Data Controller
Credifin Nederland B.V., Van Leijenberghlaan 199 D, 1082 GG Amsterdam. Chamber of Commerce (KVK): 34226691, VAT: NL8145.88.888.B01. Email: privacy@linkdash.eu.
1. What data do we collect
When creating an account, we collect your name, email address and password (stored encrypted). When you use your page, we process server-side usage data such as page views, click statistics, and technical metadata such as device category, country, referrer, and user agent. If you upload an avatar, this image is stored in our secure storage.
2. Purpose and legal basis of processing
We use your data solely for the following purposes, with corresponding legal basis (Art. 6 GDPR):
- Manage your account and provide access to the service — legal basis: performance of contract
- Host your link-in-bio page and display it to visitors — legal basis: performance of contract
- Show analytics so you can see how your page performs — legal basis: legitimate interest
- Process payments for paid subscriptions — legal basis: performance of contract
- Improve our service based on anonymous usage — legal basis: legitimate interest
3. Data retention periods
Account data is retained as long as your account is active. After account deletion, all personal data is permanently removed within 30 days. Analytics and usage data are retained for a maximum of 12 months. Payment data is retained for 7 years by our payment processor in accordance with legal obligations.
4. Sub-processors
We share your data with the following processors that are necessary for service delivery:
- Supabase (database and file storage) — servers in the EU (Frankfurt)
- Mollie (payment processing) — Netherlands, DNB-regulated
- Vercel (hosting and CDN) — US and EU edge locations, with EU Standard Contractual Clauses
- Resend (optional email delivery) — US, with EU Standard Contractual Clauses
- OpenAI (AI features) — US, with EU Standard Contractual Clauses. Only pseudonymized prompts are sent, no directly identifying personal data.
- Anthropic (AI features, alternative LLM provider) — US, with EU Standard Contractual Clauses. Only pseudonymized prompts; data is not used for model training.
- Cloudflare (CDN, DNS and DDoS protection) — global edge network with EU routing, with EU Standard Contractual Clauses
5. Data transfers outside the EU
Some of our sub-processors (Vercel, Resend, OpenAI, Anthropic, Cloudflare) are based in the United States. For these transfers, EU Standard Contractual Clauses (SCCs) apply as safeguards for an adequate level of protection in accordance with Art. 46 GDPR. Mollie and Supabase process data within the EU (Netherlands and Frankfurt respectively).
6. Storage and security
Your data is stored encrypted with secure database access and role-based authorization. Passwords are hashed and unreadable to our team. We make regular backups to prevent data loss.
7. Your rights
Under the GDPR, you have the right to:
- Request access to your personal data
- Request correction of inaccurate data
- Request deletion of your account and all associated data
- Object to certain processing
- Transfer your data to another service
9. Filing a complaint
If you believe your personal data is not being processed correctly, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
10. Data Processing Agreement (DPA) for business users
For data of visitors to your LinkDash page (analytics, subscribers, Mini Shop buyers, bookings, form submissions), LinkDash acts as processor and you — as account holder — act as data controller. For business users requiring a formal Data Processing Agreement (DPA) — for example due to your own GDPR accountability, a Data Protection Officer, or employer requirements — a standard DPA is available on request via privacy@linkdash.eu. This DPA contains terms compliant with Art. 28 GDPR, a list of sub-processors, a description of technical and organizational measures, data location (primarily EU/Frankfurt), data breach notification procedure, and handling of data subject requests. For consumers and small creators, a separate DPA is not required — this privacy policy provides the necessary transparency.
11. Contact
For questions about your privacy, contact us at privacy@linkdash.eu.