PRIVACY POLICY

At Linky, we're committed to transparency about how we collect, use, and protect your personal information. This Privacy Policy explains our practices and outlines your rights regarding your information.

We recommend that you read this Privacy Policy in full to ensure you are fully informed. However, if you only want to access a particular section, you can click on the relevant link below to jump to that section.

What does Linky do?

Linky is a modern link hub built specifically for creators. Whether you're a musician, podcaster, comedian, or any type of creator, our platform helps you share all your content in one beautiful, customizable page. We enable creators to connect their audience to all their online destinations, making content more discoverable and easier to manage.

This Privacy Policy applies to our websites and services which include Linky (https://linky.ai) and its related software or features (collectively referred to as our "Platform" or "Linky"). The Platform allows creators to sign-up to create a personalized, easily-customizable link hub, share their content, monetize their work, and track analytics. The pages that Linky Users are able to create using the Linky Services are referred to as "User Profiles." User Profiles are accessible by the public.

We are headquartered in the United States. Our services are primarily hosted on Cloudflare's global edge network, which provides fast, secure, and reliable infrastructure for our Platform.

How does this Privacy Policy apply to me?

This Privacy Policy only applies to personal information we collect as a controller about:

• Individuals who visit and interact with the Linky Services or User Profiles;
• Individuals that sign up to use our Linky Services via a paid plan;
• Individuals who interact with Linky Users through their User Profiles;
• Individuals who respond to our surveys, marketing materials or participate in promotions that we may run from time to time.

In this Privacy Policy, we refer to all of the above individuals collectively as "Linky Users."

This Privacy Policy applies to the processing of personal information by Linky as a controller. When we talk about Linky acting as a "controller", we mean that Linky determines the purpose and the means of the processing (i.e. we make decisions about why and how we handle your personal information). Because of the nature of our services, we may also act as a "processor" on behalf of a Linky User. In these instances, we facilitate the processing of personal information on behalf of the Linky User and based on their instructions. For example, if you interact with a Linky User's profile or make a payment to them, we facilitate this processing ("Processor Services"). This Privacy Policy does not address our Processor Services. If you interact with a Linky User and want to know how they handle your personal information, please get in touch with that Linky User directly.

If you provide us with information about another person (if, for example, you are a representative of an individual), you must provide them with a copy of this Privacy Policy and let that other person know that we use their personal information in the ways set out in this Privacy Policy.

Third-party processing and responsibilities

Linky enables connections between Linky Users and third parties, such as payment processors, social platforms, and external websites. Once you interact with a third party (such as by clicking a link, making a payment, or visiting an external website), Linky does not control how your personal information is processed by that third party.

We strongly recommend reviewing the privacy policies of any third parties you interact with via Linky. If you have concerns about how a third party handles your personal information, please contact that third party directly.

Information we collect

The personal information that we may collect about you broadly falls into the following categories:

Information you provide voluntarily

When you use and/or engage with the Linky Services, we may ask you to provide personal information voluntarily.

• Account and Profile Information: When you create a Linky account, we will ask you to provide some information which may include your email address, name, username, profile picture, biography, and other profile information.
• Payment and Transaction Information: If you use a paid plan, we will ask for additional information, such as your full name, billing email address, billing address and payment method. We will also collect information about your purchase history and transaction records. We collect this information in order to facilitate billing.
• Communication Data: If you choose to contact us or submit a report, we may collect information such as an email address to facilitate these services and your communication preferences. For example, we may ask you to provide your name and email address so that we can respond to your queries.
• Content Data: We collect the content you create on the Platform, including links, descriptions, customizations, themes, and other profile settings.

Information that we collect automatically

When you use the Linky Services, we collect certain information automatically from your device. In some countries, including countries in the European Economic Area and the UK, this information may be considered personal information under applicable data protection laws.

• Usage and Analytics Data: We collect information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location), time zone, usage data, diagnostic data and other technical information. We may also collect information about how you arrive at Linky Services, including the referring website or service, and how you interact with the Linky Services and User Profiles, including the pages accessed and links clicked. Collecting this information enables us to better understand you, where you come from, and what content is of interest to you, and enables us to share useful analytics with Linky Users.
• Content Moderation Data: We may undertake automatic scanning of User Profiles and links to support compliance with our Terms of Service, which may include determining whether content should be removed or any User Profiles should be suspended in line with our Terms of Service.

Information that we obtain from third party sources

From time to time, we may receive personal information about you from third party sources.

