Privacy Policy

1. Information We Collect

1.1 Your account

• Your name, email address and password. We store only a hash of the password, never the password itself.
• If you sign in with Google: the name, email address and profile photo Google shares with us.
• What you choose to add: a profile photo, your workspace name, your answers to the onboarding questions, your language, and two-factor authentication settings.
• Email addresses of the people you invite to your workspace.
• API keys you create, and the connections you set up, such as a Meta pixel ID and the access tokens needed to send events to Meta on your behalf.
• Messages you send us through support tickets or email.

1.2 Your content

The links you shorten and their destination URLs, titles, collections, QR codes, bio pages, and the images and files you upload.

1.3 Billing

Payments are handled by Paddle, our merchant of record. Paddle collects your payment details; we never see or store your full card number. Paddle tells us your plan, subscription status, billing period, invoices, and the brand and last four digits of the card on file.

1.4 Activity and security logs

When someone creates, edits or deletes something in a workspace, we record what changed, who changed it and when. When someone signs in, we record the time and their IP address, country, device and browser. This helps workspace owners see who changed what, and helps us investigate abuse and security problems.

1.5 People who click short links or visit bio pages

Each time someone opens a HikrLink short link, a smart link or a bio page, or clicks a link on a bio page, we record:

• The visitor's IP address. It is pseudonymised 30 days after collection (see section 7).
• The country, worked out from the IP address. We do not record the city or any finer location.
• The browser's user agent string, and the device type and browser we read from it
• The referring page, when the browser sends one
• Campaign parameters on the link that was opened (utm_source, utm_medium, utm_campaign, utm_term and utm_content)
• The date and time
• A click identifier, hkclid, generated for that visit

When a short link forwards a visitor, we add the hkclid to the destination URL as a query parameter. The destination website therefore receives it, and the link owner can use it to match a later sign-up or sale back to the click. It is a random value; it does not contain the visitor's IP address or any other detail.

Smart links also read the visitor's browser language and device at the moment of the click to choose a destination. The language is used for that choice and not stored.

1.6 Visitors to hikrlink.com

The website measures visits with Hikr, our own measurement tool, which runs without cookies or any other storage on your device. With your consent, it also measures visits with Google Analytics. If you use the contact form, we receive your name, email address, subject and message; the waitlist form takes only your email address. Section 4 and our Cookie Policy explain the details.

2. How We Use It

• To provide the Service: shortening and forwarding links, routing smart links, serving bio pages and QR codes, and showing link owners the analytics described in 1.5
• To check destinations against our list of known malicious and suspicious sites, and to detect and stop fraud, spam and abuse
• To classify the topic of the web pages your links point to, using Google's Gemini API. Only the destination URL and that page's public content are sent, never visitor data.
• To run your subscription and billing through Paddle
• To send the emails described in section 3
• To answer support requests
• To keep the Service secure and to meet legal obligations

Where data protection law requires a legal basis, we rely on: performing our contract with you (running your account and the Service); our legitimate interests in keeping the Service secure, preventing abuse and telling you about your account and plan; your consent for the Meta Pixel and Google Analytics, which you can withdraw at any time; and legal obligations, such as keeping billing records. For visitor data under 1.5, the link or page owner decides the legal basis.

3. Emails

We send account and service emails: verification codes, password resets, workspace invitations, security notices, billing notices, and replies to your support requests.

We also send a small number of reminders:

• During a free trial, reminders 5, 3 and 1 day before it ends
• On your first day, one reminder if you have not created a link yet
• When a subscription ends, a notice that your account has moved to the free Starter plan, then reminders to reactivate 14 and 30 days later

Every email we send includes an unsubscribe link, and mail apps that support one-click unsubscribe show that option too. You can also email privacy@hikrlink.com to stop reminders.

4. Cookies, Pixels and Similar Technologies

The full list, with names and durations, is in our Cookie Policy. In short:

In the HikrLink dashboard

We use first-party cookies to keep you signed in and to remember your language. HikrLink's own Meta Pixel measures sign-ups, checkouts and purchases so we can tell which of our adverts work. It loads only after you accept it in the consent prompt; if you decline, it does not load. Your choice is stored in the hk_consent cookie for 180 days. To change it, clear that cookie in your browser and the prompt appears again, or email us. Once loaded, the pixel sends Meta your IP address, browser details and the event, and Meta may set its own cookies.

