Privacy Policy

1. Who we are

LinkifyThis is operated by a sole trader based in Portugal (show name, address and NIF). We are the data controller for the information described in this policy.

For anything about your data — a question, a request, or a complaint — email privacy (at) linkifythis (dot) com.

2. Information we collect

When you use LinkifyThis, we may collect the following:

• Account information: your email address and date of birth when you register. If you pay for anything, we also keep the name you give our payment provider at checkout.
• Date of birth: we ask for it when you set up your account. We use it only to confirm you meet the minimum age for the Service and to determine whether you are old enough to buy a paid plan. It is never shown on your public page and is not used for advertising.
• Payment information: handled by our payment provider. We never see or store your card details. We keep the customer and subscription identifiers they give us, plus a record of what you paid.
• Your content: your page code, and the links, images, and text you put on your page.
• Usage data: counts of page views and link clicks. These are a timestamp and a page or block identifier — nothing else. We do not store the IP address, device, browser, or location of anyone who visits a page. So that reloading a page does not count as a new visit, we briefly keep a salted one-way hash of the visitor’s IP address combined with the page or link. It cannot be turned back into the address, is different for every page, is never stored with the view or click, and is deleted after a day.
• Reports: if you report a page, we store the reason you chose, anything you typed, and a one-way hash of your IP address. We never store the address itself. See section 10.
• Early Access requests: if you apply for an invite, we keep your name, email, country, and the links you gave us.
• Vouchers: if we send you a voucher, we keep the email address we sent it to, and when and how it was used.
• Email we send you: a copy of every message we send to you, so we have a record of what was sent and when.
• Sign-in attempts: to stop people guessing their way into accounts, we record each request for a sign-in code with a salted one-way hash of the IP address it came from. The address itself is never stored, and these records are deleted after a day.
• Link checks: the addresses of the links on your page, and of any link a visitor clicks, are checked against lists of sites known to spread malware or run scams. We keep each address with the result, so we do not ask again. These records are about the link, not about you or the visitor.

3. How we use it, and why we are allowed to

Under the GDPR we need a legal basis for everything we do with your data. Ours are:

• To provide the Service (contract). Creating your account, hosting your page, serving it to visitors, processing payments, and managing your plan.
• To meet our legal obligations (legal obligation). Checking you meet the minimum age, keeping accounting records, and responding to reports and lawful requests.
• To keep the Service working and safe (legitimate interests). Preventing abuse, spam, and fraud, enforcing our Terms, rate-limiting reports, fixing faults, and understanding how the product is used in aggregate.
• With your permission (consent). Advertising cookies, and any marketing email. You can withdraw consent at any time, and withdrawing it does not affect anything done before.

We do not sell your personal information, and we do not use your data to build advertising profiles of you.

4. Age requirements

LinkifyThis is not available to anyone under 16. We ask for your date of birth when you create your account, and if you tell us you are under 16 we will not set the account up. We keep a record of that answer so we do not ask you again before you are old enough.

Paid plans are only available from age 18, because card payments require an adult account holder. If you are between 16 and 18 you can use the free plan in full, and the option to upgrade will be unavailable until you reach 18.

5. What is public

Your page is public. Anything you put on it — your links, your text, your images, your name if you use it — can be seen by anyone who knows or guesses your code, and by search engines.

Images you upload are served from a public address. Anyone who has that address can open the image directly, even if it is no longer shown on any page, until it is deleted. Please do not upload anything you need to keep private.

6. Who we share it with

We share data only with the providers who help us run the Service. Each is bound by contract to protect it and to use it only on our instructions:

• Vercel — hosting the website. Like any web host, it handles every request to the site, including the IP address it came from.
• Supabase — database, authentication, and image storage.
• Stripe — payments and subscriptions.
• Resend — sending account, invite, billing, and moderation email.
• Google Workspace — our own mailboxes, so it holds any email you send us.
• Google Web Risk — checking link addresses against lists of known malicious sites. It receives the address being checked, and nothing about who is asking.
• Google AdSense — advertising on ad-supported pages. Ads are never shown on pages marked 18+.