• Authentication Providers: When you sign in using Google or Facebook OAuth, we receive your profile information (name, email, profile picture) from these providers in accordance with their privacy policies.
• Payment Processors: We may receive information from our payment processors (Stripe) to support commerce products, enabling us to process payments and provide services to Linky Users.
• Cloudflare: As our infrastructure provider, Cloudflare may process certain technical information (IP addresses, request data) as part of providing their services. This processing is governed by Cloudflare's privacy policy and our agreement with them.

How we use the information we collect

We will use the information we collect for the purposes described in this Privacy Policy or for other purposes that we explain to you at the time we collect your personal information.

In some countries, including countries in the European Economic Area and the UK, we are required to have a legal basis to process your personal information. These legal bases include, first, the performance of a contract. This applies when we need to process your information to provide you with the Linky Services under our Terms of Service, or to take steps before entering into a contract with you. We may also rely on our legitimate interests, where processing your information is necessary for our business and those interests are not overridden by your rights. In some cases, we process your information based on your consent. This means we'll ask for your permission before using your information for certain purposes. Finally, we may need to process your information to comply with legal obligations, such as responding to lawful requests.

The table below provides a summary of the purposes for which we process your personal information, the legal basis we rely on in each case, and the categories of information involved:

Children's data

Our services are not intended for use by children under the age of 18 (the "Age Limit"). If you are under the Age Limit, please do not use the Linky Services and do not provide us with your personal information. If you are a parent or guardian and you are aware that an individual (of whom you are a parent or guardian) under the Age Limit has provided us with personal information, please contact us. We will, upon notice or discovery, take all reasonable efforts to delete any personal information that may have been collected or stored by us about that individual.

How and when we share the information we collect

We may disclose your personal information to the following categories of recipients:

• to our third party services providers (for example, to support the delivery of the Linky Services, provide functionality, facilitate payments, fulfill tax obligations, or enhance the security of the Linky Services). Our service providers include Cloudflare (hosting and infrastructure), Stripe (payment processing), Google and Facebook (authentication), and Slack (notifications). We only engage third party service providers after careful review of their data protection measures;
• with other Linky Users if you choose to interact with their User Profiles or make payments to them through our Platform;
• with third parties who facilitate log-in to the Linky Services, such as Google and Facebook;
• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
• to an actual or potential buyer (and their agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer they must use your personal information only for the purposes disclosed in this Privacy Policy; and
• to any other person with your consent to the disclosure or notified to you when we collect your personal information.

In order to facilitate paid products and/or services within the Linky Services, we use third party payment service providers. We will not store or collect your payment card or bank account details; this information is provided directly to our third party payment service providers (Stripe), whose use of your personal information is governed by their privacy policies and their terms and conditions in their role as data controller for these processing activities. These payment service providers adhere to the standards set by payment card industry data security standards ("PCI-DSS") as managed by the Payment Card Industry Security Standards Council. The payment processor we work with is Stripe (their privacy policy can be viewed at https://stripe.com/privacy).

Disclosure of personal information to other countries

Your personal information may be transferred to and processed in countries other than the country in which you are a resident. These countries may have data protection laws that differ from, and in some cases may be less protective than, the laws of your country.

Specifically, Linky may transfer personal information to the United States (where our services are primarily hosted on Cloudflare's infrastructure), and other countries where we conduct business or where our service providers are located. We may also subcontract certain activities and share your personal information with third parties located in other countries. The countries where these organisations are located will vary, but we generally disclose personal information to organisations located in the United States. These transfers are necessary to provide the Linky Services and carry out the activities described in this Privacy Policy.

We have taken appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy and applicable data protection laws. These safeguards include entering into data transfer agreements with our third-party service providers. We will not transfer your personal information to another country unless we believe there to be adequate safeguards in place. This includes, where applicable, utilising standard contractual clauses approved by the European Commission and by other relevant authorities, or relying on determinations from the European Commission and other relevant authorities about whether countries have adequate levels of protection. We also implement measures to ensure the security of your personal information wherever it is transferred.

How do we use cookies and similar tracking technology?

We use cookies and similar tracking technology (collectively, "Cookies") to collect and use personal information about you. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Policy.

How long do we retain your personal information?

We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy and in accordance with applicable legal and regulatory requirements in respect of permitted or required retention periods and limitation periods relevant to legal action. When we no longer need your personal information, we will securely delete or anonymize it, except where we are required to retain it for legal, regulatory, or accounting purposes.

