Privacy Policyhow we handle your data.

LinkScale (linkscale.to and dashboard.linkscale.to, the "Service") is operated by RM ECOM, SASU, a French simplified joint-stock company ("LinkScale", "we", "us"). Company details are on our Legal Notice.

This policy explains what personal data we process, why, with whom it is shared, how long it is kept and what rights you have. It applies to visitors of our website, to account holders, and to people who open a link built with LinkScale. The LinkScale browser extension has its own page: Chrome Extension Privacy.

• Account holders and website visitors: we decide why and how your data is processed, so we are the controller under the GDPR.
• Visitors of a link or page created by a LinkScale customer: the statistics about those visits are collected for that customer, who is the controller. We act as their processor, except for the security and anti-abuse processing described below, for which we are controller.

Customers who use LinkScale to collect data about their own visitors must inform those visitors and, where required, obtain their consent, for example through their own privacy notice. We process that data only on their documented instructions, keep it confidential, and help them answer requests from the people concerned.

Where we process the personal data of a customer's visitors as that customer's processor, the following terms apply between the customer and us, as required by Article 28 of the GDPR. They form part of our Terms.

• Scope: we process visit and click data, visitor identifiers, technical and location signals, and what visitors submit on the customer's pages, for the duration of the customer's account, in order to serve their links and pages and to provide statistics.
• Instructions: we process this data only on the customer's documented instructions, which are these terms and the settings the customer chooses in the Service, unless the law requires otherwise.
• Confidentiality and security: the people who can access the data are bound by confidentiality, and we apply the security measures described below.
• Sub-processors: the customer authorises us to use the providers listed under "Who we share it with", which are bound by equivalent obligations. We remain responsible for them, and we update this page before adding or replacing one so that a customer can object.
• Assistance: we help the customer answer requests from the people concerned, and meet their own security, breach notification and impact assessment obligations, taking into account the information available to us.
• Breaches: we notify the customer without undue delay after becoming aware of a personal data breach affecting their data.
• End of the contract: the data is deleted or anonymised after the account is closed, except where the law requires us to keep it.
• Audits: on reasonable written request, we provide the information needed to show that we comply with these terms.

The customer remains responsible for the lawfulness of the processing it asks us to carry out, including the information given to its visitors and any consent required.

When you create and use an account

• Identity and contact: name, email address, password (stored only as a hash) or the identity returned by a sign-in provider, language and time zone.
• Billing: plan, invoices, billing address, country and tax identifier. Card details are collected and held by our payment provider; we never see or store full card numbers.
• Content: the links, landing pages, templates, images and other files you create or upload, and the settings of your projects and team.
• Integrations: when you connect a third-party platform, the access it grants (tokens or session data, stored encrypted) and the data you ask us to synchronise.
• Usage and support: actions in the dashboard, security logs (sign-ins, IP address, device), and the messages you send us.

When someone opens a LinkScale link

• IP address, approximate location derived from it (country, region, city), browser and device type, operating system, language, referring page, date and time, and the buttons clicked.
• A random visitor identifier stored in the browser, used to count unique visitors and to keep a visitor on the same version of a page.
• Signals used to detect bots and abuse.
• What a visitor chooses to submit on a customer's page, such as a form entry, a contact request or a booking. That information goes to the customer who owns the page.

Data we receive from other sources

• Sign-in and payment providers: confirmation of your identity, and the status of your payments, disputes and refunds.
• Platforms you connect or ask us to follow: the data of the account you connected, and the publicly available profile, post and audience figures of the social accounts you ask us to track.
• Reports: information sent to us by a person or an authority about a link, a page or an account.

When you visit linkscale.to

• Technical data your browser sends (IP address, browser, pages viewed) and the information you enter in our forms, such as a contact or abuse report.

We do not ask for, and you should not send us, sensitive data such as health information, government identifiers or payment card numbers, whether in your content, in a form on your pages or in a message to us.

• Providing the Service (your account, links, pages, analytics, integrations, support): performance of our contract with you.
• Billing and accounting: performance of the contract and our legal obligations.
• Security, fraud and abuse prevention, including blocking automated attacks and handling reports of illegal content: our legitimate interest in keeping the Service and its users safe, and our legal obligations.
• Service emails about your account, billing, and problems with your links: performance of the contract.
• Product news and offers: your consent or, for existing customers, our legitimate interest. Every such email has a one-click unsubscribe.
• Improving the Service with aggregated usage statistics: our legitimate interest.

