Privacy Policy
This Privacy Policy explains how Linkifier ("we," "us," "our," or the "Platform") collects, uses, discloses, shares, protects, and retains personal and technical data when you access or use our website (linkifier.me), creator pages, analytics dashboards, discovery tools, APIs, and all related services (collectively, the "Services"). By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.
1. Scope and Applicability
This policy applies to all users of the Platform, including creators who register accounts and manage link-in-bio pages, visitors who view or interact with those pages, and any third party whose data is processed in connection with the Services. It covers visitor-facing pages, account dashboards, email capture forms, link click tracking, telemetry and analytics reporting, directory and discovery features, AI-powered categorization and content processing, and all integrations with third-party processors.
If you are a creator operating a page on the Platform, you may also act as an independent controller or joint controller of visitor data collected through your page. You are responsible for your own compliance with applicable data protection laws in relation to any personal data you collect or receive through the Services.
2. Data We Collect
2.1 Account and Profile Data
- Registration information: email address, username, profile slug, password (hashed), and authentication tokens.
- Profile content: display name, bio/description, avatar and banner images, links and link metadata (titles, URLs, icons, ordering), theme and customization settings, social media handles, and any other content you publish to your page.
- Account identifiers, login timestamps, session metadata, IP addresses at login, device fingerprints, and security events (failed logins, password resets, suspicious activity flags).
- Subscription tier, billing status, and payment metadata received from third-party payment providers (such as Stripe). We do not store raw credit card numbers, CVVs, or full bank account details.
2.2 Visitor and Link Interaction Data
- IP address, forwarded-for headers, and related network metadata.
- User-agent string, browser type and version, operating system, device type, approximate country or region signals, and language preferences.
- Referrer URL, UTM parameters, campaign identifiers, and traffic source classification.
- Link click events: which links were clicked, timestamps, click order, timing of first and last click, and destination URLs.
- Page view and session events: page load time, total time on page, active time on page, scroll depth, reach-bottom flags, bounce indicators, and returning-visitor indicators generated from pseudonymous technical signals.
- Aggregated engagement statistics: total views, click-through rates, device/browser breakdowns, referrer breakdowns, IP-derived geographic summaries, quality/intent categories, and temporal patterns.
2.3 Cookies, Local Storage, and Tracking Technologies
- Essential cookies and storage: We use cookies and browser storage for authentication, security, fraud prevention, bot checks, language preferences, dashboard navigation, account state, and basic platform functionality. Examples include refresh-token cookies, short-lived bot-verification/result-gate cookies, external-browser gate cookies, session keys stored in session storage, language preferences, and cookie-consent preferences.
- Google reCAPTCHA: Some flows use Google reCAPTCHA v2 or v3, including the landing-page builder after cookie acceptance and optional quiz/result gates. reCAPTCHA may collect hardware, software, browser, device, interaction, IP address, and cookie information and send it to Google for spam, fraud, and abuse analysis. Google may set necessary cookies such as
_GRECAPTCHAwhen reCAPTCHA runs. - Cloudflare Turnstile: Some optional quiz/result gates may use Cloudflare Turnstile as an alternative bot-protection provider. Turnstile may process security, browser, device, interaction, IP address, and challenge outcome signals for spam, fraud, and abuse prevention.
- Google Analytics: The Linkifier landing page may load Google Analytics after cookie acceptance. Analytics data is used to understand traffic and improve the service.
- Sign-in and platform widgets: We may load Google Identity Services for Google sign-in and Trustpilot widgets on the landing page. Those third parties may process technical data under their own policies when their scripts load or when you interact with their services.
- Creator-configured tracking pixels: Creators can add Meta Pixel IDs, Google tag IDs, and Google Ads conversion labels to their own Linkifier pages. When enabled by a creator, these third-party tags may collect page views, outbound link clicks, email signup events, browser/device information, cookies, and similar identifiers according to Meta's or Google's own terms and privacy policies. Linkifier's built-in pixel prompt waits for visitor opt-in before loading these optional Meta/Google pixel scripts; creators remain responsible for having a valid legal basis and giving any visitor notices required for their use of these pixels.
- Affiliate and referral tracking: We may store referral codes in local storage and record hashed IP address, user-agent, referrer, and click date for affiliate attribution, abuse prevention, and payout calculations.
