical, administrative, and physical security measures to protect your personal data against unauthorized access, loss, alteration, or destruction:

  • Encryption in transit: All communication between your browser and our servers is carried out via HTTPS/TLS, ensuring data travels encrypted.
  • Password encryption: Your password is stored exclusively as a cryptographic hash using the bcrypt algorithm through Supabase's authentication system. No one, including the Owner, can know your plain-text password.
  • Database-level security (Row Level Security): Supabase implements row-level security policies (RLS) that ensure each user can only access their own data. These policies are never disabled.
  • Restricted access: Only you, as an authenticated user, can access your account data. Administrative access to the database is strictly limited.
  • Monitoring: We actively monitor the infrastructure to detect and respond to potential security incidents.

12. 12. Minors

EDC Bookmarks is intended exclusively for individuals over 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or legal guardian and become aware that a minor in your care has provided us with personal data without your consent, we ask you to contact us immediately at me@edcilo.com so we can proceed to delete such information.

If we detect that a user is under 18 years of age, we will delete their account and all associated data without prior notice.

13. 13. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our data processing practices, applicable legislation, or the services we offer.

When we make material changes, we will notify you via the email address associated with your account with at least 15 days' notice. We will also publish the updated version on this page, indicating the new "Last updated" date.

We recommend periodically reviewing this Privacy Policy. Continued use of the service after any modification takes effect implies your acceptance of the changes.

14. 14. Contact

For any questions, comments, or requests related to this Privacy Policy or the processing of your personal data, you may contact us through:

  • Email: me@edcilo.com
  • Address: Mexico
  • Owner: Eduardo Cifuentes López

We are committed to responding to all requests within a maximum of 10 business days.

Back to home