Privacy Policy

1.1 Information You Provide Directly

• Account data: email address, display name, and (for email/password sign-up) a bcrypt-hashed password managed by Supabase Auth. We never store plaintext passwords.
• Profile information: optional profile photo, bio, and username for your public profile page.
• Smart links & content: destination URLs, slugs, titles, deep-link targets, passwords for protected links, QR code settings, and any other content you create through the Service.
• AI generation inputs: prompts, scripts, reference images, audio files, and any other material you provide to AI generation features. These are transmitted to third-party AI providers (see Section 5).
• Payment information: billing name and address. Card numbers and payment credentials are collected directly by Stripe and never stored on our servers.
• Communications: messages you send to our support team.
• Referral information: referral codes you share and payout details you provide.

1.2 Information Collected Automatically

• Click analytics: when a visitor follows one of your short links we record the timestamp, HTTP User-Agent header, HTTP Referer header, country and city (derived from IP via server-side geolocation), device type, operating system, and browser. We store a one-way daily-salted hash of the visitor's IP address for unique-visitor counting only. Raw IP addresses are never stored.
• Usage data: pages visited within the dashboard, features used, credits consumed, and session duration, collected to improve the Service.
• Log data: our hosting infrastructure (Vercel) may log request paths, HTTP response codes, and timestamps for operational and security purposes.
• Session cookies: a session token issued by Supabase Auth to keep you logged in across requests.

1.3 Information from Third Parties

• Google OAuth: if you sign in with Google we receive your name, email address, and profile picture from Google, subject to the permissions you grant.
• Stripe: payment status, subscription tier, and transaction history.

For users in the EU/EEA and UK, we rely on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the Service you signed up for — account management, link operation, AI generation, billing, and analytics.
• Legitimate interests (Art. 6(1)(f) GDPR): security monitoring, fraud prevention, product improvement, and sending service-related communications. We balance these interests against your rights.
• Legal obligation (Art. 6(1)(c) GDPR): complying with applicable laws, court orders, and regulatory requirements.
• Consent (Art. 6(1)(a) GDPR): sending marketing emails (you may withdraw consent at any time) and the Meta Pixel / Conversions API advertising measurement described in Section 4, which only runs after you accept our cookie banner and can be withdrawn at any time. We do not currently send marketing emails; if we do so in future we will obtain separate consent first.

• To create and manage your account and authenticate your identity.
• To operate and deliver the Service, including short link redirection, analytics, and AI content generation.
• To process payments and manage subscriptions and credits through Stripe.
• To send transactional emails: account confirmations, password resets, billing receipts, and renewal notices (via Resend).
• To administer the referral and affiliate programme, including tracking conversions and processing payouts.
• To detect, investigate, and prevent fraud, abuse, spam, and security incidents.
• To comply with legal obligations and enforce our Terms of Service.
• To analyse aggregate, anonymised usage trends to improve the Service.
• To respond to your support requests and communications.

We do not sell your personal data. With your consent, we share limited data with Meta Platforms, Inc. to measure and improve the performance of our advertising — see Section 4.

We use the following cookies and similar technologies:

• Authentication cookie (strictly necessary): a session token set by Supabase Auth to keep you logged in. Without this cookie the Service cannot function.
• Preference cookies: lightweight local storage values to remember UI preferences (e.g., dashboard tab state). No personal data is stored.
• Meta Pixel and Meta Conversions API (consent-based): with your consent, we use Meta's browser pixel and server-side Conversions API to measure the performance of our advertising campaigns (e.g., which sign-ups or purchases originated from an ad) and to build advertising audiences. This shares limited data with Meta Platforms, Inc. — such as a hashed version of your email address, your IP address, browser user agent, and the pages you visit — for this purpose. See Meta's Privacy Policy for how Meta processes this data.

We display a cookie consent banner on your first visit. Accepting enables the Meta Pixel/Conversions API described above; declining keeps only the strictly necessary authentication and preference cookies. You may change your choice at any time by clearing your browser's local storage for this site, or block/delete cookies via your browser settings — note that blocking the authentication cookie will prevent you from logging in.

We share personal data only with the categories of recipients listed below, each acting as a data processor under a data processing agreement or equivalent safeguard:

We may also disclose personal data to law enforcement or government authorities when required by valid legal process (court order, subpoena, regulatory demand), or to protect the rights, property, or safety of LinkSnap, our users, or the public. We will notify you of such disclosures where permitted by law.

In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity, subject to the same privacy protections. We will notify you before your data is transferred and becomes subject to a materially different privacy policy.

LinkSnap and its third-party processors operate globally. Your personal data may be transferred to and processed in countries outside your country of residence, including the United States, which may have different data protection standards than your home country.

For transfers of personal data from the EU/EEA or UK to third countries, we rely on:

• The EU–US Data Privacy Framework (where the recipient is certified).
• Standard Contractual Clauses (SCCs) adopted by the European Commission.
• UK International Data Transfer Agreements (IDTAs) for transfers from the UK.
• Adequacy decisions issued by the European Commission, where applicable.

You may request a copy of the applicable transfer mechanisms by emailing support@linksnap.live.