- Third-party embeds on creator pages (such as embedded videos, music players, or social widgets) may set their own cookies subject to those third parties' own privacy policies.
2.4 Email and Contact Data
- Email addresses submitted by visitors through creator page forms, newsletter signup widgets, or platform-level contact forms.
- Message content, metadata, timestamps, inbox events, and delivery status.
- Suppression lists, unsubscribe records, bounce status, spam complaint flags, and opt-in/opt-out history.
2.5 Third-Party Linked Content and Embeds
- When creators add links to third-party services (YouTube, Spotify, SoundCloud, TikTok, Instagram, Twitter/X, etc.), we may store the URLs and associated metadata (titles, thumbnails, embed codes) needed to render and track those links.
- We may fetch publicly available metadata (Open Graph tags, oEmbed data, favicon URLs) from linked destinations to generate previews and enrich link displays.
- Visitor interactions with embedded third-party content are subject to those third parties' privacy policies. We are not responsible for data collected directly by embedded third-party players or widgets.
2.6 AI Processing Inputs and Outputs
- Profile text, category labels, tags, attributes, link titles, link URLs, and related metadata submitted to AI processors for classification, quality scoring, content moderation, or discovery optimization.
- AI-generated outputs including category labels, topical groupings, SEO-oriented descriptions, quality scores, relevance rankings, abuse/spam risk scores, and content summaries.
- Prompt/response logs retained for debugging, quality assurance, and system improvement purposes.
2.7 Support and Communication Data
- Messages, tickets, and correspondence submitted through support channels, including email, in-app feedback, and any associated metadata.
- Feedback, feature requests, bug reports, and survey responses.
3. How We Use Data
- Provide, operate, maintain, and improve the Platform and all related Services.
- Render creator pages, serve link content, and process link click redirections.
- Generate analytics dashboards and telemetry reports for creators, including page views, unique visitors, click counts, geographic breakdowns, referrer analysis, temporal trends, and engagement metrics.
- Operate email capture workflows, lead routing, message delivery, unsubscribe processing, and anti-abuse controls.
- Operate cookie consent, bot-protection checks such as Google reCAPTCHA or Cloudflare Turnstile, affiliate attribution, and creator-configured pixel features where enabled.
- Power discovery and directory features, including search, category browsing, trending/featured listings, and recommendation systems.
- Classify, categorize, and score profiles and content using AI and machine learning systems for quality, relevance, and policy compliance.
- Detect, prevent, and respond to abuse, fraud, spam, bot traffic, scraping, policy violations, and security threats.
- Enforce rate limits, usage quotas, and tier-based access restrictions.
- Process payments, manage subscriptions, and communicate billing-related information.
- Provide customer support and respond to inquiries.
- Conduct internal research, testing, and development to improve platform quality and features.
- Comply with legal obligations, respond to legal process, and enforce our Terms of Service and other contractual rights.
4. Legal Bases for Processing (Where Applicable)
Depending on your jurisdiction, our processing of personal data may rely on one or more of the following legal bases:
- Consent: Where you have given explicit consent to specific processing activities, such as submitting your email through a creator page form or opting into marketing communications.
- Contractual necessity: Processing required to provide the Services you have requested, including account creation, page rendering, analytics delivery, and subscription management.
- Legitimate interests: Processing necessary for our legitimate business interests, including platform security, fraud prevention, abuse detection, performance monitoring, analytics, service improvement, and the operation of discovery and categorization systems. We balance these interests against your rights and freedoms.
- Legal obligations: Processing required to comply with applicable laws, regulations, court orders, or governmental requests.
5. Email Collection, Creator Access, and Shared Responsibility
If a visitor submits an email address or other contact information through a creator's page, that data may be made available to the creator (page owner/controller) for follow-up communication, newsletter distribution, or audience engagement purposes.
The creator receiving this data acts as an independent data controller with respect to their use of visitor-submitted information. Creators are solely responsible for ensuring their outreach complies with applicable laws, including obtaining any necessary consent, honoring unsubscribe requests, and adhering to anti-spam regulations (such as CAN-SPAM, CASL, and GDPR e-privacy requirements).
We maintain suppression and unsubscribe records at the platform level to reduce abuse risk and ensure that visitors who opt out are not re-contacted through our email infrastructure. We may suspend or terminate creator access to email features in cases of misuse or complaints.
