Privacy policy

1. Who is responsible

The operator of LnkStart, based in Spain, is responsible for the processing described here. Contact: privacy@lnkstart.com.

2. What we process, and why

• Registration email. Used to create your free account, send the confirmation link, and issue your license key. Legal basis: performance of a contract (Art. 6.1.b GDPR).
• Your web account. If you sign in: your email address, the sessions you have open (browser name and when they were last used), and whether you linked Google. Passwords are stored only as an argon2id hash, and session tokens only as a hash, so neither can be read back. The IP address you sign in from is never stored: only a salted hash of it, to limit sign-in attempts. Legal basis: performance of a contract.
• What you write about your servers in the dashboard. The name you give them and, if you type it, the address of their console, only to show you the button that opens it. Your server never sends us its domain: we only have this address if you type it, and it is deleted when you remove it. Legal basis: performance of a contract.
• Server telemetry. Sent by your own server, not by us collecting it: version, OS, usage counts and aggregated traffic totals, once a day and when renewing the license. Never visitor IPs, domains, service names or content. The complete list, field by field, is in what the server sends. Legal basis: performance of a contract (issuing and renewing the license) and legitimate interest (understanding aggregated product usage).

We never process the traffic that flows through a customer's own installation: it never reaches our infrastructure, so we have no technical means to see it.

3. Who receives this data

• Resend: sends the confirmation and sign-in emails.
• Google, only if you choose to sign in with your Google account.

Nobody else. Your own server connects over HTTPS to our license service to renew it; that service is ours, not a third party's.

4. How long we keep it

• Registration account: until the registration account is deleted.
• Web account and sessions: until you delete the account; sessions expire after 30 days or when you close them.
• Server telemetry: 90 days, install notices included; aggregated, never identifying visitors or content (see "Telemetry").

5. Your rights

You may request access, rectification, erasure, restriction, portability and objection regarding your registration data by writing to privacy@lnkstart.com. We respond within one month, extendable to three if the request is complex. You may also lodge a complaint with your national data protection authority.

6. International transfers

No personal data described above is transferred outside the European Economic Area as part of the processing this policy covers.