Privacy Policy

Linkhiver is a link-in-bio platform that lets creators, musicians, businesses, and brands publish a single page of links and share it from a linkhiver.com/username URL. To make that work, we collect a limited amount of information about you and your visitors. This policy describes what we collect, why, and the choices you have.

Linkhiver is operated by Criccletech Bilişim Ltd. Şti., an independent software company registered in Istanbul, Türkiye. Criccletech is the data controller for the personal data described in this policy, and you can reach us about any of it at privacy@linkhiver.com.

If you are accessing the Service from the European Economic Area, the United Kingdom, or Switzerland, the GDPR applies to your data and the legal bases for processing are described in Section 11. If you are a California resident, your rights under the CCPA/CPRA are described in Section 12. If you are in Türkiye, Law No. 6698 on the Protection of Personal Data (KVKK) applies to you, and the disclosure notice required by its Article 10 is published at linkhiver.com/tr/kvkk.

We collect information in three categories:

Information you provide directly. When you create a Linkhiver account, we collect your name, email address, and a hashed password (we never store passwords in plain text). If you build a profile, we store the bio, profile photo, links, and any other content you choose to publish.

Information we collect automatically. When you use the Service, we record device and browser information (user agent, screen size, language), approximate location derived from IP address (country and city, not street), the pages you visit on linkhiver.com, and basic engagement metrics on your published profile (link clicks, view counts, referrer domain). Public profiles also record aggregated visitor analytics, which the profile owner can see.

Information from third parties. If you sign in with Google or Apple, we receive your name and email address from that provider. We do not receive your password or social-graph data.

Visitor analytics on public profiles. When someone opens a public Linkhiver profile we record the visit so the profile owner can see view and click counts. These records are cookieless — we store nothing on the visitor's device and no identifier for them, only the event type, the link tapped, the referring site, a coarse device category, and a country derived from the network request. We rely on legitimate interest for this, and any visitor can switch it off under Cookie preferences.

How you use your dashboard. While you are signed in we record how you use Linkhiver itself — which dashboard pages you open and which features you use, such as adding a link or creating a QR code. This is first-party product data about your own account: it stays in our database, is never shared with or sold to anyone, and we store no IP address, no browser or device fingerprint, and nothing about the content you create. We use it only to see where the product helps and where it gets in the way. It rests on legitimate interest, so it is not part of the cookie banner, and every record is deleted along with your account.

We use the information we collect to:

• Provide the Service — host your profile, serve it to your visitors, and make sure your links actually work.
• Send transactional emails (password resets, security alerts, important service notices) — you cannot opt out of these because they are part of the Service.
• Send product updates and tips — you can opt out of these at any time from the email footer or your account settings.
• Detect and prevent abuse, fraud, spam, and illegal content on the platform.
• Generate aggregated, non-identifying statistics that help us understand which features matter and which to retire.

We do not sell your personal information. We do not sell your visitors' data. We do not train AI models on the content you publish.

Linkhiver sets first-party cookies to keep you signed in and to remember preferences such as dark mode and your language. These are strictly necessary to run the Service and load without asking. We set no advertising cookies of our own and do not track you across other websites.

On linkhiver.com we use Google Analytics 4 and Microsoft Clarity to understand how the site is used. Clarity stays off until you accept analytics cookies in the banner. Google Analytics uses Google Consent Mode: until you accept, it sets and reads no cookies and sends Google only cookieless pings with no identifier, which Google uses to estimate overall traffic and sign-ups. You can withdraw your acceptance at any time under Cookie Preferences. On app.linkhiver.com the arrangement is different: Microsoft Clarity — session recording and heatmaps — is on by default across the signed-in product, including the setup flow you complete when you join, and on our pricing page, which anyone can open without an account. There it does not wait for you to accept cookies, and there are three ways to switch it off: reject cookies on the banner; open Cookie preferences in the footer of our pricing page; or, if you have an account, turn it off under Settings → Security → Cookie preferences. Neither runs on a published profile, business card or QR page: visits there are measured cookielessly, as described in Section 2. We also use a Meta pixel on linkhiver.com for our own advertising; it waits for the same banner. Separately, a first-party cookie records which campaign brought you to the site so we can tell where a sign-up came from - in the EU, the EEA and the UK it waits for your answer too, and a Reject stops it everywhere. The banner asks once, and one answer covers all of them.

