Privacy Policy
Last updated: July 19, 2026
1. About this Policy
This Privacy Policy explains what personal data Onlink (“Onlink”, “we”, “us”) collects, why we collect it, and what your rights are. It covers on.link, dash.on.link, app.on.link, and every related service, whether you are a creator, a buyer, or a visitor.
Onlink is the controller of the personal data described here. We are based in Portugal and operate under the EU General Data Protection Regulation (GDPR). If anything in this policy is unclear, write to us at [email protected].
2. What We Collect
Account data. When you create a creator account, we collect your name, email address, and a password — stored only as a modern cryptographic hash, never in plain text. If you sign in with Google, we receive your name and email from your Google account instead.
Creator content. Everything you add to your page — text, links, images, video, audio, products, prices — is collected and stored so we can host and display it. Your page content is public by design.
Purchase data. When you buy from a creator, we receive your name and email from the payment flow, plus the product, amount, and date of each purchase, so we can provision your access and show creators their sales. We never see or store your card number: payments are processed entirely by Stripe.
Billing data. For paid creator accounts we keep your plan, billing status, and invoices through Stripe, our payment provider.
Technical data. Our servers retain short-lived logs (IP address, browser type, timestamps) strictly for security, abuse prevention, and keeping the service running.
3. What We Do Not Collect
Public Onlink pages are served without cookies and without third-party trackers: visiting a creator’s page does not create an advertising profile of you, and we run no third-party analytics scripts on it. We do not collect phone numbers at checkout, we do not buy data about you from data brokers, and we do not use your content or data to train AI models.
4. How We Use Your Data
We use personal data to: provide the service you signed up for — hosting your page, processing sales, provisioning buyer access, sending transactional email such as sign-in verification and purchase receipts (legal basis: performance of a contract); keep Onlink secure — preventing fraud, abuse, and unauthorized access (legal basis: our legitimate interest in running a safe platform); and meet legal obligations — accounting, tax, and responding to lawful requests (legal basis: legal obligation).
We do not use your data for third-party advertising, and we will not send you marketing email without your consent.
5. Public by Design
An Onlink page is a public website. Whatever a creator publishes on their page — including their name, photo, bio, social links, and products — is visible to anyone with the link and may be indexed by search engines. Do not publish anything on your page that you want to keep private.
6. What Creators See About Buyers
When you buy from, book with, or donate to a creator, that creator receives your name, email address, and the details of the transaction (product, amount, date). This is necessary to deliver what you bought and is part of the sale: the creator is the seller of record.
Creators must handle buyer data lawfully — using it to deliver the purchase and provide support, not for unrelated marketing without your consent. Misusing buyer data is a violation of our Terms & Conditions.
7. Who Processes Data for Us
We share personal data only with the service providers that make Onlink work, under contracts that bind them to protect it: Stripe (payments and billing), Google (optional sign-in and our business email), Resend (transactional email delivery), and Cloudflare (content delivery, DNS, and media storage). Our application servers are hosted in the European Union.
Beyond these processors, we disclose personal data only when the law requires it, or to protect Onlink or its users from fraud or abuse, or as part of a corporate transaction such as a merger — in which case this policy continues to apply.
8. International Transfers
Some of our processors are based in the United States. Where personal data leaves the European Economic Area, it is protected by recognized safeguards — the EU–US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.
9. How Long We Keep Data
Account and content data are kept while your account exists. When you delete your account, deletion is scheduled with a grace window in which you can change your mind; once that window ends, your data is permanently removed from our systems, and backups rotate out shortly after.
Buyer access accounts follow the same pattern with a thirty-day grace window. Transaction records are kept for as long as tax and accounting law requires, and security logs are kept only briefly.
10. Your Rights
Under the GDPR you can ask us to: access the personal data we hold about you; correct it; delete it; hand it over in a portable format; restrict how we process it. You can also object to our processing, and withdraw consent at any time where processing is based on consent.
To exercise any of these rights, email [email protected] — we will respond within a month. You also have the right to complain to a supervisory authority: in Portugal, the CNPD (Comissão Nacional de Proteção de Dados), or the data protection authority of the country where you live.
12. Security
All traffic to Onlink is encrypted in transit. Passwords are stored with a modern, memory-hard hashing algorithm, accounts have a single active session at a time, and access to production data is restricted. No online service can promise perfect security, but if a breach ever affects your personal data we will notify you and the authorities as the law requires.
13. Children
Onlink accounts are for adults: you must be at least 18 to create one. We do not knowingly collect personal data from children; if you believe a child has provided us with data, contact us and we will delete it.
14. Changes to this Policy
When we make a material change to this policy, we will tell you — by email or with a notice in the product — before the change takes effect. The date at the top always shows the latest revision.
15. Contact
Privacy questions and data requests: [email protected]. General help: [email protected]. Postal contact details are available on request.