Privacy Policy

1. Preamble, scope, and definitions

This Privacy Policy (hereinafter, the “Policy”) constitutes a binding disclosure instrument between you, in your capacity as either a visitor, registered user, creator, subscriber, purchaser, or any other natural or legal person who accesses, interacts with, or otherwise utilises the LinkStage platform, mobile-responsive web application, application programming interfaces, embedded widgets, and all affiliated subdomains, microsites, and services (collectively, the “Services”), and LinkStage, its subsidiaries, affiliates, agents, successors, assigns, and service providers (collectively, “LinkStage,” “we,” “us,” or “our”). For the purposes of this Policy, “Personal Data” shall mean any information relating to an identified or identifiable natural person, including but not limited to pseudonymous identifiers, online identifiers, device fingerprints, behavioural profiles, and any other data elements capable, whether alone or in combination with other data elements held by LinkStage or third-party processors, of identifying, directly or indirectly, a data subject; “Processing” shall mean any operation or set of operations performed upon Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction; “Controller” shall refer to LinkStage insofar as it determines the purposes and means of Processing; and “Processor” shall refer to any third party engaged by LinkStage to Process Personal Data on its behalf and under its documented instructions. This Policy applies irrespective of the device, operating system, browser, network, or geographic location from which you access the Services, and it supplements, without replacing, the terms set forth in the LinkStage Terms of Service, Community Guidelines, Creator Agreement, and any other published contractual or informational document that governs your relationship with us. By continuing to access or use the Services after the effective date set forth above, you expressly acknowledge that you have read, understood, and consented to the practices described herein, including the cross-border transfer, retention, and Processing activities outlined in subsequent sections, and you agree to be bound by the then-current version of this Policy.

2. Categories and sources of information collected

In the ordinary course of providing, maintaining, securing, improving, personalising, monetising, and supporting the Services, LinkStage collects, receives, generates, and otherwise Processes a broad spectrum of information, which may be classified into the following non-exhaustive, overlapping categories:

• Account and registration information. When you create, verify, upgrade, downgrade, or modify a LinkStage account, we collect identifiers and credentials such as email address, username or handle, display name, profile slug, password or authentication tokens, telephone number (if provided), date of birth (where age-gating or regional restrictions require), country or region of signup, preferred language, time zone, marketing preferences, and any other details you voluntarily submit through onboarding flows, account settings, or support channels. In cases where authentication is performed through a third-party identity provider (e.g., Google OAuth), we may additionally receive profile photos, names, and verification status subject to the permissions you grant.
• Profile and user-generated content. The Services are designed to enable creators to construct publicly visible or selectively accessible link-in-bio pages, storefronts, fan-letter portals, newsletters, and multimedia galleries. Consequently, we Process profile metadata, biographical narratives, photographs, videos, audio clips, thumbnail images, social media handles, external hyperlinks, product listings, pricing information, passcode-protected or geofenced content configurations, fan-mail settings, tipping and donation preferences, scheduled posts, and any comments, messages, or submissions transmitted by or to you through our platform.
• Transactional and payment data. If you initiate, receive, or facilitate any monetary transaction through the Services—whether in the form of subscription upgrades, one-time tips, product purchases, payouts, refunds, or affiliate conversions—we, together with our payment processors, banks, tax-service providers, and fraud-prevention partners, collect billing address, payment method details (which, in the case of card numbers, are tokenised or otherwise handled directly by certified payment processors and are not retained in full by LinkStage), transaction history, invoice identifiers, tax-identification numbers where required by law, and records necessary for reconciliation, dispute resolution, chargeback defence, and regulatory reporting.
• Usage, analytics, and interaction data. We automatically collect technical and behavioural information each time you interact with the Services, including but not limited to Internet Protocol (IP) addresses, device type and model, operating system version, browser type and version, screen dimensions, language settings, referring and exit URLs, clickstream data, dwell time, scroll depth, feature usage, search queries, error logs, crash reports, session identifiers, cookie identifiers, local storage contents (where permitted and technically relevant), and aggregated or pseudonymised statistics derived therefrom.
• Communications and correspondence. We retain records of any emails, support tickets, live-chat transcripts, feedback submissions, survey responses, social-media interactions, legal notices, abuse reports, moderation appeals, and any other written, audio, or visual communications exchanged between you and LinkStage or between users through Service-facilitated channels.