How do we secure your personal information?

We have implemented technical, administrative, and physical safeguards to ensure the security of your personal information. These controls include:

• Industry-standard encryption for data in transit and at rest
• Cloudflare's global security infrastructure, including DDoS protection, Web Application Firewall (WAF), and bot management
• Secure authentication through OAuth providers (Google, Facebook)
• Regular security audits and monitoring
• Access controls and authentication requirements
• Secure payment processing through PCI-DSS compliant providers (Stripe)

In the unlikely event of a data breach, we have a robust incident response plan to mitigate harm and notify affected individuals where we are legally required to do so.

What are your rights in relation to personal information?

Your rights may depend on where you live and the laws that apply to you. You can contact us to:

• Access, correct, update or request deletion of your personal information
• Object to or restrict how we process your personal information
• Request portability of your personal information
• Opt out of receiving marketing communications. You can also exercise this right by clicking on the unsubscribe or opt-out link in the marketing materials we send you

If you have given consent to the processing of your personal information, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal information conducted in reliance on other lawful grounds.

Depending on the country which you live in and the laws that apply to you, you may also have additional data protection rights. If you are located in the UK or the European Economic Area, you also have the right to complain to a data protection authority. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. In some instances, we may need to verify your identity before granting you access to your personal information or complying with your request.

Your U.S. State Privacy Rights and Additional Disclosures

Depending on the U.S. state in which you reside, you may have certain privacy rights regarding your personal information. If you are a California resident, please see the "Supplemental Information for California Residents" section below. For other state residents, your privacy rights may include (if applicable):

• The right to confirm whether or not we are processing your personal information and to access such personal information
• The right to obtain a copy of your personal information in a portable format
• The right to delete your personal information, subject to certain exceptions
• The right to correct inaccurate personal information that we maintain about you
• The right, if applicable, to opt out of the processing of your personal information for purposes of targeted advertising, the "sale" of your personal information, and profiling
• The right not to receive discriminatory treatment by us for the exercise of your privacy rights

To exercise your rights, please contact us using the information provided in the "Contact us" section below. If legally required, we will comply with your request upon verification of your identity.

Supplemental Information for California Residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 ("CCPA"), requires that we provide California residents with a privacy policy that contains a comprehensive description of our practices regarding the collection, use, disclosure, sale, sharing, and retention of personal information. This section is intended solely for, and is applicable only as to, California residents.

Categories of Personal Information We Collect: We collect identifiers (name, email, username), personal records (payment information), commercial information (purchase history), online usage information (browsing history, interactions with our services), geolocation data, and inferences derived from personal information.

Sale and Sharing of Personal Information: We do not sell personal information in the traditional sense. However, our use of cookies and similar tracking technologies may constitute a "sale" or "sharing" of personal information under California law. You can opt out by adjusting your cookie preferences as described in our Cookie Policy.

California Privacy Rights: California residents have the right to (1) know what personal information we collect, use, disclose, and sell; (2) request deletion of personal information; (3) correct inaccurate personal information; (4) opt out of the sale or sharing of personal information; and (5) not be discriminated against for exercising these rights.

To exercise your California privacy rights, please contact us at privacy@linky.ai. We will verify your identity before responding to your request. You may designate an authorized agent to exercise these rights on your behalf, subject to verification requirements.

Complaints

We take your privacy concerns seriously. If you have a complaint regarding our handling of your personal information or concerning our privacy practices, you may file a complaint with us using the contact details provided under the "Contact us" heading below. We will confirm receipt of your complaint and, if we believe necessary, we will open an investigation. In the unlikely circumstances we are unable to resolve your complaint to your satisfaction, you may contact the local privacy and data protection authorities in your jurisdiction.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws. You can see when this Privacy Policy was last updated by checking the "last updated" date displayed at the top of this Privacy Policy.

Contact us

If you have any questions about this Privacy Policy or our privacy practices, or if you would like to make a request about any personal information we hold about you, please contact us:

• By email using: privacy@linky.ai
• By visiting our support page: FAQ

Linky Service Providers

We work with the following service providers to deliver the Linky Services:

• Cloudflare: Hosting, infrastructure, D1 database, KV storage, and security services
• Stripe: Payment processing
• Google: OAuth authentication
• Facebook (Meta): OAuth authentication
• Slack: Notification services (for violation reports)

Each of these service providers has their own privacy policies governing how they handle personal information. We encourage you to review their privacy policies to understand their practices.