Your information,
clearly explained.

We collect information in the following ways:

• Account and billing information. Your name, email address, profile image, authentication and session information, IP address, device information, and subscription details. Payments are processed by Polar. We receive billing and transaction status, but not your full payment card number.
• Content you provide. Page names and slugs, links, text, settings, images, and other content you upload, save, or publish through Linkdrop.
• Connected store information. If you connect a Shopify store, we receive the store identity and authorization, connection status, and product catalog information needed to synchronize products and provide the integration. Linkdrop does not request or store Shopify customer or order data.
• Instagram information. If you use Linkdrop Flows, or message or comment on an Instagram account that uses it, we receive information from Instagram as described in Linkdrop Flows and Instagram data.
• Usage and public-page activity. Page views, clicks and other interactions, page paths, referring pages, browser and device information, and approximate country, region, and city derived from request information. We may use cookies or similar browser storage for authentication, security, analytics, and advertising on selected Linkdrop screens.
• Communications. Information you include when you contact us for support, make a privacy request, submit a Plus priority request, or otherwise communicate with us. Priority requests also include the relevant page and basic browser information so our team can investigate and respond.

We use information to:

• Provide, operate, maintain, and improve Linkdrop.
• Create accounts, authenticate users, and keep accounts secure.
• Save, publish, deliver, and manage Linkdrop pages and uploaded media.
• Run the Instagram automations and inbox that businesses set up in Linkdrop Flows, as described in Linkdrop Flows and Instagram data.
• Process subscriptions and keep billing access in sync.
• Provide page owners with aggregate analytics about views and interactions.
• Measure campaign performance and personalize advertising for Linkdrop.
• Send essential account messages and, for eligible accounts, optional weekly analytics summaries that can be disabled at any time.
• Prevent fraud, abuse, security incidents, and violations of our terms.
• Review and respond to support, feedback, and Plus priority requests.

Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and protecting Linkdrop, your consent, or compliance with law.

We share information with providers that support hosting, cloud storage, databases, content delivery, payments, security, and website functionality. Our primary providers include Amazon Web Services for infrastructure, PlanetScale for databases, Polar for subscription billing, Shopify for connected-store catalog and checkout functionality, Resend for application email delivery, and, for Linkdrop Flows, third-party AI service providers that interpret message replies on our behalf.

We use Google Analytics on selected Linkdrop marketing, authentication, editor, and account screens to understand visits, navigation, successful signups, and checkout starts, and report eligible confirmed Linkdrop subscription payments from our server. Payment reporting includes the plan, amount, currency, and transaction identifier, linked to a browser analytics identifier when available; it does not include payment-card details or billing addresses. Google may process browser and device information, approximate location, campaign information, and pseudonymous identifiers stored in cookies. We do not install this tracking on customer public pages or editor preview frames, or send customer page content, account email addresses, or password-reset tokens through it. We enable Google advertising measurement and personalization on these selected Linkdrop screens, allowing this information to be used to measure campaign results and personalize advertising. Learn more about how Google uses information from sites that use its services.

Content you publish is public and can be viewed, copied, or shared by anyone. When you link to a third-party website or service, that third party’s privacy practices apply.

We may also disclose information when required by law, to protect the rights and safety of Linkdrop or others, or as part of a merger, financing, acquisition, or sale of all or part of our business. We will require a successor to handle personal information consistently with this policy.

Linkdrop Flows lets a business or creator connect an Instagram professional account, automate replies to comments and messages, and manage those conversations in an inbox. This section explains how we handle the information we receive from Instagram, which is operated by Meta, both for the business that connects its account and for the people who interact with that account.

Information we receive from Instagram

• From the connected account. The account's Instagram ID, username, and profile details; the permissions the business grants; an access token, which we store encrypted; and, when the business chooses posts or Reels for a flow, their captions, media, links, and publish times.
• From people who interact with that account. Their Instagram-scoped ID, name, username, and profile picture; the comments, Live comments, Story replies, Story mentions, and direct messages they send to the account, including attachments; edits, deletions, and reactions to those messages; and, when a flow checks it, whether they follow the account at that moment.
• Information shared in a conversation. Answers people give in a flow, such as an email address, phone number, a photo, or other details the business asks for, and the notes, tags, and fields the business adds in its inbox. For photos, we store a link to the image Instagram provides rather than copying the image.

