Privacy Policy

SetLinks is operated by BA Solutions, LLC, Tacoma, Washington, United States ("we", "us"). This policy covers the website at www.setlinks.io, the dashboard at app.setlinks.io, short links at setlinks.io/{slug}, the SetLinks API and the SetLinks mobile apps.

For the account data of our customers and for visitors to our website, we are the controller under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP). For the click data of people who follow a customer's link, we are that customer's processor; § 2 explains the difference.

You can reach us about anything in this policy at support@setlinks.io.

People in the EU, the UK and Switzerland can contact us directly at the same address.

In this policy, the "Service" means SetLinks: the website, the dashboard, short links, the API and the mobile apps. A "Customer" is anyone with a SetLinks account, including every member of a Customer's team. A "Link visitor" is anyone who opens a SetLinks short link or scans a SetLinks QR code. A site visitor is anyone who reads our website.

Our role is different for each, and so is what we hold. No IP address is stored in the click records we keep for Customers: a Link visitor's IP address is used once, to look up a country, and is not copied into the record. It remains only in the CDN's raw log, for 30 days.

A Customer decides to create a link and to measure it; we count its clicks on the Customer's behalf and under their instructions. The Customer who made the link — in practice, the team that owns it — is the controller of Link visitor data, and our Data Processing Addendum governs how we handle it.

One exception: to deliver short links and keep them secure, our CDN writes a raw access log for each request. We are the controller of that log, on the basis of our legitimate interests (§ 4), and we keep it for 30 days. Everything we derive from it for the Customer's statistics, we process as the Customer's processor.

Customers

• Account. Your email address and name. You give us your name on the registration form, or it comes from your Google account, or from your Apple account in the mobile apps.
• Sign-in. Sign-in is handled by Google Firebase Authentication, which holds your email address, display name, your password if you set one, and your Google or Apple identity if you sign in that way. We never store your password.
• Teams. The team's name and logo, who belongs to it, and each member's role (owner, admin or member). A team logo is served publicly from cdn.setlinks.io, at an address derived from the image itself.
• Invitations. The invited email address, the role offered, who sent it, and when it expires (after 7 days) or was accepted. The invitation link's token is stored only as a hash. If a team invites you, we hold your email address before you have an account.
• Links. Each link's short name (slug), its label, its destination URLs, its status, its store-attribution settings, and any external ID you give it.
• API keys. Each key's name, its first characters, its scope, when it was last used and who created it. The key itself is stored only as a hash.
• Billing. Your team's plan, subscription status, Stripe customer and subscription identifiers, the end of the current period, and whether the subscription is set to cancel. If your team takes part in a promotional offer, such as the Founding member discount, we keep its place in the offer and its member number; and, for the person who owned the team when it took the place, a record that the owner of a team took the Founding member offer, so the same person cannot take a second place through another team. That record is kept after that team is deleted, and is removed when that person's account is deleted. We also record when a person dismissed the Founding member welcome message in a team, which is deleted with that team or with their account. Card details are entered on Stripe's own forms and stay with Stripe. When you open your billing settings, the dashboard fetches the card's brand, last four digits and expiry from Stripe to show you; your receipt email shows the last four digits.
• Support. The messages and attachments you send and receive in a support conversation, held in our Chatwoot support desk together with your name and email address. Our own database keeps only which conversation belongs to whom, when you last read it, and what we need to email you our replies: the language of your dashboard when you last wrote, and which replies we have already emailed you. When your team is a Founding member, the support desk also receives your team's Founding member number with each conversation, so that the request is marked as priority.
• Emails we send you. Six kinds, all transactional: password reset, email verification, team invitation, email-change confirmation, payment receipt, and our replies to your support conversations, emailed when a reply has gone unread for ten minutes. Stripe also emails you if a payment fails. We send no marketing email and no newsletter.
• Security records. To stop abuse of password reset and email verification, we count requests per IP address and per email address; each counter expires after one hour.
• Service logs and error reports. Our API logs each request's ID, method, path, status and duration, without your IP address or user agent. Errors are reported to Sentry (§ 6).