When you use AI generation features, your prompts and input materials are transmitted to the relevant third-party AI provider (listed in Section 5). Each provider's data handling is governed by their own terms and privacy policy. Key points:

• We do not use your prompts or AI outputs to train our own models.
• Some providers may use inputs for model safety evaluation or improvement subject to their own policies. Where opt-outs are available, we apply them.
• Do not include sensitive personal information (health data, financial data, government ID numbers) in AI prompts, as these will be sent to third-party servers.
• AI-generated outputs stored in our system (AWS S3) are associated with your account and subject to our data retention policy.

• Account and profile data: retained for the lifetime of your account. Deleted within 30 days of account closure, except where we are legally required to retain it longer.
• Smart links and settings: retained as long as your account is active. Deleted within 30 days of account closure.
• Click analytics data: retained for 24 months, then permanently deleted.
• AI-generated files (images, videos, audio): retained in AWS S3 for up to 90 days after generation, then automatically deleted unless you have explicitly saved them to your account.
• Credit transaction ledger: retained for 7 years to comply with financial record-keeping obligations.
• Support communications: retained for 3 years after resolution of the support request.
• Backup data: encrypted backups are retained for up to 30 days before being overwritten.

You may request early deletion of your personal data at any time (subject to our legal retention obligations) by contacting us at support@linksnap.live.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of all data in transit via TLS 1.2+.
• Encryption of data at rest in Supabase (PostgreSQL) and AWS S3.
• Row-level security (RLS) in our database ensuring users can only access their own data.
• Bcrypt hashing of passwords; plaintext passwords are never stored or logged.
• One-way daily-salted hashing of visitor IP addresses; raw IPs are never stored.
• Rate limiting on authentication and API endpoints via Upstash Ratelimit.
• Content Security Policy (CSP) and security headers on all responses.
• Strict access controls limiting employee access to personal data on a need-to-know basis.

Despite our measures, no internet transmission or storage system is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the applicable supervisory authority within 72 hours of discovery, as required by applicable law.

Depending on your location, you may have the following rights regarding your personal data:

10.1 Rights Under GDPR (EU/EEA and UK Users)

• Right of access (Art. 15): obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17): request deletion of your personal data, subject to our legal retention obligations.
• Right to restriction of processing (Art. 18): ask us to pause processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making (Art. 22): we do not make solely automated decisions with legal or similarly significant effects on you.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.

You also have the right to lodge a complaint with your local supervisory authority. For EU users, find your authority at edpb.europa.eu. For UK users, contact the ICO.

10.2 California Privacy Rights (CCPA / CPRA)

California residents have the following rights under the CCPA as amended by the CPRA:

• Right to Know: request disclosure of the categories and specific pieces of personal information collected, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to Delete: request deletion of personal information we have collected, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: we do not sell or share personal information for cross-context behavioural advertising. No opt-out is currently required, but you may submit a request for confirmation.
• Right to Limit Use of Sensitive Personal Information: we do not use sensitive personal information beyond the purposes permitted by the CPRA.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.

To exercise CCPA rights, submit a verifiable consumer request to support@linksnap.live. We will respond within 45 days (extendable by a further 45 days with notice). You may designate an authorised agent to make a request on your behalf; we will require written proof of authorisation.

Do Not Track: we honour browser-level Do Not Track (DNT) signals by not engaging in cross-site tracking. We do not use third-party advertising trackers regardless of DNT status.

10.3 How to Exercise Your Rights

To exercise any privacy right, email us at support@linksnap.live with the subject line "Privacy Rights Request". We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request.

The Service is not directed at children under the age of 13 in the United States (as defined by COPPA) or under 16 in the EU/EEA (as defined by GDPR). We do not knowingly collect personal information from children below these ages without verifiable parental consent.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at support@linksnap.live. We will delete the information as quickly as practicable.

We may send you transactional emails (account confirmations, billing receipts, password resets, security alerts) without your separate consent, as these are necessary to operate the Service.

If we introduce a marketing newsletter or promotional communications, we will obtain your separate opt-in consent first. You may opt out of any marketing emails at any time by clicking "Unsubscribe" in the email or by contacting us. Opting out of marketing emails does not affect delivery of transactional emails.

All emails are sent via Resend and comply with the CAN-SPAM Act (US), CASL (Canada), and the Privacy and Electronic Communications Regulations (UK/EU).

The Service enables you to create short links to third-party websites and to integrate with third-party AI providers. This Privacy Policy does not apply to those third-party sites or services. We encourage you to review the privacy policies of any third-party site you visit via our platform. We are not responsible for the content or privacy practices of third-party destinations.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes at least 14 days before they take effect via:

• An email to the address associated with your account, and/or
• A prominent notice within the Service dashboard.

The "Effective date" at the top of this page reflects the date of the last revision. We encourage you to review this policy periodically. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

LinkSnap AI — Privacy Team
Email: support@linksnap.live
Subject line: Privacy Enquiry
Website: linksnap.live

We aim to respond to all privacy-related enquiries within 5 business days. Formal rights requests will be handled within the statutory timeframes noted in Section 10.