💚 Your privacy matters
At Tagui, we know the information you entrust to us is sensitive. This policy honestly explains what data we collect, how we use it, and how we protect it.
The data controller responsible for your information is Tagui LLC, a limited liability company (LLC) registered in the state of Florida, United States (hereinafter "Tagui" or "we").
1. What Data We Collect
Purchase data
- Full name
- Email address
- Shipping address
- Payment information (processed by Stripe, not stored by Tagui)
Emergency profile data
All are optional except the name: you decide which ones to fill in and which to leave blank.
- Name and photo
- Date of birth
- Weight and height
- Approximate location (city/region — NOT exact location or GPS)
- Sensitive medical data: blood type, allergies, medications, medical conditions
- Up to two emergency contacts (name, phone, email, relationship)
- Fields you add yourself, with the title and content you choose (for example: health insurance, primary doctor, language spoken)
Your account data
- Your password, stored encrypted with bcrypt. We do not store the password itself: not even we can read it.
- Purchase, activation and last-edit dates
- A record that you accepted these legal texts: the date, which version you accepted, and an irreversible fingerprint of the connection you used. It is not your IP address: it is a one-way summary.
Site technical data
- Preferred language (stored in your browser, never leaves your device)
- Our own visit count for the shop: page viewed, whether you came from a campaign, mobile or desktop, language, and approximate city. No name, no email, no IP address.
Data about whoever opens a profile
This part is not about you as a Tagui owner, but about whoever scans one. Each time a profile is requested, the server records: the code requested, whether it existed, the type of browser or program that asked for it, and an irreversible fingerprint of the connection. Approximate city is stored only when the code does NOT exist.
Why: to detect someone trying random codes to reach other people’s profiles. It is a security measure, not marketing — it is never used for advertising or shared with anyone. And for that same reason, the city is NOT stored when the profile does exist: recording where someone’s medical profile was opened would mean recording where they were during an emergency.
2. How We Use Your Data
- Display your emergency information when someone scans your Tagui
- Send the unique activation code to your purchase email
- Send verification codes when you edit your info or recover your password
- Process your purchase and deliver the physical product
- Detect and stop anyone trying to reach other people’s profiles by guessing codes
- Know how many people visit the shop, to decide what to improve. This does not touch emergency profiles
We do NOT sell, rent, or share your data with third parties for commercial or advertising purposes.
⚠️ 3. Who Can See Your Information
Please note:
- Your public profile (the /u/YOUR-CODE page) is BY DESIGN accessible to anyone who scans your Tagui or knows the link. This is the product's intended behavior.
- Only you (with your password) can edit the information.
- Carefully decide what medical information you want to display.
4. How We Protect Your Data
- Password encryption: we use bcrypt (industry standard) to encrypt all passwords. Not even we can see them.
- Secure connection: all traffic travels over HTTPS with SSL certificate.
- 2-step verification: to edit your info you need your password AND a code sent to your email.
- Protected database: we use Supabase with row-level security policies (RLS).
- Brake against code guessing: anyone trying random codes is locked out within seconds. Only FAILED attempts count, so scanning a real Tagui is never affected.
- Access log: the server records every profile request, including those made by automated programs, so abuse can be detected. See section 1.
5. Third-Party Services
For Tagui to work we use the following services. Each has its own privacy policy:
6. Your Rights
You have the right to:
- Access your information at any time from /editar/YOUR-CODE
- Modify or update your data whenever you want
- Delete your account and all your data. Email us at hola@taguihelp.com or message us on Instagram @taguihelp and we'll process the deletion within 7 days.
- Download a copy of your information. There is no self-service button for this yet: email us at hola@taguihelp.com and we will send it within 30 days.
7. Cookies and Local Storage
Tagui does NOT use advertising cookies and never shares your data with advertisers. We do use two tools to know how many people visit the site: Google Analytics, which stores cookies in your browser (_ga and _gid), and Vercel Analytics, which uses no cookies. Neither receives your Tagui code: your profile address is replaced with /u/[code] before it is sent, so neither can know which profile a visit belongs to or see your medical information. We also store your language preference (ES/EN) in your browser (localStorage), which never leaves your device. You can block these cookies from your browser settings and the site will keep working.
8. Minors
Tagui does not knowingly collect data from children under 13. If you are a parent or guardian and believe a minor in your care has provided us information, please contact us to delete it. For users between 13 and 17, parental supervision and consent is required.
9. Data Retention
We keep your information while your Tagui is active. If you request account deletion or your Tagui is not activated for more than 12 months after purchase, we may delete the associated data. The profile access log described in section 1 is deleted automatically after 90 days.
10. Changes to This Policy
We may update this policy to reflect changes in our practices or legal requirements. The last update date appears at the top. For significant changes, we will notify active users by email.