6. Link Click Tracking and Redirect Processing
When a visitor clicks a link on a creator page, the click may be routed through our servers before redirecting to the destination URL. During this process, we collect the data described in Section 2.2 (click event metadata, timestamp, referrer, device information, and IP-derived geographic data). This data is used to populate analytics dashboards, detect click fraud or bot activity, and measure link performance.
Creators can view aggregated and, where applicable, per-link click statistics through their dashboard. We do not expose raw visitor IP addresses or personally identifiable visitor information to creators through standard analytics features.
7. Telemetry, Analytics, and Statistical Reporting
We collect telemetry data to measure platform performance, detect anomalies, identify usage trends, and deliver analytics features to creators and platform operators. Telemetry data may include page load performance metrics, API response times, error rates, uptime statistics, and resource utilization data.
We may aggregate, pseudonymize, or anonymize telemetry and analytics data for internal reporting, benchmarking, trend analysis, and product improvement. Aggregated and anonymized data that cannot reasonably be used to identify an individual is not subject to the restrictions of this Privacy Policy.
Raw client telemetry is ordinarily aggregated into summaries and then deleted after aggregation once it is no longer needed for event-level processing. Aggregated summaries may be retained longer for analytics, benchmarking, public statistics, fraud prevention, capacity planning, legal compliance, and dispute resolution.
8. AI and OpenAI-Based Processing
We use artificial intelligence systems, including services provided by OpenAI (via their API), to power various platform features. Specifically, we may transmit the following data to OpenAI or other AI processors:
- Profile text, display names, bio/description content, link titles, and link URLs for the purpose of automated categorization, topic classification, and quality scoring.
- Category taxonomy data, tag sets, and existing classification labels for the purpose of regrouping, merging, or refining category structures.
- Content snippets for the purpose of generating SEO-oriented descriptions, topical summaries, and discovery metadata.
- Aggregated content patterns (not individual visitor data) for the purpose of detecting abuse patterns, spam content, and policy violations.
We access OpenAI services through their API under contractual terms that prohibit OpenAI from using submitted data to train their models (API data usage policy as distinct from consumer product terms). We select API configurations that minimize data retention on the processor side where such options are available.
We do not transmit raw visitor personal data (such as IP addresses, email addresses, or device fingerprints) to AI processors for classification or categorization purposes. AI inputs are limited to creator-published content and platform taxonomy data.
AI systems are inherently probabilistic. Outputs including categories, scores, descriptions, and risk assessments may contain errors, inaccuracies, or biases. All AI-generated outputs are subject to human review and may be adjusted, overridden, or discarded. AI outputs should not be treated as guaranteed factual determinations or final decisions.
We may change AI processors or introduce additional AI services in the future. Any such changes will be reflected in updates to this policy.
9. Data Sharing and Disclosure
- Service providers and infrastructure partners: Hosting providers, CDN services, database providers, cloud storage, security and DDoS protection services, analytics platforms, payment processors (e.g., Stripe), and email delivery services (e.g., transactional email providers) that process data on our behalf under contractual obligations.
- Google services: Google may receive data when Google reCAPTCHA, Google Analytics, Google tag, or Google Ads conversion features are loaded or used.
- Creator-configured advertising and analytics providers: If a creator enables Meta Pixel, Google tag, Google Ads conversion tracking, or similar tools on their page, those providers may receive visitor interaction data as described in Section 2.3.
- AI and data processors: OpenAI and any other AI/ML service providers used for categorization, content analysis, quality scoring, abuse detection, and metadata generation, operating under data processing agreements.
- Creator page owners: Visitor-submitted contact information (email addresses, messages) is shared with the respective creator as described in Section 5. Aggregated analytics data is displayed to creators through their dashboards.
- Directory and discovery: Profile information that creators have chosen to make public (display name, bio, links, category, avatar) may appear in platform directory listings, search results, trending features, and category browse pages visible to other users and visitors.
- Legal and regulatory: We may disclose data to law enforcement, regulatory authorities, courts, or other governmental bodies when required by law, legal process, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
- Business transfers: In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or similar transaction, personal data may be transferred to the acquiring entity or successor. We will provide notice of any such transfer where required by law.
