Privacy Policy

1. Introduction

Ulinkly ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by Ulinkly.

This Privacy Policy applies to our website and its associated subdomains, the Ulinkly dashboard, our link and redirect service, our API, and our mobile SDKs when a customer integrates them into an app (collectively, our "Service"). A customer's own privacy notice also applies to their app and its users. By accessing or using our Service, you signify that you have read, understood, and agree to our collection, storage, use, and disclosure of your personal information as described in this Privacy Policy and our Terms of Service.

Ulinkly is operated by Flywheel Studio. If you have questions about this policy or our data practices, contact us at contact@ulink.ly.

2. Our Role: Controller and Processor

Ulinkly handles personal information in two distinct roles, and your rights and our obligations depend on which role applies.

As a controller. For information relating to our own account holders, such as the contact details, credentials, and billing data of the people who register for and administer a Ulinkly account, we act as the data controller. We decide why and how that information is used.

As a processor. When you use Ulinkly to create links and those links are clicked by your own end users, we collect and process click and device data on your behalf and under your instructions. In that context, you (our customer) are the controller of your end users' data, and Ulinkly acts as your processor. Our processing of that data is governed by your instructions and our Terms of Service.

This distinction matters because it determines who is responsible for responding to end-user privacy requests. For end-user click data, we will generally direct requests to the relevant customer who controls that data.

3. Information We Collect

We collect information from you when you visit our website, register on our site, subscribe to updates, respond to a survey, fill out a form, or use our Service.

3.1 Account and Contact Information (we act as controller)

• Contact information (such as name and email address)
• Account credentials (such as passwords, stored in hashed form)
• Billing and transaction information (processed through our payment provider)
• Usage information (such as how you interact with our dashboard and Service)
• Device information (such as IP address and browser type)

3.2 Link and Click Information (we typically act as processor)

When you create and use links through our Service, we collect data about those links and the interactions with them, including:

• The links you create and their configuration
• Click analytics, including timestamp, referrer, IP address, user agent, approximate location derived from the IP address, and device information. IP addresses are stored as received; we do not anonymize them.

Where this data relates to your end users, we process it on your behalf as described in Section 2.

3.3 App and SDK Information (we typically act as processor)

When a customer integrates our SDK into their app, the app sends us installation and persistent-device identifiers; device model, manufacturer, operating system, and app version; language and timezone; and any metadata the app chooses to include. We also record the request IP address, user agent, and approximate location.

SDK session requests can include session start and end times, screen orientation, network type, battery level, and charging state. To match a new install to an earlier link click (deferred deep linking), we compare a fingerprint made from the IP address, screen width, and timezone; a click is eligible for matching for 24 hours. The SDK does not read the device clipboard.

We use this information to provide deep linking, deferred-link matching, attribution, analytics, and usage-based billing. Customers control the links and metadata they send to us and should not place sensitive personal information in link URLs or metadata.

3.4 Information from Sign in with Google (we act as controller)

You can create and sign in to a Ulinkly account with your Google account. When you do, we request only the basic "email" and "profile" permissions, and Google shares the following with us:

• Your email address and whether Google has verified it
• Your name and profile picture URL, as set in your Google account
• Your Google account identifier, which links your Google sign-in to your Ulinkly account

We use this information only to create your Ulinkly account, sign you in, and contact you about your account and our Service (for example, project invitations, billing, and security notices). We do not access your Gmail, contacts, calendar, Drive, or any other Google data, and we cannot post on your behalf.

This information is stored with our authentication provider, Supabase (see Section 5), for as long as your account exists, and is deleted with your account as described in Section 6. We do not sell it, use it for advertising, or share it with third parties except the service providers who help us run the Service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Ulinkly's access at any time from your Google account settings; this stops Google sign-in but does not delete your Ulinkly account.

3.5 Status Page Subscriptions (we act as controller)

If you subscribe to updates on our status page (status.ulink.ly), we collect your email address, the components you choose to follow, and when you confirmed or unsubscribed. We use them only to send you incident and maintenance updates. To limit abuse of the subscribe form, we also record the requesting IP address for one day.

4. How We Use Your Information and Legal Bases

We use the information we collect to:

• Provide, operate, and maintain our Service
• Improve, personalize, and expand our Service
• Understand and analyze how our Service is used
• Develop new products, features, and functionality
• Communicate with you for customer service, updates, and marketing purposes
• Identify you as a customer of Ulinkly, consistent with our Terms of Service (you may opt out as described there)
• Process transactions
• Detect and prevent fraud and abuse
• Comply with legal obligations and enforce our Terms of Service

Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we rely on the following legal bases for processing personal information for which we are the controller:

• Contract: to provide the Service you have signed up for and to process payments.
• Legitimate interests: to secure, improve, and analyze our Service, to prevent fraud, and to carry out limited direct marketing, balanced against your rights.
• Consent: where required, for example for certain marketing communications or non-essential cookies, and for status page updates, which you confirm from your inbox and can stop with the unsubscribe link in every email. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws and respond to lawful requests.

