Privacy Policy

1. Overview & Scope

At 1Link, we prioritize user trust, transparency, and data minimization. This Privacy Policy details the types of personal data we collect, how it is processed and safeguarded, and your choices and statutory rights regarding your personal information.

This policy applies to two categories of individuals:

• Platform Users (Customers): Individuals and organizations registered on 1Link who create and manage smart redirection links, QR codes, subdomains, and subscription plans.
• Smart Link Visitors (End Users): Individuals who scan a 1Link-generated QR code or click on a 1Link-powered smart URL (/l/{slug} or branded subdomain).

2. Information We Collect From Platform Users

When you register, manage links, or subscribe to 1Link, we collect the following data:

• Account Identity Information: First name, last name, and email address.
• Authentication Credentials: Securely hashed passwords (via salted bcrypt), temporary 6-digit registration OTP codes, and JWT access tokens. If you authenticate via Google OAuth, we receive your verified Google account ID, email address, and profile name.
• Link Configuration Data: Slugs, destination URLs (Apple App Store links, Google Play Store links, fallback web URLs), title metadata, and in-app deep link schemes (myapp://).
• Domain & App Verification Metadata: Custom subdomain names, Apple Team ID, Apple Bundle ID, Android Package Name, and SHA-256 certificate fingerprints for hosting assetlinks.json and apple-app-site-association files.
• Billing Identifiers: Lemon Squeezy Customer ID, Subscription ID, Variant ID, and subscription status (e.g., active, past_due, cancelled). We never store credit card numbers or banking information.

3. Information Processed From Smart Link Visitors

When a visitor clicks a 1Link URL or scans a QR code, our servers process:

• User-Agent String: Evaluated in-flight to identify operating system (iOS, Android, macOS, Windows, Linux) to execute the correct store redirection.
• Timestamp: To record the occurrence of the hit and aggregate click timeline activity.
• IP Address: Ephemerally processed for DDoS protection, click fraud mitigation, and rate-limiting. IP addresses are pseudonymized/hashed and are never sold or shared with data brokers.
• Referrer Header: Standard HTTP referrer indicating the source web page or application (if sent by the client's browser).

4. Legal Bases for Processing (GDPR Article 6)

We process personal information under the following legal frameworks:

• Performance of a Contract: Providing smart link routing, account authentication, threshold monitoring, and customer support.
• Legitimate Interests: Securing our infrastructure against abusive traffic, preventing link cloaking or phishing, and maintaining accurate hit analytics.
• Legal Obligation: Maintaining transaction records and cooperating with lawful government or regulatory inquiries.

5. How We Use Collected Information

We use your information strictly for legitimate operational purposes:

• Executing device redirection with sub-50ms latency.
• Rendering real-time dashboard analytics (total hits, 7-day timeline trends, device breakdown ratios).
• Dispatching transactional communications: Email registration OTPs, password notifications, and quota threshold alerts (e.g. 80% quota reached).
• Facilitating tier switches, upgrades, and Lemon Squeezy billing management.
• Enforcing our Acceptable Use Policy to block malware and phishing links.

6. Payment Processing via Lemon Squeezy

1Link utilizes Lemon Squeezy, LLC as our Merchant of Record and payment gateway. When you purchase a Professional or Enterprise subscription, your payment details (credit card number, expiration date, CVV, billing address, VAT/tax IDs) are provided directly to Lemon Squeezy via their PCI-DSS Level 1 compliant checkout interface.

Lemon Squeezy transmits cryptographically signed webhooks (verified via HMAC SHA-256) notifying 1Link of subscription state changes (e.g. subscription_created, subscription_updated, subscription_cancelled). Please consult the Lemon Squeezy Privacy Policy for information on their independent data handling.

7. Third-Party Sub-processors & Data Sharing

We never sell, rent, monetize, or trade your personal data or your link visitors' clickstream data.

We share minimal necessary data with vetted infrastructure sub-processors:

8. Cookies & Client-Side Storage

1Link does not use invasive third-party tracking pixels, marketing beacons, or advertising cookies. We utilize standard browser localStorage solely for essential platform functionality:

• onelink_token: Stores your encrypted session JWT token to maintain your authenticated login state.
• onelink_user: Caches basic display profile data (display name, email, active tier) for fast UI rendering.
• onelink_theme: Saves your Dark Mode vs. Light Mode display preference across sessions.

9. Data Retention & Security Controls

We retain account data for as long as your account remains active. When an account or link is deleted, associated configuration records are immediately scheduled for permanent deletion or soft-deleted as required for tax compliance.

We implement multi-layered enterprise security controls:

• Encryption in Transit: All HTTP traffic is secured via TLS 1.3 / HTTPS.
• Cryptographic Hashing: Passwords hashed with bcrypt; Lemon Squeezy webhook payloads validated with HMAC-SHA256 signatures.
• SQL Injection Prevention: Database operations execute via parameterized prepared statements via GORM.
• Principle of Least Privilege: Scoped database permissions and regular dependency auditing.

10. Your Privacy Rights (GDPR & CCPA/CPRA)

Regardless of your geographical location, 1Link provides you with comprehensive privacy rights:

• Right to Access & Portability: You may request an export of your personal data and link history.
• Right to Rectification: You can edit your name, links, fallback destinations, and subdomain settings anytime in your dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request complete deletion of your account and all associated smart links.
• Right to Restrict Processing & Object: You may object to any processing based on legitimate interests.
• Right to Non-Discrimination: We do not penalize or restrict service to any user exercising their statutory privacy rights.

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We respond to all verified requests within thirty (30) days.

11. Children's Privacy

1Link is an enterprise developer tool and is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please notify us immediately so we can remove the data.