Privacy Policy

The data controller is KREATIVE MONSTER GLOBAL (KMG), publisher of Lynks.Pro.

• Address: 99 avenue Achille Peretti, 92200 Neuilly-sur-Seine, France
• Privacy contact: global@kreativemonster.com

We limit collection to what is strictly necessary to run the service:

• Account: your email address (login identifier) and the information you choose to add to your page (display name, avatar, links, block content).
• Visit statistics: views, clicks, referring origin without path or query parameters, country, device and browser categories. Visit counts remain available without a persistent identifier. Unique and returning visitor statistics use an optional cookie specific to the page, after agreement; they are not a count of people. On the marketing site, creation, demonstration and offer buttons are counted by page category, action and language, without a visitor identifier, IP address or raw destination. After agreement to optional measurement, one visible dashboard opening per account and UTC day helps observe day-7/day-30 returns. These account observations can be exported and are deleted with the account.
• Cookies: session, security and language support essential functions. After email confirmation, a personal resource access cookie lasts 30 days on this device. This request does not subscribe you to marketing. Signature logos and portraits use public Lynks URLs accessible to recipients; only optimised images without metadata are retained. Privacy choices last six months. After agreement, an identifier specific to the page may last 90 days and an A/B variant 30 days, without outlasting your agreement. The former shared identifier is no longer used. Site referral categories may be kept for 24 hours only after agreement to optional measurement. Creator-configured Google/Meta pixels are blocked before agreement. Embedded video, music and maps load after an explicit click or your choice to allow them.
• Technical data: server logs (IP address, timestamp) kept for security and abuse prevention. When a form is submitted from a page (contact, booking, list signup), we also keep a technical record of that submission: IP address, precise date and time, browser and system, approximate location derived from the address, and a copy of the content sent. This record exists solely to establish proof of abuse, threats or harassment, and to defend ourselves in court. It is never shared with the page owner, and never used for commercial purposes.

To improve the getting-started experience, we retain observed creation steps and error categories linked to your account identifier. These measurements do not contain page content, entered links or IP addresses. Records older than 90 days are removed by the daily purge and are deleted with your account. Administrators view aggregated results. No additional tracker is stored for this measurement.

With your agreement, Lynks measures main content loading (LCP), responsiveness (INP) and visual stability (CLS) on its marketing pages. We retain the first reported value of each metric per document, with the route template, mobile or desktop category and language. Private pages and creator pages are excluded. No visitor identifier, entered content or URL parameters are stored in these measurements. They remain internal to Lynks and are removed after 90 days by the daily purge. A separate technical abuse counter uses a daily fingerprint of the IP address. You can refuse or withdraw your agreement through privacy choices.

In Account, you can allow measurement of the days you visibly open the dashboard home. This setting is disabled by default and your choice applies to your account across all your devices. We retain at most one observation per UTC day linked to your existing account identifier, together with the date of your current agreement. No page content, entered links, IP address or additional tracking identifier is recorded. Administrators view aggregated results; day-7 and day-30 returns are calculated only for accounts actually observed on their sign-up day whose target day has ended. Administrator, demo and inactive accounts are excluded. Observations older than 90 days are removed by the daily purge. You can withdraw your agreement in Account: measurement stops across your devices and retained usage observations for your account are deleted together. This setting is separate from the marketing site’s privacy choices and from marketing communications; it does not reconstruct past activity.

We count page views on our own site (home, pricing, tools, guides, creation, sign-up). For each view we keep a page template such as “/tarifs” or “/guides/*”, the referral source reduced to a single word such as “search” or “social network”, the device, the country and the language. We keep no IP address, no visitor identifier, no exact referring address and no full path: this measurement counts visits, it does not follow anyone and cannot recognise you from one page to the next. No additional tracker is stored, and pages published by creators are excluded from this count.

Each processing activity has a specific purpose and a legal basis within the meaning of the GDPR:

• Provide the service (account creation, publishing your page): performance of the contract.
• Aggregated audience measurement visit counts without persistent identifiers help monitor service use. Optional identifiers, performance measurement, referral categories, product returns and pixels require prior agreement, withdrawable through the Privacy button. Creators configure tracking for their own page.
• Security and abuse prevention (logs, fraud prevention): legitimate interest and legal obligation.
• Communications (account-related emails, notifications): performance of the contract; for non-essential messages, your consent, revocable at any time.

The technical AI request log keeps only an identifier, the model, the account served and reserved or confirmed quantities, without prompts or responses. Entries older than 180 days are removed by the daily purge.

Technical records of form submissions (bounded content, IP address and connection headers) are removed after 30 days by the daily purge. An administrator may retain a record for an abuse case with an explicit reason, up to 90 days after submission, with no renewal beyond that limit. Annotations follow the same deadline. The IP reputation cache expires after 30 days. These records are restricted to administrators and are not sent to creators.

• Account and content: kept for as long as your account is active. When the account is deleted, your personal data is erased within a reasonable period.
• Inactive accounts: under the data minimization principle, an account left inactive for three months may be deleted after a warning sent by email. Simply logging back in before the stated deadline cancels this deletion.
• Aggregated statistics: kept in aggregated form for audience tracking. Marketing-site click events, technical link-email outcomes and optional product openings are purged daily after 90 days. Email outcomes contain neither an email address nor a token.
• Technical logs: form submission records are kept for 30 days, or at most 90 days for a reasoned abuse case. The daily purge removes expired records and their annotations. The application role cannot rewrite a record or remove a record still within its retention period.
• Legal obligations: some data may be kept for longer when required by law (for example, invoicing).

In accordance with the GDPR, you have the following rights over your data:

• Access: find out what data concerning you is processed.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data.
• Portability: retrieve your data in a reusable format.
• Objection and restriction: object to a processing activity or request that it be restricted.
• Withdrawal of consent: withdraw your consent at any time, for the processing activities that depend on it.

Most of these actions are available directly from your account: your data is exportable and deletable from your dashboard, with no extra steps. For any other request, write to global@kreativemonster.com. You can also file a complaint with the CNIL, the French data protection authority (cnil.fr).

The services below are involved according to the function used. The primary Supabase database is in Paris; this does not mean that all operations by every provider remain in the European Union. Depending on the service, data may be processed outside the European Economic Area. Provider contractual and privacy resources are linked below. Payments and some external services may also involve their own purposes. No data is sold.

For a PayPal purchase, also review PayPal’s policy. Pixels are configured by the page creator, who must inform visitors about their own uses. PayPal.

Pages are served over HTTPS and encrypted in transit. We apply reasonable technical and organizational measures to protect your data against loss, unauthorized access, or disclosure.