Link visitors

The service that answers a short link reads only the User-Agent and Accept-Language headers your browser sends, to decide where to send you. It sets no cookie and writes nothing. Our CDN (Amazon CloudFront) writes a standard access log line for each request: your IP address, user agent, referrer, the requested URL including any query string, the date and time, the edge location and a request ID.

From that log line, we derive one click record, containing:

• your country, looked up from your IP address in a database on our own servers;
• your device class, and whether the request looked like a bot, both worked out from the user agent;
• which of the link's destinations you were sent to;
• the referring website's host name only, or instead the tag in the address's ?s= parameter, if there is one;
• whether the click was a QR-code scan;
• the time, and the CDN's request ID.

The IP address and the user agent are not kept in the click record. Click records are also added up into daily totals per link, day, device class, country, referring host and destination. If the Customer turns on store attribution, the link adds a campaign tag naming the link to the app-store address; it adds nothing about you.

Site visitors

Our website at www.setlinks.io uses PostHog, from its EU cloud, to count how it is used: the pages you open, the page you came from, your browser, device type and screen size, the links and buttons you click, and your IP address, from which PostHog works out your approximate location (country and city). It loads no tag manager, no advertising script and no third-party font.

The website asks before it stores anything optional on your device. Until you choose Accept, and after you choose Decline, PostHog keeps no identifier between pages, so each page view is counted on its own and is not linked to you or to your other views. If you accept, a PostHog cookie keeps a random visitor identifier so that your visits are counted as yours, and the website remembers where your first visit came from — campaign tags, the referring site and the first page — and adds it to the sign-up link, so that a new account records how it found us. The Cookie and Storage Notice lists each item and how long it lasts, and Cookie settings at the foot of every page changes your answer.

The CDN serving the website, the dashboard and cdn.setlinks.io writes the same kind of access log described above, including your IP address, user agent and referrer, and our file storage writes its own access log. We do not analyse these logs; they exist to deliver and secure the Service.

In the dashboard

In the dashboard at app.setlinks.io we use PostHog, from its EU cloud, to understand how the product is used: the screens you open, the buttons and links you click, your browser, device type and screen size, and your IP address, from which PostHog works out your approximate location (country and city). These events carry your internal account ID and your team's ID and plan — never your name or email address.

PostHog and Sentry also record dashboard sessions. A recording shows the layout of the screens and where you move, click and scroll; all text, everything you type and every image are hidden in your browser, before the recording is sent, and the contents and headers of the dashboard's requests are never recorded. Secret codes in addresses — invitation links, password-reset and email-confirmation codes — are removed from every event and recording. PostHog uses recordings to see where the dashboard is hard to use, and Sentry to show what happened before an error.

None of this stores anything on your device: PostHog and Sentry keep their identifiers in memory only, so each page load starts a new session and a new recording (Cookie and Storage Notice). If you accepted our website's cookie, the sign-up link carries your website visitor identifier, so the visits you made before signing up are joined to your account.

Mobile apps

The mobile apps use the same account data as the dashboard, and add Sign in with Apple as a way to sign in. On iOS they ask only for permission to add images to your photo library, and on Android 10 and earlier for permission to write to storage, in both cases solely to save a QR code you choose to save. They keep your active team and your sign-in session on the device. They contain no advertising library and receive no push notifications. Errors in the apps are reported to Sentry.

While you are signed in, the apps send PostHog, from its EU cloud, the same kind of usage events as the dashboard — the screens you use and when the app is opened or closed — tagged with your internal account ID and your team's ID and plan, never your name or email address; PostHog works out your approximate location from your IP address. PostHog also records app sessions, and Sentry keeps a recording of the moments before an error, in both cases with all text and every image hidden on your device before a recording is sent. Nothing is sent to PostHog before you sign in, and signing out resets it. To keep its identifier and the events waiting to be sent, PostHog stores them in the app's own storage on your device, which is removed when you uninstall the app. You can object to this use (§ 8) by writing to us, and we will turn it off for your account.