On bio pages

A bio page can use a Meta Pixel: the page owner's, or HikrLink's own when the owner has not added one. No pixel loads on a bio page until the visitor accepts it in the consent prompt.

On short links

HikrLink's own pixel never fires on a short link. If a link owner has added their own Meta Pixel, it fires when their link is opened, either in the visitor's browser or from our servers through Meta's Conversions API. In the server-side case we send Meta the visitor's IP address, user agent, referrer and any Meta click identifiers, on the owner's instruction. The link owner is responsible for telling their visitors and for obtaining any consent this requires.

On hikrlink.com

• Hikr, our own measurement tool, counts page views and clicks through to the app without cookies or device storage. If you reached the website through a link carrying an hkclid, links from the website to the dashboard pass it on, so we can tell which campaign led to a sign-up.
• Google Analytics runs only after you accept it in the consent banner. It does not load any Google script: the page sends page-view events to an address on our own domain, which forwards them to Google Analytics. Accepting stores a random visitor identifier in your browser's local storage. Declining stops all of it.
• Google Fonts: the website and the dashboard load their typefaces from Google's font servers, so Google receives your IP address and browser details when a page loads. Google Fonts does not set cookies.

5. Ad Page on Free Links

Links owned by accounts on the free Starter plan may show a short ad page before forwarding the visitor. Links on paid plans go straight to their destination. The ads are placed by us directly, not through an ad network. Showing one does not use advertising cookies or share visitor data with the advertiser. When a visitor clicks an ad we count the click, and that count holds no details about the visitor.

6. Who We Share Data With

We do not sell, rent or trade personal data. We share it only with the service providers below, who process it for us under contract, and with the parties you choose to connect.

Services you connect. If you connect an AI assistant such as Claude or ChatGPT to your account, or connect Meta, the data you authorise is sent to that service under its own terms.

Legal requirements. We may disclose data if required by law, regulation or valid legal process.

7. How Long We Keep Data

• Your account: for as long as the account is open. You can delete your account in Settings. It closes immediately, and 30 days later we permanently erase it, including its links, bio pages, analytics and uploaded files.
• Billing records: kept after an account is erased, for as long as tax and accounting law requires, with your name and contact details removed.
• Visitor data (section 1.5): kept for as long as the link or bio page and its owner's account exist. We do not currently delete it after a fixed period. Deleting a link deletes its click history.
• IP addresses: every night, stored IP addresses older than 30 days are replaced with a keyed hash (HMAC-SHA-256 with a secret key that is not stored in the database). After that we can still count unique visitors, but the address can no longer be read. This applies to visitor data and to the activity log. A hashed address is pseudonymised, not anonymous: the same address always produces the same value.
• Activity and security logs: for the life of the workspace.
• Links created on hikrlink.com without an account: expire after 7 days and are deleted, with their clicks, a day later unless you claim them.
• Server request logs: kept by our hosting provider for a limited period, 30 days by default.

8. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have your data deleted
• Receive your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, where we rely on it

You can edit your profile and delete your account yourself in Settings. For anything else, email privacy@hikrlink.com. We respond within 30 days. If you clicked someone else's link or visited their bio page, contact them first; we will help them respond. You also have the right to complain to your data protection authority, which in Mauritius is the Data Protection Office.

9. Security

Data is encrypted in transit (TLS) and at rest by our hosting provider. Passwords are stored only as hashes, two-factor authentication is available on every account, and access to production systems is restricted. No method of transmission or storage is 100% secure, but we work to protect your data and will notify you and the relevant authorities of a breach where the law requires it.

10. International Data Transfers

Our servers are in Singapore, and some of the providers in section 6 process data in the United States, the European Union and the United Kingdom. Your data may therefore be processed outside your country. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses for these transfers.

11. Children's Privacy

HikrLink is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@hikrlink.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The “Effective Date” at the top shows when the policy was last revised.

13. Contact

For privacy questions and requests:

Bouletteproof Ltd
East Wing, First Floor, Lifestyle Boulevard, Sottise Road, Grand Baie, Mauritius
privacy@hikrlink.com

Customers who need a data processing agreement can request one at the same address.