Some features use artificial intelligence, for example to draft a page or to analyse a post you selected. When you use them, the content you submit is sent to LinkScale and to AI service providers acting on our behalf under contract, only to produce the answer you asked for. We do not use your content to train AI models, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.

To protect links against bots, scraping and attacks, LinkScale automatically evaluates technical signals of each request (IP address and network, browser, request rate). A request judged automated may be slowed down, sent to a different page, or refused. These measures are temporary and are not used for any other purpose. If you believe you were blocked by mistake, contact us and a person will review it.

We do not sell personal data. We share it only with service providers that help us run the Service, under contracts that limit their use of it to our instructions:

• Hosting and delivery: Vercel, Cloudflare and our database providers.
• Payments: Stripe.
• Email delivery: Amazon Web Services.
• AI processing: AI service providers, for the features described above.
• Platforms you connect: only the data needed to run the integration you enabled.
• Domain registrars and registries: the contact details required to register a domain you buy through us.
• Professional advisers: our accountants, lawyers and insurers, where needed and under a duty of confidentiality.

Visitor statistics, form entries and bookings are made available to the customer who owns the link or page, and to the team members that customer has invited. What that customer does with them is governed by their own privacy notice.

We may also disclose data when required by law, to answer a valid request from a public authority, to protect the rights and safety of our users or of third parties, or as part of a merger or acquisition, in which case this policy continues to apply. We review each request from an authority, we disclose only what it validly requires, and we may report content that appears to be manifestly illegal, in particular any content endangering minors.

Some of our providers process data outside the European Economic Area, notably in the United States. Those transfers rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on the Standard Contractual Clauses adopted by the Commission, together with additional safeguards where needed.

• Account data and content: for as long as your account exists. After closure it is deleted or anonymised, except what we must keep by law.
• Link analytics: for as long as the account that owns the link exists, then deleted or anonymised.
• Invoices and accounting records: 10 years, as required by French law.
• Security logs: up to 12 months.
• Form entries, leads and bookings collected on a customer's page: until that customer deletes them or closes their account.
• Abuse reports, enforcement decisions and proof of consent: for as long as needed to establish, exercise or defend legal claims, generally up to 5 years.
• Marketing contacts: until you unsubscribe, or 3 years after our last contact with you.
• Backups: encrypted, and overwritten on a rolling basis.

We use cookies and browser storage for:

• Strictly necessary purposes: keeping you signed in, remembering your language and display settings, securing forms and detecting bots. These do not require consent.
• Link statistics: the visitor identifier described above, on links and pages created with LinkScale.
• Audience measurement and marketing, where used, only with your consent where the law requires it. You can withdraw it at any time.

You can also block or delete cookies in your browser settings; some features may then stop working.

Links and pages built with LinkScale lead to websites, applications and platforms that we do not operate, and LinkScale links are shared on social networks we do not control. This policy does not cover them: each one processes your data under its own privacy policy, and we are not responsible for what they collect or how they use it. The pages themselves are written by our customers, who are responsible for their content and for any tracking tool they add to them.

Data is encrypted in transit (HTTPS) and access to it is restricted to the people who need it to run the Service. Passwords are hashed, integration credentials are encrypted, and backups are encrypted. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires, which for the supervisory authority means within 72 hours where the breach creates a risk for the people concerned.

Security also depends on you: choose a strong password that you use nowhere else, keep your API keys and access tokens private, give team members only the access they need, and tell us at once if you suspect that someone else has used your account.

Under the GDPR and French law you have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing, including at any time to direct marketing;
• receive your data in a portable format;
• withdraw a consent you gave, without affecting earlier processing;
• give instructions about what happens to your data after your death.

To exercise them, email thomas at linkscale.to. We answer within one month and may ask you to prove your identity. If you opened a link created by a LinkScale customer, you may also contact that customer directly; we will forward any request we receive about their data.

You can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country of residence.

If you live in a U.S. state with a consumer privacy law, such as California, you have the right to know what personal information we collect and why, to access it, to correct it, and to have it deleted. The categories we collect, their sources and their purposes are described above.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for exercising these rights. You or an agent you authorise can make a request at the address below.

Because we do not sell or share personal information in that sense, there is nothing to opt out of, and our website does not change its behaviour in response to browser "Do Not Track" signals.

LinkScale accounts are reserved for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version, and we will tell account holders by email before any material change takes effect.