We do not sell personal data to data brokers. We do not use visitor personal data for Linkifier-owned cross-site advertising profiles. Some disclosures described above, especially creator-configured pixels or advertising tags, may qualify as "sharing" or "selling" under certain state or national privacy laws (such as the California Consumer Privacy Act); see Section 14 for jurisdiction-specific disclosures.
10. Third-Party Links and Services
Creator pages may contain links to third-party websites, platforms, and services. Clicking on such links will direct you away from the Platform to destinations that operate under their own privacy policies and terms. We are not responsible for the privacy practices, content, or security of any third-party sites or services linked from creator pages.
We encourage you to review the privacy policies of any third-party services you interact with through links on the Platform.
11. International Data Transfers
The Platform is operated from and data is primarily processed in the United States and the European Union. Your data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your jurisdiction.
Where required by applicable law (including the GDPR), we implement appropriate transfer safeguards such as Standard Contractual Clauses (SCCs), adequacy decisions, vendor security certifications, and contractual data protection commitments. By using the Services, you acknowledge and consent to the transfer of your data as described in this section, subject to applicable legal protections.
12. Security Measures
We implement administrative, technical, and organizational security measures designed to protect personal data against unauthorized access, alteration, disclosure, destruction, loss, and misuse. These measures include, but are not limited to:
- Encryption of data in transit (TLS/HTTPS) and at rest where applicable.
- Hashed and salted password storage; we never store plaintext passwords.
- Access controls, role-based permissions, and least-privilege principles for internal systems.
- Regular security assessments, dependency audits, and vulnerability monitoring.
- Rate limiting, bot detection, and abuse prevention systems.
- Logging and monitoring of access to sensitive systems and data.
No system is completely secure. While we strive to protect your data, we cannot guarantee absolute security, and you acknowledge the inherent risks of transmitting data over the internet and using cloud-based services. You are responsible for maintaining the confidentiality of your account credentials.
13. Data Retention
We retain personal data for as long as necessary to fulfill the purposes described in this policy, including:
- Account data: Retained for the duration of your account and for a reasonable period afterward (typically up to 12 months) to allow for account recovery and to comply with legal obligations.
- Analytics and telemetry data: Raw event-level telemetry is ordinarily retained until aggregation and deleted after aggregation, generally after it is more than 24 hours old. If aggregation is delayed, raw telemetry may remain until processed. Aggregated and anonymized analytics data may be retained indefinitely.
- Cookies and session data: Authentication refresh cookies may last up to 60 days unless you log out or clear cookies. Short-lived result-gate cookies generally last up to 1 hour, and external-browser gate cookies generally last seconds. Session storage entries usually expire when the browser session ends.
- Email and contact data: Retained as long as the associated creator account is active and for a reasonable period afterward. Suppression and unsubscribe records are retained indefinitely to ensure ongoing compliance.
- Affiliate and referral records: Retained as needed for attribution, payout calculations, fraud prevention, tax/accounting, and dispute handling.
- Security and abuse logs: Retained for up to 36 months to support security investigations, fraud prevention, and legal proceedings.
- AI processing logs: Input/output logs retained for up to 12 months for debugging and quality assurance; aggregated model performance metrics may be retained indefinitely.
- Legal holds: Data subject to legal proceedings, regulatory investigations, or disputes may be retained beyond standard periods as required.
Upon account deletion, we will delete or anonymize your personal data within a reasonable timeframe, except where retention is required by law or for legitimate business purposes as described above.
14. Jurisdiction-Specific Rights and Disclosures
14.1 European Economic Area, United Kingdom, and Switzerland (GDPR)
If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent local laws:
- Right of access to your personal data.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") under certain conditions.
- Right to restriction of processing.
- Right to data portability in a structured, commonly used, machine-readable format.
- Right to object to processing based on legitimate interests, including profiling.
- Right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing performed prior to withdrawal.
- Right to lodge a complaint with your local supervisory authority.
14.2 California (CCPA/CPRA)
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:
- Right to know what personal information we collect, use, disclose, and sell/share.
- Right to delete personal information, subject to certain exceptions.
- Right to opt out of the sale or sharing of personal information. We do not sell personal data for monetary consideration. To the extent that certain data disclosures (such as sharing analytics data with creators or transmitting data to AI processors) may constitute "sharing" under the CCPA, you may exercise your opt-out right by contacting us.