The aforementioned information may be obtained directly from you, from your device or browser, from third-party integrations that you authorise (such as social-media accounts, email-service providers, analytics platforms, or e-commerce tools), from publicly available sources, from our affiliates and successors in interest, and from automated monitoring and logging systems that operate continuously to preserve Service integrity.

2a. Data obtained from connected social platforms

When you connect a social account, LinkStage accesses data through that platform’s official API using only the permissions you grant, and solely to deliver the features you asked for. We do not sell, rent, license, transfer or share platform data with advertisers, data brokers or any third party, we do not use it to build advertising profiles or train machine-learning models, and we do not use it for any purpose beyond what is described below. You may disconnect an account at any time, which deletes the stored tokens and cached platform data.

• Instagram (Instagram Graph API). We use your Instagram basic profile (user id, username, profile picture), media publishing permissions, comments and messages, and account insights only to publish or schedule the posts you create in LinkStage, to show your comments and direct messages in your LinkStage inbox and let you reply, and to display your own follower, reach and engagement statistics to you. This data is not used for any other purpose.
• Facebook (Meta Graph API). We use Facebook Page identifiers, Page access tokens, Page posts, comments, messages and Page insights only to publish or schedule content to the Pages you select, to show Page comments and messages in your inbox, and to display your own Page statistics. This data is not used for any other purpose.
• TikTok (TikTok API). We use your TikTok open id, display name, avatar, creator posting information (privacy options, Duet/Stitch/comment availability) and video publishing endpoints only to upload and publish the videos you schedule with the settings you choose, and to show your own video and follower statistics. TikTok data is never used for advertising, enrichment or resale, and never shared with third parties.
• YouTube (YouTube Data & Analytics API). LinkStage’s use of information received from YouTube APIs follows the YouTube Terms of Service and the Google Privacy Policy. We use your channel id, video metadata, comment threads and channel analytics only to upload and schedule your videos, to show and answer comments in your inbox, and to display your own views, subscriber and audience statistics. You can revoke LinkStage’s access at any time via Google security settings. This data is not used for any other purpose.
• Pinterest (Pinterest API). We use your Pinterest account id, boards and pin-creation endpoints only to create the pins you schedule and to show your own pin performance statistics. This data is not used for any other purpose.
• Snapchat (Snap Kit / Snapchat API). We use your Snapchat display name, avatar and content-publishing endpoints only to publish the content you schedule and to display your own statistics. This data is not used for any other purpose.
• Threads, X and Bluesky. Where you connect these accounts, we use the profile identifier, publishing endpoints and reply/comment data only to publish your scheduled posts and to show and answer replies in your inbox. This data is not used for any other purpose.

Access and refresh tokens are stored encrypted and are used only to keep your connection alive. Media files you schedule are stored temporarily on Cloudflare R2 and deleted once the post is confirmed published on every selected platform.

2b. Third-party subprocessors and international transfers

LinkStage relies on the following processors, each engaged under a data-processing agreement and, where data leaves the EEA, EU Standard Contractual Clauses:

• Supabase — database, authentication and backend hosting (account data, content metadata, email lists).
• Cloudflare (incl. R2) — content delivery, security, and temporary storage of media files you upload or schedule.
• Resend — transactional and newsletter email delivery (email addresses, delivery, open and click events).
• Google Cloud — OAuth sign-in, Google Drive relay for scheduled media, and YouTube API access.
• Stripe — subscription and purchase payments, payouts, tax and fraud prevention (billing details; full card numbers are handled by Stripe, never by LinkStage).
• Social platforms you connect yourself — Meta (Instagram, Facebook, Threads), TikTok, Google/YouTube, Pinterest, Snapchat, X and Bluesky, strictly to perform the actions you request.

2c. Age requirements and 18+ content

LinkStage is not intended for children. You must be at least 16 years old to create an account (and at least 18 to sell products, receive tips or payouts, or to publish or access sections marked 18+). Creators may mark links, tiles or pages as 18+; visitors must confirm they are 18 or older before that content is shown, and we record only the fact and time of that confirmation. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

