1. Controller
The Linkyr operator is the controller and must add its legal name, address and privacy contact before launch. Telegram: @kyrax0.
Privacy Notice
How Linkyr handles data, why, retention periods and your rights.
Effective: 10 August 2026 · Version 2026-08-10AddressVietnam
Registration details are incomplete and must be completed before commercial operation.
Full policy
This is Linkyr's operative policy. Terms cannot erase criminal liability, mandatory duties or consumer rights. The operator must obtain licensed legal review and complete its legal identity before commercial operation.
2. Data collected
Account/profile data; URLs, slugs, QR and settings; transactions/plans; support and abuse reports; security logs; device, browser, approximate country, referrer and hashed visitor identifiers. When Cloudflare Turnstile is enabled, device/network signals and a verification token are processed to prevent bots, fraud and abuse. Raw IP addresses are not stored in analytics by default.
3. Purposes and legal bases
Contract performance, security/fraud prevention, payment, minimal analytics, support and legal compliance. Where consent is required, withdrawal does not affect prior lawful processing.
4. Recipients and transfers
Need-to-know sharing may include Supabase, SePay, Cloudflare Turnstile, hosting/CDN, email, URL-safety vendors, advisers and lawful authorities when configured or required. Cross-border processing must use safeguards and records required by applicable law.
5. Retention
Detailed clicks default to 180 days before deletion/aggregation; sessions up to 30 days; short-lived tokens as disclosed; account data until deletion; billing, audit and abuse evidence as needed for tax, disputes and law. Backups rotate under the operating schedule.
6. Your rights
Depending on location: notice, access, correction, deletion, restriction, objection, consent withdrawal, portability, complaint and non-discrimination. California rights may include know, delete, correct, opt out of sale/sharing and limit sensitive data where applicable. Linkyr does not currently sell personal information.
7. Children
The service is not directed to US children under 13 and does not knowingly collect their data unlawfully. Guardians may request deletion; higher local age rules still apply.
8. Security and requests
Controls include HttpOnly sessions, CSRF, password hashing, parameterized queries, authorization, audit and rate limits; no system is perfectly secure. Contact @kyrax0; identity verification and statutory response periods apply.
9. Data sources
Data comes from you, device/browser, Linkyr activity, workspace members, login/payment providers, abuse reporters and public safety sources. Linkyr does not buy personal advertising profiles.
10. Automation and decisions
Automated URL signals, rate limits and warnings protect the service. Material long-term restrictions are evidence-reviewed with an appeal path; Linkyr does not profile people for legal decisions about credit, employment or insurance.
11. Destinations and workspaces
Link owners independently control data collected at destinations. Workspace owners/admins may see member and role activity; organizations must give their own appropriate notices to members and visitors.
12. Data incidents
We investigate, contain, remediate and notify affected people or authorities where law requires based on data type, likely consequences and mitigations. Users should promptly report suspicious activity.
13. Changes and contact
Updates show an effective date and material changes receive reasonable notice. Send privacy rights requests to the operator's privacy email with enough verification information, never a password or OTP.
14. International transfers
Infrastructure may process data outside your residence, including the configured Supabase project region and Vercel/Cloudflare networks. Linkyr must assess destinations, transfer necessity and required safeguards before claiming a specific SCC, adequacy route or certification.
15. Privacy signals and no sale
Linkyr does not currently sell personal information or use behavioral advertising, so there is no advertising sale/sharing to opt out of. Where applicable, valid Global Privacy Control signals are honored for in-scope activity; Do Not Track has no uniform response standard.
16. Verification and complaints
To protect accounts, we may verify identity and authority before access, correction, deletion or export requests. If dissatisfied, complain to Linkyr and an applicable data-protection or consumer authority.