Advertising pixels on creator pages. A creator can connect their own advertising pixel (Meta, TikTok or Google Analytics) to their public page. When they do, the pixel loads by default — the page shows no consent bar — and those providers receive your page view, how long you stayed, which links you tapped, and any contact save or signup, under their own privacy policies and for that creator's advertising account, not ours. You can switch this off at any time under Cookie Preferences in the footer of any creator page; once it is off, no pixel loads and nothing is sent. Pages without a connected pixel load no third-party script.

We share personal information only in the following situations:

• Sub-processors. We run no servers of our own. The providers below process data on our instructions, under a data processing agreement, and each receives only what its role requires:
  • Supabase, Inc. — managed Postgres database, authentication and file storage. Holds your account, profile, links, uploaded media and analytics events. Our database instance runs in the ap-northeast-1 region: Tokyo, Japan.
  • Vercel Inc. — application hosting and edge delivery for linkhiver.com and app.linkhiver.com.
  • Cloudflare, Inc. — DNS, CDN and denial-of-service protection in front of app.linkhiver.com, and Turnstile bot protection on the sign-in and sign-up forms.
  • Paddle.com Market Ltd, United Kingdom — our merchant of record for payments on the web: checkout, subscriptions, invoicing, sales tax and refunds. Paddle receives your billing details directly; your full card number never reaches Linkhiver.
  • RevenueCat, Inc., with Apple Inc. and Google LLC — subscriptions bought inside the mobile app. The store processes the payment and tells us only whether your subscription is active.
  • Resend, Plus Five Five, Inc. — delivery of transactional email: sign-in codes, password resets, verification codes and service notices.
  • Sentry, Functional Software, Inc. — error and performance monitoring, on its European region. Receives stack traces, request URLs and limited diagnostic metadata when something fails.
  • Google LLC — Google Analytics 4 on linkhiver.com and app.linkhiver.com, Google Ads, and Sign in with Google if you use it. Analytics runs in Google Consent Mode: until you accept analytics cookies it sets no cookies and sends only cookieless pings with no identifier, and it never runs on a published profile, business card or QR page. If you sign up after clicking one of our Google ads, we send Google Ads that ad's click ID and the time of your sign-up (and of your page's first ten visits) so we can tell which ads work — never your name, email or any other detail.
  • Microsoft Corporation — Microsoft Clarity: session recording and heatmaps. On linkhiver.com it runs only if you accept analytics cookies. On app.linkhiver.com it is on by default — across the signed-in product, the setup flow and the pricing page — until you reject cookies on the banner, open Cookie preferences in the footer of that pricing page, or switch it off under Settings → Security → Cookie preferences. Microsoft receives the screen as it is drawn for you, your clicks and scrolls, and a coarse location and device type derived from your connection; while you are signed in, your email address goes with it as the session's name. On app.linkhiver.com each recording is also labelled with the channel that brought you here (for example search, direct or a campaign name) and with the setup step you are on, so we can see where people get stuck. Other people's personal data is masked before it leaves your browser: your subscribers' email addresses, and the phone numbers and messages of visitors who use your enquiry form. It does not run on published profiles, business cards or QR pages.
  • Apple Inc. — Sign in with Apple, if you use it. We receive your name and the email address you choose to share.
  • DeepSeek, Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China — the AI Bio feature only, and only when you ask it to write a bio. We send your display name, username, current bio, your link titles with the websites they point to, and the names of your connected social networks. We send nothing else: no email address, no password, no visitor analytics and no payment data.
  • Meta Platforms, Inc. - two separate things. On linkhiver.com, the Meta pixel, and only if you accept cookies on the banner: it tells us a visit came from one of our ads and that the page loaded, and it sets an _fbp cookie. Separately, the Instagram auto-reply feature, and only if you connect an Instagram account, where we exchange the messages needed to send the replies you configured.
• Agent access (MCP). You can connect an AI agent — Claude or another MCP-compatible client — from Settings → Integrations. Once connected, it can read your profile, links, appearance, and analytics, and, only on a Pro plan, create, edit, reorder, and delete links and edit your profile and appearance. No subscriber or lead data is ever exposed to a connected agent, and it cannot change your username, view billing, or delete your account. We never store an agent's access token in plain text — only its HMAC-SHA256 hash, the same protection our API keys use — so a leaked database snapshot cannot be replayed as a working token. An access token is valid for one hour and renews automatically while the connection stays active; you can revoke the connection at any time from Settings → Integrations, and revocation takes effect immediately. Full setup and tool documentation is available on our agent access documentation page. Questions about this section can be sent to support@linkhiver.com.
• Legal requirements. If a court order, subpoena, or law enforcement request compels disclosure, we will comply while pushing back against overbroad requests. We will notify you unless legally prohibited.
• Business transfers. If Linkhiver is acquired or merged, your data may transfer to the successor entity — but the new entity will be bound by this policy or one no less protective.
• With your consent. Anything outside the above happens only with your explicit permission.