- Right to non-discrimination for exercising your privacy rights.
- Right to correct inaccurate personal information.
- Right to limit the use of sensitive personal information.
Categories of personal information we collect are described in Section 2. We collect this information for the business and commercial purposes described in Section 3. Categories of third parties with whom we share personal information are described in Section 9.
14.3 Other Jurisdictions
If you are located in a jurisdiction with applicable data protection laws (including but not limited to Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, or other state-level US privacy laws), you may have additional rights. We will honor valid requests in accordance with applicable law. Contact us at [email protected] to exercise any applicable rights.
15. Exercising Your Rights
To exercise any data protection rights described in this policy, you may submit a request to [email protected]. Please include sufficient information for us to verify your identity and specify which rights you wish to exercise.
We may require identity verification before processing your request. Verification may involve confirming account ownership through your registered email address or other reasonable means. We will respond to valid requests within the timeframes required by applicable law (typically 30 days under GDPR, 45 days under CCPA).
If we deny a request in whole or in part, we will provide an explanation of the reasons and inform you of any available appeal or complaint mechanisms.
16. Children
The Services are not intended for or directed at children under the age of 13 (or a higher minimum age where required by local law, such as 16 in certain EEA member states). We do not knowingly collect personal data from children under these age thresholds.
If we learn or have reason to believe that we have collected personal data from a child below the applicable age threshold without verified parental consent, we will take steps to delete that data as promptly as possible and may restrict or terminate associated accounts. If you believe a child has provided us with personal data, please contact us at [email protected].
17. Do Not Track Signals
Some browsers transmit "Do Not Track" (DNT) signals. There is no uniform industry standard for interpreting DNT signals. The Platform does not currently alter its data collection or use practices in response to DNT signals. If a uniform standard is established, we will revisit this position.
18. Data Controller and Processor Roles
For our own platform operations, Linkifier is operated by Internet Of The Bots, owned by Leelan Joy Korber, 9535 Römerweg, Austria. Legal contact: [email protected].
Linkifier acts as the data controller for personal data collected through the Platform for its own operational purposes (account management, platform analytics, security, AI processing, discovery features).
Where a creator collects visitor data through their page (such as email submissions), the creator acts as an independent data controller for their use of that data, and Linkifier acts as a data processor on behalf of the creator for the purpose of facilitating collection and delivery of that data. Creators operating in the EEA or processing EEA resident data may contact us to enter into a Data Processing Agreement (DPA) as required by the GDPR.
19. Automated Decision-Making
We may use automated systems, including AI-based classification and scoring, to categorize profiles, rank content for discovery, detect spam or abuse, and assign quality scores. These automated processes may affect the visibility, ranking, or classification of your content on the Platform.
Where automated decision-making produces legal or similarly significant effects on you, you have the right to request human review, express your point of view, and contest the decision. Contact us at [email protected] to request review of any automated decision.
20. Limitation of Liability
To the maximum extent permitted by applicable law, Linkifier shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from or related to the collection, use, disclosure, or processing of personal data under this Privacy Policy, including but not limited to damages arising from unauthorized access to or alteration of your data, errors in AI-generated outputs, actions taken by creators with visitor-submitted data, or data processed by third-party services linked from creator pages.
This limitation applies regardless of the theory of liability (contract, tort, strict liability, or otherwise) and even if we have been advised of the possibility of such damages.
21. Indemnification
Creators agree to indemnify, defend, and hold harmless Linkifier and its officers, directors, employees, agents, and affiliates from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to the creator's collection, use, storage, or disclosure of visitor personal data obtained through the Platform, including any failure to comply with applicable data protection laws, anti-spam laws, or this Privacy Policy.
22. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. Changes are effective when posted to the Platform. Where required by law, we will provide advance notice of material changes (such as by email to registered users or by prominent notice on the Platform).
Your continued use of the Services after the posting of a revised Privacy Policy constitutes your acknowledgment of and agreement to the updated policy. If you do not agree with any changes, you should discontinue use of the Services and may request deletion of your account and data.
23. Contact
For privacy inquiries, data protection requests, or questions about this policy, contact us at:
Legal/privacy email: [email protected]
Platform support: [email protected]
If you are located in the EEA and wish to raise a concern with a supervisory authority, you may contact the data protection authority in your country of residence.