5. Sharing Your Information and Sub-Processors

We may share information in the following circumstances:

• With vendors and service providers (sub-processors) who process data on our behalf and under contract
• In response to a lawful request where we believe disclosure is required by applicable law, regulation, or legal process
• To protect the rights, property, or safety of Ulinkly, our users, or others, and to enforce our agreements
• In connection with a merger, sale of assets, financing, or acquisition of all or part of our business
• With your consent or at your direction

We use the following sub-processors to operate the Service. They process data in the European Union and the United States. This list may be updated from time to time; the current list is maintained on this page.

We also use the following providers for our own website, dashboard, and documentation. They do not receive your end users' app or SDK data.

6. Data Retention

We retain personal information only for as long as necessary for the purposes described in this policy, unless a longer period is required by law.

• Link, click, and app/SDK data: retained while the link or project it belongs to exists. Customers can delete a link or a project at any time. Deleting a link deletes its click data; deleting a project deletes all of its links, clicks, installations, sessions, and deferred-link data. Deleted data is removed from our production database immediately and from backups within 30 days.
• Account data: deleting your account removes your login, profile, and project memberships immediately, and from backups within 30 days. Deleting your account does not delete projects; delete your projects first, or contact us, to remove their data.
• Billing records: payment and invoice records held by Stripe are retained by Stripe as required by tax and financial regulations.
• Status page subscriptions: unconfirmed subscriptions are deleted after 7 days. After you unsubscribe we keep your email address marked as unsubscribed so that you are not emailed again; contact us to have it deleted. Records of sent update emails are deleted after 30 days, and backups of the status page within 14 days.

7. International Data Transfers

Our primary database is hosted in the European Union (Frankfurt, Germany), and our status page in the European Union (Bulgaria). Our sub-processors and providers process data in the European Union and the United States, so your information may be processed in a country other than your own. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), or transfers to countries recognized as providing an adequate level of protection.

8. Cookies and Tracking Technologies

Our website and dashboard use cookies and similar technologies for sign-in, analytics and session recording (Google Analytics and PostHog), and advertising measurement (an OpenAI measurement tag on our marketing website). Cookies are small data files stored on your device that may include a unique identifier. Ahrefs and Vercel Analytics measure traffic without cookies.

If you visit from the European Union, the European Economic Area, the United Kingdom, or Switzerland, Google Analytics, PostHog, and the OpenAI measurement tag load only after you accept them in our cookie banner. If we cannot determine your location, we ask for consent. Visitors elsewhere receive them by default. Anyone can accept or reject them at any time from "Cookie settings" in our website footer; your choice is stored in a first-party cookie for 12 months. Sign-in cookies are necessary for the dashboard and are always used.

The redirect pages that serve your end users' links and our mobile SDKs do not use these analytics or advertising tools.

9. Data Security

We have implemented appropriate technical and organizational measures designed to protect the personal information we process, including encryption in transit, hashed credentials, and access controls. However, no method of electronic transmission or storage is fully secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our Service is not directed to children. We do not knowingly collect personal information from children under the age of 16 in the EEA and the UK, or under the age of 13 elsewhere. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

11. Your Privacy Rights

11.1 EEA and UK residents

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

11.2 US state residents

If you are a resident of California or another US state with applicable privacy laws (such as the CCPA/CPRA and comparable state laws), you may have the right to:

• Know what personal information we collect, use, and disclose
• Request access to and deletion of your personal information
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising

We do not sell personal information for money. We use advertising measurement tags on our marketing website, which some US state laws may treat as "sharing" for cross-context behavioral advertising; you can opt out from "Cookie settings" in our website footer, by contacting us at contact@ulink.ly, or by blocking cookies in your browser. You will not be discriminated against for exercising any of these rights.

11.3 How to exercise your rights

To exercise any of these rights, contact us at contact@ulink.ly. We will respond within the timeframe required by applicable law. Where your request concerns end-user data that we process on behalf of a customer, we will refer the request to that customer as the controller.

12. Health and Other Sensitive Data

The Service is not designed to store protected health information or other sensitive personal information, and we do not sign Business Associate Agreements under HIPAA. Do not put protected health information or other sensitive data in links, link metadata, or SDK metadata.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new policy on this page with its effective date. Where changes are material, we will provide additional notice as required by law. Changes are effective when posted unless otherwise stated.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at contact@ulink.ly.