People who report abuse

If you report a link under our Acceptable Use Policy or send us a copyright notice, we collect your name, your contact details and what your report says, on the basis of our legitimate interest in keeping the Service free of abuse and, for copyright notices, to meet our legal obligations. We keep it while the matter is open, and as long as needed to handle repeat infringement. A copyright notice, including your name and contact details, may be sent to the customer responsible for the link.

We use personal data only for the purposes below. Where the GDPR or UK GDPR applies, each rests on the legal basis shown.

Apart from the website cookie and first-touch record, we do not rely on consent, and we do not use personal data for advertising. Withdrawing consent does not affect what was done before. You can ask us for the balancing test behind any purpose that rests on legitimate interests, and you can object to it (§ 8). We rely on these interests only where the data involved is minimal and expected: no IP address enters our database, request counters expire after an hour and logs after 30 days, so we consider your rights are not overridden.

An email address and a way to sign in are required to create an account; without them we cannot provide the Service. We make no decision about anyone based solely on automated processing that has legal or similarly significant effects. The bot flag on a click record only labels the click in the Customer's statistics; it does not block anyone.

A few details the table cannot hold:

• Click records are removed on this schedule whether or not the Customer's account still exists.
• When you delete your account, any invitation still waiting for your email address is deleted at once. A deleted link can keep resolving from the CDN's cache for up to 10 minutes.
• The record that a person took a place in a promotional offer is kept while their account exists, including after the team it was taken through is deleted, and is deleted with the account.
• The copy of each link that answers redirects (its slug, label, destinations and status) is also covered by AWS point-in-time recovery, which keeps a restorable history for up to 35 days before it rolls off.
• The request counters described in § 3 expire after one hour. Our servers cache which teams you belong to for 45 seconds.
• The emails we send are kept by Resend, and your sign-in record by Google Firebase, under their own retention settings; your Firebase account is deleted as the last step of deleting your SetLinks account.
• If our support desk cannot be reached at the moment you delete your account, the failure is reported to us and the remaining support data is deleted by hand.

We use the service providers below to run SetLinks. Each receives only what the table shows, for the purpose shown. The full list, with what each receives and where, is on the Subprocessors page, which is where we announce any change.

Stripe also acts as an independent controller for the payment data it collects, for its own fraud-prevention and legal-compliance purposes, under its own privacy policy.

Country lookups use the DB-IP "IP to Country Lite" database, which we download into our own systems; nothing is sent to DB-IP. We credit it as its CC BY 4.0 licence requires.

Apart from these providers, and the members of your own team, who see your name, email address and role, we disclose personal data only where the law requires us to, for example in response to a valid legal order; where we believe in good faith that it is necessary to protect someone from serious harm; or where our Acceptable Use Policy's abuse and copyright procedures call for it, such as sending a copyright notice to the customer it concerns. The click data we process on a Customer's behalf is disclosed only on that Customer's instructions or where the law requires it, and requests for it are handled as § 11 of our Data Processing Addendum describes.

The Service's databases, file storage and logs are hosted by Amazon Web Services in the EU, in Stockholm, Sweden. Pages and short links are delivered through AWS's CDN from edge locations worldwide, close to whoever is requesting them. Sentry receives error reports in the EU, in Germany, and PostHog receives website, dashboard and app analytics in its EU cloud. Email you send to our @setlinks.io addresses is received through Amazon Web Services mail servers, separate from the Stockholm hosting described above.

We are a company in the United States, and Google Firebase, Stripe, Resend, Apple and PostHog are US providers, so personal data is transferred to the United States. Our staff and contractors may access the Service's data from outside the European Economic Area, the United Kingdom and Switzerland. Where the GDPR, the UK GDPR or Swiss law requires a safeguard for such a transfer, we rely on the Standard Contractual Clauses approved by the European Commission, with the UK International Data Transfer Addendum and the amendments Swiss law requires. For the click data we process on Customers' behalf, our Data Processing Addendum incorporates these clauses. You can ask for a copy of the safeguards that apply at support@setlinks.io.

