Privacy Policy

Last updated: 8 April 2025 · Service provider: LinkHaus

This Privacy Policy explains how LinkHaus ("we", "us", "our") collects, uses, stores, and protects personal data when you visit a profile page hosted on our platform, or when you use our service as a creator. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable data protection laws.

1. Data Controller

LinkHaus operates this platform. For any data protection enquiries, contact us at: [email protected]

2. What Data We Collect

When a visitor opens a creator profile page, we automatically collect the following data:

IP address — used to estimate country of origin and prevent abuse.
User agent string — used to determine device type (mobile, tablet, desktop) and browser.
Referring URL — the page you came from before visiting a profile.
Timestamp — date and time of the visit or link click.
Country — derived from IP address; the raw IP is not stored permanently.
Device type and browser — derived from user agent; stored as a category (e.g. "mobile", "Chrome").

We do not collect names, email addresses, or any other directly identifying information from visitors unless you voluntarily contact us.

    We do not use cookies for tracking. We do not run third-party advertising trackers.
    We do not sell your data to any third party.
  

3. How We Use Your Data

The data collected is used solely for the following purposes:

Providing creators with aggregated analytics — total clicks, page views, device breakdown, and country breakdown. Creators see aggregated statistics only, not individual visitor identities.
Platform security — detecting and blocking abusive traffic, bots, and spam.
Service operation — ensuring links resolve and redirect correctly.

4. Legal Basis for Processing (GDPR)

We rely on the following legal bases under Article 6 GDPR:

Legitimate interests (Art. 6(1)(f)) — analytics and security processing is carried out in our legitimate interest to operate and improve the platform, in a manner that does not override your rights and freedoms.
Legal obligation (Art. 6(1)(c)) — where applicable law requires us to retain certain data.

5. Data Retention

Raw click event and page view records are retained for a maximum of 24 months, after which they are deleted or anonymised. IP addresses embedded in stored records are not used beyond the initial country lookup and are not linked to identifiable individuals.

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for their own purposes. Data may be disclosed:

To our infrastructure providers (database hosting, server providers) who act as data processors under a data processing agreement and are bound by GDPR-equivalent obligations.
If required by law or legal process (e.g. court order, regulatory demand).

7. International Transfers

Our database infrastructure may be hosted within the European Economic Area (EEA). If data is processed outside the EEA, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses) in accordance with Chapter V of the GDPR.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access (Art. 15) — request a copy of the data we hold about you.
Right to rectification (Art. 16) — request correction of inaccurate data.
Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten").
Right to restriction of processing (Art. 18) — request that we limit how we use your data.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — object to processing based on legitimate interests.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA within the EU).

9. Children's Privacy

Our platform is not directed under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. This includes encrypted database connections and access controls on all stored data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of profile pages after an update constitutes acceptance of the revised policy.