How we use it

• Only to provide Linkdrop Flows to the business that connected the account: to recognize the comments and messages its flows respond to, send the replies and follow-ups it set up, show conversations in its inbox so it can reply personally, email resources people ask for, notify the business, report how its flows perform, and count the people its flows reach each month for plan limits.
• Automated interpretation. To understand a reply, we send its text, a limited window of recent messages from that conversation, and the business's question setup to third-party AI service providers that process it on our behalf. They identify which of the business's answers the reply matches and extract details such as a date or size, and we use the result only to continue that conversation. AI only interprets replies; every message Linkdrop sends is written by the business.
• We do not sell Instagram data, use it for advertising, use it to build profiles across businesses, or share one business's Instagram data with another business. Replies are sent through Instagram, and the connected business can view and export its own conversations and contacts.

How long we keep it

• The raw notifications Instagram sends us about comments and messages are deleted after 90 days.
• Conversations, contacts, answers, and flow history are kept while the business's Linkdrop account exists so it can review and export them. Disconnecting an account stops our access and all automation immediately, but keeps this history until the business deletes it, deletes its Linkdrop account, or a deletion request is made.
• Files a business uploads for its flows are kept until it deletes them or its Linkdrop account.

How to delete Instagram data

• If you connected an account. Disconnect it in Linkdrop Flows under Settings → Channels. You can also remove Linkdrop from the apps connected to your Instagram account in Instagram's settings, which tells us to revoke our access. If you ask Instagram to delete the data Linkdrop received, we delete that account's conversations, contacts, and related records and give you a confirmation code and a page to check the request's status. Deleting your Linkdrop account deletes all of your Flows data.
• If you messaged a business that uses Linkdrop. Reply STOP to stop its automated messages. To have your information deleted, ask that business, or email us at privacy@mail.linkdrop.bio and we will verify the request and delete it or work with the business to do so.

We keep account information and page content while your account and pages remain active. Raw public-page analytics events and aggregate counts are retained without a fixed time-based expiry so page owners can understand performance over time. Analytics remain subject to page and account deletion.

Unfinished image uploads generally expire after 24 hours, and uploaded images that are no longer referenced generally expire after 7 days. When paid access ends, page data may be scheduled for deletion after a 30-day recovery period. Billing, security, legal, and backup records may be kept longer where reasonably necessary or required by law.

After Shopify requires store-data erasure, we delete the store connection, credentials, product catalog snapshots, and related integration data.

Instagram data from Linkdrop Flows follows the periods in Linkdrop Flows and Instagram data, including deletion of raw Instagram notifications after 90 days.

Priority requests and their response status are kept while reasonably needed to respond, improve Linkdrop, maintain support history, and resolve disputes. They are removed with the associated account unless a longer period is required for legal or security reasons.

Previously collected product analytics, sampled session recordings, and browser error reports remain subject to the retention settings applied to our former analytics provider. Linkdrop no longer sends new data to that provider. Public-page analytics provided to page owners continue through Linkdrop's own analytics system.

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of your personal information. You may also have the right to object to or restrict certain processing, withdraw consent, or complain to your local privacy regulator.

You can update much of your page information directly through Linkdrop. For other requests, email privacy@mail.linkdrop.bio. For Instagram data from Linkdrop Flows, see how to delete Instagram data. We may need to verify your identity before completing a request. You can also control or delete cookies and browser storage through your browser settings, although disabling essential storage may affect account features. Weekly analytics summaries can be disabled from your account or through the unsubscribe link in any summary without affecting essential account emails. Google Analytics collection on Linkdrop screens honors browser Do Not Track where supported.

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No internet service can guarantee absolute security, so we cannot promise that information will never be accessed, used, or disclosed improperly.

Linkdrop and its providers may process information in countries other than your own, including the United States. Where required, we use appropriate safeguards for these transfers. Linkdrop is not directed to children under 13, and we do not knowingly collect personal information from them.

To report a suspected security vulnerability, email security@mail.linkdrop.bio.