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to receive it in a portable format, to object to processing based on our legitimate interests, and to have processing restricted.

How to use them

• In the dashboard. Under Settings you can correct your name, change your email address and Delete account. Deleting your account deletes every team you own alone, with its links and their daily click totals, its invitations, its API keys and its subscription; it removes you from other teams; then it deletes your account itself. If you own a team that still has other members, we refuse deletion until you transfer or delete that team; the dashboard names the teams concerned.
• By email. Everything else, including a copy of your data, goes to support@setlinks.io. We answer within 30 days of receiving your request. We may ask you to write from the email address on your account, or otherwise confirm it is you, before acting.

Link visitors

The Customer who made the link is the controller of your click data, so please direct requests to them. If you send a request to us, we forward it to that Customer. For the raw CDN log, write to us directly. Click records hold no IP address. For 30 days a click record can still be matched to the CDN log line it came from; after that, we cannot tell which click records are yours.

Complaints

If you think we have handled your data unlawfully, you can complain to a data protection supervisory authority, in particular the one in the EU country where you live or work, or, in the UK, the Information Commissioner's Office, or, in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to put it right first.

This section adds what the privacy laws of California and other US states ask us to say. Where it applies to you, it applies together with the rest of this policy.

We collect this from you, from your team members when they invite you, from your browser or device, from Google or Apple when you sign in with them, and from Stripe for billing. We use it for the purposes in § 4, keep it for the periods in § 5, and disclose it for those purposes only to the providers in § 6, within a team to that team's members, and where the law requires (§ 6).

We do not sell or share personal information, as those words are defined in the California Consumer Privacy Act, and have not done so in the past twelve months. We do not use personal information for targeted advertising, and we do not profile anyone in furtherance of decisions that produce legal or similarly significant effects. We use sensitive personal information only to sign you in, and never to infer characteristics about you. Because there is no sale or sharing, there is nothing for an opt-out or a Global Privacy Control signal to switch off; if your browser sends one, we treat it as an opt-out request all the same.

You may ask to know, access, correct or delete your personal information, and to receive it in a portable format, as described in § 8. We will not treat you differently for using these rights. An authorised agent may make a request for you with your signed permission; we may ask you to confirm it. If we decline a request, you can appeal by replying to our answer or by writing to support@setlinks.io with "Appeal" in the subject line, and we will answer the appeal in writing within the time your state's law allows.

We protect personal data with measures that include:

• encryption in transit: our CDN accepts TLS 1.2 or higher only and redirects plain HTTP to HTTPS, and our servers reach the database and cache over TLS;
• encryption at rest for the database and file storage; the store that answers redirects uses AWS's default encryption;
• a private network: the database is not reachable from the internet, and our application servers on AWS have no public IP address;
• API keys and invitation tokens stored only as SHA-256 hashes; passwords handled by Google Firebase and never stored by us;
• a verified email address required before an account can be used, and sign-in tokens checked for revocation on every signed-in request;
• signature checks on the payment and support-desk notifications our servers receive;
• limits on password reset, verification, card and upload attempts, and on API requests;
• secrets kept in AWS Secrets Manager;
• access to customer data limited to the people who need it to run the Service; our internal staff tool requires an individual grant at one of three levels, and payment transactions are visible only above the lowest level.

No system is perfectly secure, and we do not claim that ours is. If a breach affects your personal data, we will notify you and the authorities where the law requires it.

The Service is not directed at anyone under 16, and our Terms of Service require account holders to be at least 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@setlinks.io and we will delete it.

If we make a material change to this policy, we will tell Customers by email and announce it on our legal page at least 30 days before it takes effect. Other changes take effect when published here with a new version and effective date. Every version is recorded in the change log.

BA Solutions, LLC
Tacoma, Washington, United States
support@setlinks.io