1. Who is responsible for your data
MyLinkz (mylinkz.cc) is run by Dragon Corp, Box 55991, 10216 Stockholm, Sweden. Dragon Corp is the controller of the personal data described here. Questions about your data: legal@mylinkz.cc.
This policy explains what we collect, why, how long we keep it and what rights you have. It covers people with a MyLinkz account and visitors to pages on MyLinkz.
2. What we collect and why
- Your account: e-mail address, password (stored only as a secure hash), usernames, account settings and the time zone of your browser. Why: to create and run your account. Legal basis: contract.
- Your page: everything you add, such as title, bio, profile picture, links, texts, images, videos, colors and design. This is public on your page. Why: to show your page. Legal basis: contract.
- Logins: time, device type, browser, and the approximate place (city and country) and network name worked out from your IP address. We keep your last 20 logins so you can check them under Settings. Why: security of your account. Legal basis: legitimate interest (keeping accounts safe).
- Security log: failed logins, blocked IP addresses, logins from new countries and other limits that kick in, with IP address and country. Kept for up to 180 days (username checks 7 days). Why: to stop attacks, spam and misuse. Legal basis: legitimate interest.
- Page statistics: when someone visits a page or clicks a link we store the time, the country and where the visit came from (for example Instagram). We don't store the visitor's IP address or create visitor profiles. The page owner sees these numbers in Analytics. Why: to give page owners statistics and to spot unusual traffic. Legal basis: legitimate interest.
- Poll votes: if you vote in a poll on a page, we store your answer, the time, a random code for your device (the ml_dev cookie) and a code made from your network address. Both codes are stored scrambled (hashed), so they can't be turned back into your IP address. They are only used so each device votes once and to stop vote spam. The page owner only sees the totals. Votes are kept until the poll is reset or deleted. Legal basis: legitimate interest.
- "Contact me" messages: if you send a message with a page's contact form, we store your name, e-mail address, message and IP address and pass the message to the page owner by e-mail and in their Contact inbox. The page owner sees your e-mail address so they can reply. The IP address is only used to stop spam and abuse. Messages are kept until the page owner deletes them or their account is deleted. Contact us if you want a message you sent to be removed. Legal basis: legitimate interest (passing on your message as you asked).
- Help desk and contact form: your messages to us and our replies. Kept as long as needed to help you, and at most as long as your account exists. Legal basis: contract and legitimate interest.
- Reports: if you report a page, we store your report and, if you give them, your name and e-mail. Legal basis: legitimate interest and legal obligations.
- Support through Ko-fi: if you support MyLinkz on Ko-fi, Ko-fi sends us the name, e-mail, amount and message of the contribution. We use this only to thank you and to mark the matching account as a Supporter. Your card or payment details stay with Ko-fi and its payment providers. Supporters are shown with their username and page on our public thank-you list, unless they chose to support privately on Ko-fi. You can turn this off at any time, and amounts are never shown. Legal basis: contract (giving you the Supporter perks) and our legal duty to keep accounting records.
- E-mails from us: account e-mails (confirm e-mail, password reset, security codes, replies) and occasional important news about the Service. Legal basis: contract and legitimate interest.
- Website statistics: we use Google Analytics to see how our website is used, for example which pages are visited. See our Cookie Policy.
3. Who we share data with
We never sell your personal data. We share it only with services that help us run MyLinkz, and only as much as they need:
- Hosting: our hosting provider stores the website and the database.
- E-mail: our e-mail provider sends account and notification e-mails.
- Country lookup: ip-api.com and ipinfo.io receive an IP address and tell us the country (and for logins the city and network). We store only the result.
- Google Analytics (Google) for website statistics.
- Ko-fi for voluntary support.
- YouTube and Spotify when a page owner adds a video or a player (see our Cookie Policy).
- Google Maps when a page owner adds a map and a visitor taps it to load it.
We may also share data when the law requires it, to protect people's safety, to stop fraud or misuse, or if MyLinkz is sold or merged. In that case we tell you first.
4. Data outside the EU
Some of these services (for example Google) may handle data outside the EU/EEA, such as in the USA. When that happens, it is protected by the EU-US Data Privacy Framework or the EU's standard contract clauses.
5. How long we keep data
- Account and page: as long as you have an account. When you delete your account, your page goes offline right away and your data is removed from our live systems within 30 days, and from backups when they are replaced.
- Login history: your last 20 logins.
- Security log: up to 180 days.
- Country lookups: up to 30 days.
- Page statistics: as long as the page exists.
- Accounting records (for example Ko-fi contributions): 7 years, as Swedish law requires.
- Data we need to handle a dispute or a legal claim can be kept until it is settled.
6. Your rights
You have the right to:
- get a copy of the personal data we have about you;
- correct wrong data (most of it you can change yourself in Settings);
- have your data deleted (you can delete your account under Settings);
- object to processing that is based on legitimate interest, and to limit processing;
- get your data in a format you can move to another service;
- withdraw consent you have given, at any time.
Write to legal@mylinkz.cc and we reply within one month. If you are not happy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
7. Children
You must be at least 13 years old to create an account, and users under 18 need permission from a parent or guardian. If we learn that a child under 13 has an account, we delete it.
8. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, limits on login attempts, extra checks for unusual logins and access only for those who need it. No system is 100% secure, so use a strong password that you don't use anywhere else.
9. Changes to this policy
We may update this policy. If a change is important, we tell you by e-mail or with a notice on the website before it takes effect.
10. Contact us
E-mail: legal@mylinkz.cc
Address: Dragon Corp, Box 55991, 10216 Stockholm, Sweden