Embedded players. A page can include a video or track from YouTube, TikTok, Instagram or Spotify. Nothing is loaded from those platforms when you open the page. Only if you tap to play does your browser connect to that platform, which then receives your IP address and may set its own cookies under its own privacy policy.

We may also disclose information where the law requires it, to comply with a lawful request, to enforce our Terms, or to protect the rights, property, or safety of our users, the public, or us.

7. Where your data is stored

Some of our providers operate outside the European Economic Area. Where data is transferred outside the EEA, that transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

8. How long we keep it

• Account and page data: until you delete it, or until you close your account.
• Page views and link clicks: for as long as the page exists. They are deleted with it.
• Copies of email we send you: while your account is open. They are erased when you close it.
• Payment records: for the period we are required to keep accounting records by law. Once your account is closed they are no longer linked to it.
• Reports and moderation decisions: kept after an account is closed, with personal details removed, so that our decisions remain reviewable.
• Early Access requests: while your account is open, and erased when you close it. A request that is never used is kept until the Early Access programme ends.
• Vouchers: while your account is open, and erased when you close it. A voucher that is never used is kept until we withdraw it.
• Sign-in attempts: one day.
• Repeat-visit hashes: one day.
• Link checks: for as long as they are useful; they contain no personal information.

9. Cookies

We use as few as we can:

• Session cookie — keeps you signed in. Essential; the Service cannot work without it.
• lt_age_confirmed — remembers that you confirmed your age on a page marked 18+, for 30 days, on that device only. Essential to that feature. It records a yes, and nothing about who you are.
• Advertising cookies — set by our ad provider on ad-supported pages. These require your consent, and you can refuse or withdraw it.
• Platform cookies — set by YouTube, TikTok, Instagram or Spotify only after you tap to play something embedded from them. Not tapping means none are set.

We do not use analytics cookies, and we do not track visitors across other websites.

What a page view records. When someone opens a page, we store the time, and three things that do not identify them: where the visit came from (the domain of the site that linked to the page, a label the creator added to the link such as ?ref=youtube, or "direct"), the country, as two letters worked out by our host from the connection, and the kind of device — phone, tablet or computer — read from the browser's own description. We do not store the IP address, the full address of the referring page, or the browser's description itself. The page's owner sees these as totals.

10. If you report a page

Reports are anonymous. We do not ask for your name, your email address, or an account.

To stop the same person reporting the same page over and over, we take your IP address, combine it with a secret key and the page identifier, and store only the resulting one-way hash. The address itself is never written down and cannot be recovered from the hash. It lets us recognise a repeat reporter without ever knowing who they are.

11. Data security

We implement a variety of security measures to maintain the safety of your personal information, including encryption in transit, access controls on our database, and keeping secret keys off the browser. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure, and we cannot guarantee absolute security.

12. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct anything that is wrong or incomplete.
• Delete your data. You can do this yourself at any time by closing your account.
• Restrict or object to how we use it, including anything we do on the basis of legitimate interests.
• Take your data with you in a portable format.
• Withdraw consent where we relied on it, such as for advertising cookies or marketing email.

To exercise any of these, email privacy (at) linkifythis (dot) com. We will respond within one month.

Closing your account from your account settings takes effect immediately and cannot be undone. Your page, its content and its analytics are deleted, your uploaded images are removed, any active subscription is cancelled, and a page code that has had visitors is not reissued to anyone else for 12 months.

Your email history, any Early Access application, and any vouchers are erased too. We send one last email to confirm the account is closed, and once it has been sent we erase that as well.

Two things are kept after your account is closed. We retain records of payments you made, because we are required to keep accounting records for the period set by law; they are no longer linked to your account, though our payment provider keeps its own records under its own legal obligations. We also retain any reports made about your page, with personal details removed, so that our moderation decisions remain reviewable.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to your national data protection authority, which for us is the Comissão Nacional de Proteção de Dados (CNPD).

13. Data breaches

If personal data is exposed in a way that puts you at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will tell you directly where the law requires it.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date at the top. Where a change materially affects your rights, we will tell you directly.

15. Contact us

If you have any questions about this Privacy Policy, or want to make a request about your data, please contact us at privacy (at) linkifythis (dot) com. For anything else, support (at) linkifythis (dot) com.