1. Who is in charge of your data
LinkMonkey ("we", "us") is the data controller for the personal data we process about you when you use our link‑in‑bio service. You can reach us at privacy@linkmonkey.io for any data‑protection question or request.
2. What we collect
- Account data: email, hashed password, username, display name, bio, avatar and header images.
- Profile content: the links you add, themes and customisation you choose, fan‑page posts, tip‑jar PayPal email, email‑campaign drafts and history.
- Billing data: Stripe customer ID, subscription status, billing cycle, the last four digits of your card (stored by Stripe, not us) and invoice history.
- Visitor analytics: page views, link clicks, approximate visitor country (IP‑geolocated) and referrer. Visitor IP addresses are used only momentarily for country lookup and rate‑limiting, then discarded.
- Communication logs: password‑reset, double opt‑in, failed payment and account‑deletion confirmation emails we send you via Resend.
- Operational logs: security events (login attempts, lockouts, token rotations), webhook errors and admin actions, retained for fraud/abuse defence.
3. Why we process it
We process the data above to (a) operate the service — render your public profile, store your uploads, deliver the emails you send, charge subscriptions; (b) keep the service safe — rate‑limit logins, detect abuse, prevent fraud, comply with our legal obligations; (c) improve the service — aggregate (non‑identifying) analytics about which features are used; (d) communicate with you about your account, security alerts and billing. We do not sell your data, ever.
4. Legal basis (GDPR)
For EU/UK users: we rely on contract (Art. 6(1)(b)) to deliver the service you signed up for, legitimate interests (Art. 6(1)(f)) for security, fraud prevention and aggregate analytics, legal obligation (Art. 6(1)(c)) for tax and accounting records, and consent (Art. 6(1)(a)) for optional features such as the newsletter signup widget where we collect a double opt‑in token before sending you anything.
5. Cookies and similar tech
- access_token, refresh_token (HttpOnly, Secure, SameSite=Lax) — keep you logged in. Required.
- csrf_token (Secure, SameSite=Lax) — protects you against cross‑site request forgery. Required.
- We do not use third‑party advertising or tracking cookies. We do not run pixels.
6. Who we share data with
- Stripe (Ireland) Ltd. — payment processing, subscription management, Customer Portal. Subject to Stripe's Privacy Policy.
- Resend — outbound transactional and creator‑campaign emails. Subject to Resend's Privacy Policy.
- Emergent Object Storage — hosts the images you upload (avatar, header, custom wallpaper, fan‑page images).
- MongoDB Atlas — encrypted‑at‑rest database for everything else.
- Cloudflare — DDoS protection and CDN for static assets. May briefly process IP addresses for routing and abuse defence.
- We never sell or rent personal data, and we never use it to train AI models.
7. International transfers
Some of our processors are located outside the EU/EEA. Where transfers leave the EU/EEA we rely on the European Commission's Standard Contractual Clauses or an adequacy decision to provide an essentially equivalent level of protection.
8. How long we keep it
Active account data is kept for as long as your account exists. When you delete your account (Settings → Delete account, or DELETE /api/auth/me), we permanently remove your profile, links, uploads, fan‑page posts and analytics within 30 days, and cancel your Stripe subscription immediately. Security and billing records may be retained for up to 7 years where required by law (e.g. VAT/accounting). Aggregate, non‑identifying analytics may be retained indefinitely.
9. Your rights
Under GDPR and similar laws, you have the right to:
- Access — request a copy of the data we hold about you.
- Rectify — correct inaccurate or incomplete data.
- Erase — delete your account from Settings, or email privacy@linkmonkey.io.
- Restrict or object — to certain processing based on legitimate interest.
- Portability — receive your profile data in a structured, machine‑readable format.
- Withdraw consent — for anything we ask consent for (e.g. newsletter widget).
- Complain — to your local supervisory authority. In Ireland, that's the Data Protection Commission (dataprotection.ie).
Email privacy@linkmonkey.io to exercise any of these rights. We respond within 30 days.
10. Security
Passwords are hashed with bcrypt. Sessions use HttpOnly, Secure, SameSite cookies with a CSRF double‑submit token. Login attempts are rate‑limited per IP, and we rotate refresh tokens on every refresh with cascade revocation on reuse. Uploads are scanned for malicious content (magic‑byte verification) and served from a path‑sanitised proxy. We enforce a strict Content‑Security‑Policy, HSTS, and the standard suite of security headers. No system is perfectly secure — please tell us about anything you find by emailing security@linkmonkey.io.
11. Children
LinkMonkey is not directed at people under 16. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, email privacy@linkmonkey.io and we'll delete the account.
12. Changes
We may update this Privacy Policy. Material changes will be announced by email or via a notice in the dashboard at least 14 days before they take effect. The "Effective" date at the top of this page always reflects the latest version.
13. Contact
privacy@linkmonkey.io for data‑protection requests. support@linkmonkey.io for everything else. We read every message.
Also read our Terms of Service.
← Back to LinkMonkey