We keep your account information for as long as your account exists. When you delete your account from Settings → Danger zone, your profile, links, uploaded media, analytics events and product-usage records are removed from the live database immediately, by database cascade — there is no grace period, and we cannot restore them afterwards. Our database provider keeps encrypted daily backups for 7 days; once that window passes, no copy remains. Invoices and payment records held by our merchant of record are kept for as long as tax law requires, which is outside our control. Aggregated statistics that can no longer be linked to you or your visitors may be kept indefinitely.

We use TLS 1.2 or better for all traffic in transit, and our database provider encrypts data at rest with AES-256. Passwords are stored only as bcrypt hashes computed by our authentication provider — we never see or store the password itself. Access to production data is limited to the accounts that need it and protected by two-factor authentication. No system is perfectly secure, and we will notify affected users within 72 hours of confirming any breach that risks your rights.

We operate from Türkiye and run no servers of our own, so your data is processed by the providers listed in Section 5 and it does cross borders. Your account database is hosted in Tokyo, Japan. linkhiver.com and app.linkhiver.com are served from Vercel's and Cloudflare's global edge networks, so pages may be delivered from a location near you. Our other processors are located in the United States, the United Kingdom and the European Union, and — for the optional AI Bio feature only — in China. For users in the EEA, the UK or Switzerland, transfers are covered by the European Commission's Standard Contractual Clauses in our processors' data processing agreements; Japan holds a European Commission adequacy decision, so hosting the database there needs no separate safeguard. For users in Türkiye, transfers abroad are made on one of the grounds set out in Article 9 of the KVKK. You can request details of the safeguards that apply to a specific transfer at privacy@linkhiver.com.

Linkhiver is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, please email privacy@linkhiver.com and we will delete it.

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and the data associated with it.
• Export your profile content and link analytics as a portable file.
• Object to specific uses or restrict processing.
• Withdraw consent at any time, where consent is the legal basis.
• Lodge a complaint with a supervisory authority — in the EU, that is your national data protection authority.

To exercise any of these rights, email privacy@linkhiver.com. We respond within 30 days, often the same week.

For users in the EEA, the UK, or Switzerland, we process personal data under one of the following legal bases: contract (we need it to provide the Service you signed up for), legitimate interests (security, abuse prevention, product analytics — balanced against your rights), legal obligation (tax records, lawful requests), or consent (marketing emails, optional cookies).

Linkhiver does not sell personal information as the CCPA defines sale. California residents have the right to know what categories of personal information we collect, request access to or deletion of that information, and not be discriminated against for exercising those rights. To exercise these rights, email privacy@linkhiver.com.

If you are in Türkiye, Law No. 6698 on the Protection of Personal Data applies and Criccletech Bilişim Ltd. Şti. is the data controller. Article 11 gives you the right to learn whether your personal data is processed, to ask what has been done with it and to whom it has been transferred at home or abroad, to have incomplete or inaccurate data corrected, to have your data erased or destroyed, to object to a result reached solely through automated analysis, and to claim compensation for damage caused by unlawful processing. The full disclosure notice required by Article 10 — the categories of data, the purposes, the legal grounds under Articles 5 and 6, the recipients, and how to file a request — is published at linkhiver.com/tr/kvkk.

We may update this policy when we change products, providers, or the law changes. If a change is material — for example, a new category of data, a new processor, or a change in retention — we will notify you by email at least 14 days before it takes effect. The "Last updated" date at the top of this page always reflects the most recent revision.

Criccletech Bilişim Ltd. Şti., Istanbul, Türkiye. Questions, complaints and data requests: privacy@linkhiver.com. We answer within 30 days and usually much sooner. If you are in the EEA or the UK you may also complain to your national data protection authority; if you are in Türkiye, to the Personal Data Protection Authority.