3. Legal bases, purposes, and uses of processing

LinkStage Processes Personal Data for a variety of specific, explicit, and legitimate purposes, the principal among which include, without limitation: (a) performing the contractual obligations owed to you and facilitating the creation, hosting, publication, distribution, monetisation, and analytics of creator content; (b) maintaining the security, availability, resilience, and integrity of the Services, including detecting, preventing, investigating, and remediating fraud, abuse, unauthorised access, spam, malware, denial-of-service attacks, and other harmful or unlawful activities; (c) complying with applicable laws, regulations, judicial orders, subpoenas, government requests, tax obligations, anti-money-laundering and know-your-customer requirements, and other legal process to which LinkStage may be subject; (d) communicating with you regarding account status, security alerts, policy updates, marketing messages (where consented or otherwise permitted by law), service announcements, and support responses; (e) conducting internal research, product development, A/B testing, personalisation, recommendation engineering, and the measurement and optimisation of conversion, engagement, retention, and satisfaction metrics; (f) enforcing our Terms of Service, acceptable-use policies, intellectual property rights, and the rights, property, or safety of LinkStage, our users, or the public; and (g) supporting corporate transactions such as mergers, acquisitions, financings, restructurings, asset sales, or dissolutions, to the extent that Personal Data forms part of the transferred business assets.

Where required by applicable data-protection law, we rely upon one or more lawful bases for Processing, which may include the necessity of Processing for the performance of a contract to which you are a party; the necessity of Processing for compliance with a legal obligation to which LinkStage is subject; the necessity of Processing for the purposes of the legitimate interests pursued by LinkStage or by a third party, except where such interests are overridden by your fundamental rights and freedoms; and, in certain circumstances, your freely given, specific, informed, and unambiguous consent, which you may withdraw at any time, subject to the consequences described in the relevant consent flow and this Policy.

4. Newsletters, electronic marketing, and consent management

The Services enable creators to operate newsletter and mailing-list functionalities through which end users may subscribe to receive communications. In accordance with best practice and, where applicable, the requirements of laws such as the Controlling the Assault of Non-Solicited Pornography and Marketing Act, the Canada Anti-Spam Legislation, the Privacy and Electronic Communications Regulations, and similar instruments, subscription to a creator newsletter is generally conditioned upon a double opt-in confirmation mechanism, whereby the prospective subscriber must first submit an email address and subsequently confirm that submission by clicking a unique verification link sent to the submitted address. Notwithstanding the foregoing, creators may configure alternative subscription methods, and LinkStage disclaims responsibility for any deviation by a creator from the recommended double opt-in process, except to the extent mandated by law. Each marketing or newsletter communication dispatched through the Services must contain a clear and functional mechanism—typically an unsubscribe link—permitting the recipient to withdraw consent or otherwise object to future communications. Unsubscribe requests are processed in accordance with applicable legal timelines and technical constraints; however, certain transactional or relationship messages, such as receipts, account-security notices, and policy updates, may continue to be sent even after a marketing opt-out.

5. Cookies, tracking technologies, and similar mechanisms

LinkStage and its authorised partners utilise cookies, web beacons, pixels, local storage objects, scripts, software development kits, and other tracking or analytics technologies (collectively, “Tracking Technologies”) to authenticate sessions, preserve preferences, enhance security, measure traffic and usage patterns, deliver and measure the performance of advertising campaigns, and otherwise operate and improve the Services. Essential cookies, which are strictly necessary for the provision of the Services and the maintenance of authentication and security, are deployed without additional consent where permitted by law. Non-essential cookies, including those used for analytics, personalisation, and marketing, are deployed only where required consents have been obtained or where an applicable legal basis exists. You may manage your cookie preferences through your browser settings, operating-system controls, or third-party consent-management tools; however, please be advised that disabling certain categories of cookies may impair the functionality, performance, or availability of particular features of the Services, and LinkStage shall not be liable for any such degradation arising from your election to limit Tracking Technologies.

6. Disclosure, sharing, and onward transfers

LinkStage does not sell, rent, trade, or otherwise monetise your Personal Data as a commodity in the conventional sense. We do, however, disclose and share Personal Data with selected categories of recipients when necessary to achieve the purposes described in this Policy, including: (i) service providers and Processors that perform infrastructure hosting, content delivery, payment processing, fraud prevention, email delivery, customer support, analytics, marketing, security monitoring, and similar functions on our behalf and pursuant to written contracts that impose confidentiality, security, and data-protection obligations; (ii) creators, to the extent that their pages, newsletters, storefronts, and fan-letter systems necessarily collect or display information submitted by visitors or purchasers; (iii) law enforcement, regulatory authorities, courts, and other governmental bodies, when we believe in good faith that such disclosure is required or permitted by law, necessary to protect our rights or the rights of others, or necessary to respond to an emergency involving personal safety; (iv) affiliates, successors, and assigns in connection with a corporate transaction or reorganisation; and (v) other third parties with your express consent or at your direction. Where Personal Data is transferred outside the jurisdiction in which it was collected, LinkStage implements appropriate safeguards, which may include standard contractual clauses, adequacy decisions, binding corporate rules, or other lawful transfer mechanisms recognised by applicable data-protection authorities.

