Privacy Policy
Last updated: September 29, 2026
1. Introduction
allme.fyi is a contact management and sharing platform operated by B.K.I.F. B.V. ("we", "us", "our"), based in the Netherlands. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, mobile applications, and API (collectively, the "Service").
We are committed to complying with the General Data Protection Regulation (GDPR) (EU) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) (US).
2. Data we collect
We collect only the data necessary to provide the Service:
- Account credentials — username, email address, and a securely hashed password
- Profile information — display name and a unique share code
- Contact details you enter — phone numbers, email addresses, physical addresses, social accounts, gaming tags, gender, date of birth, and profile photos
- Connection data — your connections, groups, field visibility settings, and field overrides
- Messages — encrypted messages sent between you and your connections
- Usage logs — minimal server logs for security and debugging (IP addresses, timestamps, request paths). The Service itself uses no analytics trackers; our marketing website may use Google Analytics if you consent to it — see the Cookie Policy.
3. How we use your data
Your data is used solely to provide the Service:
- Storing your contact information and making it available to connections you explicitly configure
- Synchronizing shared contact details to your phone's native address book (when you use our mobile apps)
- Delivering push notifications about connection requests, messages, and updates
- Providing encrypted messaging between connections
- Maintaining security and preventing abuse
We do not use your data for advertising, analytics profiling, or selling to third parties. We will never sell, rent, or share your personal data for any purpose other than providing the Service.
4. Legal basis for processing (GDPR)
We process your personal data under the following legal bases:
- Contract performance (Art. 6(1)(b) GDPR) — processing necessary to provide the Service you signed up for
- Consent (Art. 6(1)(a) GDPR) — sharing your contact data with connections you explicitly configure
- Legitimate interest (Art. 6(1)(f) GDPR) — security measures, fraud prevention, and service improvement
5. Your rights
GDPR rights (EU/EEA residents)
Under the GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your personal data ("right to be forgotten")
- Data portability — receive your data in a structured, machine-readable format
- Restriction — request that we limit how we process your data
- Objection — object to processing based on legitimate interest
- Withdraw consent — withdraw consent at any time where processing is based on consent
CCPA/CPRA rights (California residents)
Under the CCPA/CPRA, you have the right to:
- Know — what personal information we collect and how we use it
- Delete — request deletion of your personal information
- Opt-out of sale — we never sell your personal information, so there is nothing to opt out of
- Non-discrimination — we will not discriminate against you for exercising your privacy rights
To exercise any of these rights, contact us at privacy@allme.fyi.
6. Data retention
- Active accounts — your data is retained for as long as your account is active
- Account deletion — when you delete your account, all personal data is permanently removed within 30 days
- Backups — backup copies are purged within 30 days of account deletion
- Server logs — access logs are retained for a maximum of 90 days
7. Data processors
We use a limited number of third-party services to operate the platform:
| Processor | Purpose | Location |
|---|---|---|
| Hosting provider | Server infrastructure | EU (Netherlands) |
| Apple Push Notification service (APNs) | Push notifications to iOS devices | USA — Apple Privacy |
| Firebase Cloud Messaging (FCM) | Push notifications to Android devices | USA — Google Privacy |
| DeepL SE | Machine translation of the texts companies write for you to read, such as contract-flow steps and data requests. None of your data is sent. | EU (Germany) |
8. Where your data is stored, and international transfers
Your data is stored in the region assigned to your account, and it does not leave that region by default.
To let you sign in, connect and sign documents from anywhere, some records are kept in every region: your account and security settings (email address, display name, share code, devices and sign-in history), who you are connected to and the requests between you, the groups, bunches and parental links you are part of, the names and status of documents and contract flows you take part in and the name, IP address and browser you sign them with, the email address you give for contract notifications, verification records, company business cards, and anything you report to us for moderation. Everything else stays in your region.
The one exception is sharing. When you share with someone in another region, an encrypted copy of only what you shared is stored in their region so that they can read it there. Nothing else travels. Your documents and photos are never copied at all, not even when you share them: they stay in your own region's storage and are read from there.
We run a region in the European Union and a region in the United States. Where your data is stored in or moved to our United States region, the recipient is our hosting provider acting for us, and we rely on the EU–US Data Privacy Framework, with the European Commission's Standard Contractual Clauses as the fallback basis. Where a shared copy reaches someone in another region, that person or company is independent and acts for their own purposes; the basis for that transfer is your own explicit decision to share with that specific party.
We rely on Standard Contractual Clauses for the transfers to Apple and Google that are needed in order to deliver push notifications to your devices.
9. Security
We take the security of your data seriously:
- Encryption in transit — all connections use TLS (HTTPS)
- Encrypted messaging — messages between connections are encrypted end-to-end
- Password hashing — passwords are stored using secure one-way hashing
- Access control — OAuth 2.0 authentication with RSA-signed tokens
10. Children's privacy
allme.fyi offers parental control features. Accounts for users under 16 require custodian (parent or guardian) oversight. Custodians can approve connections and monitor shared information on behalf of their wards. We do not knowingly collect data from children under 16 without parental consent.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through the Service or via the email address associated with your account. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact
If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:
- Email: privacy@allme.fyi
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.