Privacy Notice

1. Who is responsible

The controller is MTÜ UNILINK CENTER, registry code 80668249, Paepargi tn 53-56, 11417 Tallinn, Estonia. Data protection contact: [email protected]. We have not appointed a data protection officer.

2. Visiting this website

When you open a page, your browser sends technical data: IP address, browser type, the page requested and the time. Netlify, which hosts the site, and Cloudflare, which delivers it and protects it from attacks, process this data for us in server logs. Purpose: to deliver the site and keep it secure. Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR). Netlify keeps its logs for up to 90 days online and up to one year offline, as set out in its data processing agreement; Cloudflare keeps them for the period set out in its data processing agreement.

The site has no analytics, no advertising and no contact forms, and our own pages set no cookies. The font is served from our own domain. Your language choice is saved in your browser; details are in the Cookie Policy.

3. Writing to us

If you email [email protected], we process your address, your name and the content of your message in order to answer you. Legal basis: steps you ask for before or under a contract (Article 6(1)(b)) or our legitimate interest in answering correspondence (Article 6(1)(f)). Our email runs on Google Workspace. We use Claude, an AI assistant provided by Anthropic Ireland, Limited, to help us read, sort and answer this correspondence; Anthropic processes it only on our behalf, as our processor under its Data Processing Addendum. We keep correspondence for as long as we need it to deal with your message, and longer only where the law requires it, for example when an email is an accounting document.

4. Donations and payments

When you donate by bank transfer or through Wise, we receive what the payment carries: your name, account details, amount, date and reference. We use it to administer the donation, issue a confirmation of receipt on request, screen the payer's name against EU, UN, UK and US sanctions lists and meet our accounting, reporting and anti-money-laundering obligations, as described in the Donation Terms (UC-POL-2026-001). Legal basis: legal obligation (Article 6(1)(c)); our legitimate interest in establishing, exercising or defending legal claims, for example in a card dispute or a recall request (Article 6(1)(f)); and, for confirmations, your request (Article 6(1)(b)). Wise processes payments as an independent controller under its own privacy notice. The payment page builds the bank QR code in your browser and does not collect card or account details. We keep accounting source documents for seven years from the end of the financial year in which the transaction was recorded, and anti-money-laundering records for the period the law requires.

5. Contracts and invoices

If we work for you under a written contract, we process the contact and billing details needed to perform and invoice it (Article 6(1)(b)) and keep invoices and accounting records for the period required by Estonian accounting law (Article 6(1)(c)).

6. SafeLink Guardian

6.1 What the app processes

• an anonymous account identifier created when you start;
• your display name and the role you choose;
• your Safety Circle membership;
• your location while the app is in use, including during an alert;
• SOS events, check-ins and timers;
• emergency contacts you add (name, phone number, email address);
• photos and audio recorded by you or during an SOS, with their SHA-256 fingerprint, time and location;
• a notification subscription, if you allow notifications;
• an email address, only if you gave one (for example in an earlier version of the app).

Your language choice is stored only on your device.

6.2 Why, and on what legal basis

• To provide the service you asked for — your account, your Safety Circle, alerts to the people you chose, location sharing and the record of an incident: performance of our agreement with you (Article 6(1)(b)).
• Voice triggering: when it is on, Chrome sends audio to Google to turn speech into text so the app can recognise an alert word. Legal basis: your consent (Article 6(1)(a)), given by allowing the app to use your microphone for this; you can withdraw it at any time in your browser or phone settings.
• Notifications: your consent (Article 6(1)(a)), given in your browser's notification prompt and withdrawable in its settings.
• Emergency contacts: you give us the details of people you want to be alerted; we use them only for that, on the basis of your and our legitimate interest in being able to alert them (Article 6(1)(f)). Please tell the people you add.
• Security of the service and prevention of misuse: our legitimate interest (Article 6(1)(f)).

6.3 Sensitive information

We do not ask for sensitive information. Photos and audio may nevertheless show it, for example injuries. We store such recordings only as the record you chose to make, do not analyse their content, and process them so that they can be used to establish, exercise or defend legal claims (Article 9(2)(f) GDPR).

6.4 Children and young people

If you are under 18, use the app only with the consent and involvement of a parent or legal guardian. The app offers a role for a child or young person within a family Safety Circle; we are reviewing this role, including age limits, parental consent and a data protection impact assessment, and will update this notice when the review is complete.

6.5 How long we keep app data

We currently keep app data until you delete it or ask us to delete it (see the Account Deletion page). We are introducing fixed retention periods with automatic deletion for location, SOS and evidence data and will publish them here.

7. Who receives personal data

We do not sell personal data and do not share it with anyone for their own marketing. Where Estonian or EU law requires us to give information to an authority, for example to protect a child in danger, we do so (Article 6(1)(c)).

8. Transfers outside the European Economic Area

Netlify, Cloudflare, Supabase, Google and Anthropic transfer data outside the EEA on the basis of the EU Standard Contractual Clauses in their data processing agreements; transfers to the United Kingdom (jsDelivr) rely on the European Commission's adequacy decision. You can ask us for a copy of the safeguards at [email protected].

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing. Write to [email protected]; we reply without undue delay and at the latest within one month, which can be extended by two further months for complex requests (Article 12(3) GDPR). To delete SafeLink Guardian data, use the Account Deletion page.

10. Complaints

You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or to the supervisory authority where you live or work.

11. Security

Connections to our website and app are encrypted (TLS). SafeLink Guardian data is stored in the EU (Ireland region) and encrypted at rest. Access to stored personal data is limited to our management board and to our processors under contract. If a personal-data breach occurs, we act as described on our Trust & Safety page.

12. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR).

13. Changes and language versions

We update this notice when our processing changes; the version in force and its effective date are published here, and earlier versions are available on request. This notice is published in ten languages. If the versions differ, the English version is the reference text; where a difference would put you at a disadvantage, the version more favourable to you applies.