7. Data subject rights, requests, and limitations

Depending upon your country or region of residence or access, you may be entitled to exercise certain rights with respect to your Personal Data, which may include, where applicable and subject to verification and legal exceptions, the right to access and obtain a copy of your Personal Data; the right to rectify inaccurate or incomplete Personal Data; the right to erase or request the deletion of your Personal Data; the right to restrict or object to certain Processing activities; the right to data portability; the right to withdraw consent; and the right not to be subject to automated decision-making that produces legal or similarly significant effects. To exercise any such right, or to lodge a complaint, inquiry, or request regarding the Processing of your Personal Data, you may contact us using the email address provided in Section 10 below. We will respond within the timeframe required by applicable law and may request additional information to verify your identity before processing your request. Please note that the exercise of certain rights may be limited by contractual, legal, or technical constraints, including the need to retain records for tax, accounting, fraud-prevention, security, or litigation purposes.

8. Security, retention, and integrity

LinkStage employs a multi-layered security programme that incorporates administrative, technical, and physical safeguards designed to protect Personal Data against unauthorised access, disclosure, alteration, and destruction. These measures include, but are not limited to, transport-layer encryption, encryption at rest where technically feasible, role-based access controls, network segmentation, intrusion detection, vulnerability management, incident-response procedures, employee training, and periodic security assessments. Notwithstanding the implementation of these safeguards, no method of electronic transmission or storage is entirely immune to risk, and we cannot guarantee absolute security. We encourage you to use strong, unique passwords, enable multi-factor authentication where available, exercise caution when clicking third-party links, and report any suspected security incident to us promptly. Personal Data is retained for as long as necessary to fulfil the purposes for which it was collected, to satisfy our legal, regulatory, tax, accounting, and contractual obligations, to resolve disputes, to enforce our agreements, and to protect our legitimate interests, after which it is securely deleted, anonymised, or aggregated in accordance with our retention schedules and applicable law.

9. Amendments, updates, and notifications

LinkStage reserves the right, in its sole discretion and without prior individualised notice except where required by law, to modify, supplement, amend, restate, or replace this Policy at any time to reflect changes in legal requirements, our business practices, the Services, or the threat landscape. The revised Policy will be posted at this URL with an updated “Last updated” date, and your continued access or use of the Services after such posting constitutes your acceptance of the revised terms. If we make material changes that materially affect your privacy rights, we will endeavour to provide a more prominent notice, such as an email notification or an in-application alert, where practicable and where required by applicable law.

10. Contact information, supervisory authorities, and grievances

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy, our privacy practices, or the Processing of your Personal Data, you may contact us by electronic mail at the address set forth below. We will make reasonable efforts to address your inquiry in a timely manner. If you are located in a jurisdiction that provides a right to lodge a complaint with a supervisory or data protection authority, you may exercise that right in addition to, or instead of, contacting us directly. Please direct correspondence to: privacy@linkstage.io.

11. How to exercise your GDPR rights, and cookies

Under the GDPR you have the right of access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and the right to withdraw consent at any time (Art. 7(3)).

• Access & portability. Email privacy@linkstage.io with the subject “Data access request”; we send a machine-readable export (JSON/CSV) within 30 days.
• Correction. Edit your details in Creator Studio → Settings, or email us and we will correct them for you.
• Deletion. Follow the Data Deletion Instructions — in-app deletion is immediate; email requests are processed within 30 days.
• Objection & consent withdrawal. Unsubscribe links end newsletter consent instantly; disconnecting a social account withdraws API access; cookie choices can be changed by clearing site data.
• Complaints. You may complain to your local supervisory authority.

Cookies and tracking. We set strictly necessary cookies for sign-in, security and preferences, and we run first-party analytics that record IP address (used for coarse country lookup and shortened after use), page views, referrer, device and browser. Analytics storage is only used after you accept it in our cookie banner; choosing “Essential only” keeps the necessary cookies alone. We do not use third-party advertising cookies or cross-site tracking pixels.