Privacy Policy

Last updated: 1 October 2026

This policy explains what personal data xlink.plus collects, why, and your rights. We are the data controller for the service at xlink.plus.

Account holders

When you sign up, we store your email address, username and a securely hashed password. We also store everything you put on your page: display name, bio, photo, links, social profiles and theme. We use this to run your account and show your page. If you subscribe to Pro, Stripe processes your payment. We never see or store your full card details. We keep your Stripe customer ID and subscription status.

Lawful basis: to perform our contract with you, and our legitimate interest in keeping the service secure (for example, rate-limiting logins).

Visitors to xlink.plus pages

When someone views a page or clicks a link, we record the time, the referring website (just the domain), a country worked out from the IP address, and the device type (mobile, tablet or desktop). We do not store IP addresses. To avoid counting the same visitor twice, we use a one-way hash of the IP address and browser that changes every day, so visitors can’t be tracked from one day to the next. Public pages set no cookies.

Lawful basis: our legitimate interest, and the page owner’s, in understanding how pages are used.

Cookies

We only use essential cookies, for signed-in users: a session cookie and a “remember me” cookie that keeps you logged in for up to 90 days. There are no advertising or third-party tracking cookies.

Who we share data with

• Stripe, for payments (Pro subscribers only)
• Our hosting provider, which runs our UK/EU servers
• Google Fonts, which loads the typefaces on pages, so your browser contacts Google’s font servers

We never sell personal data.

How long we keep it

We keep account data while your account exists, and delete it as soon as you delete your account. Analytics events are deleted along with the account. Login-attempt records used for security are kept for up to 2 days.

Your rights

Under UK GDPR, you can ask to access, correct, delete, restrict or port your data, and you can object to how we process it. You can edit or delete most data yourself in your dashboard. For anything else, email [email protected]. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Children

xlink.plus is not meant for children under 13.

Changes

If we make an important change to this policy, we’ll tell account holders by email or in the dashboard.