LinkMax
DATA PROTECTION & PRIVACY
Effective Date: November 4, 2026

Privacy Policy

How LinkMax protects merchant account data and enforces 100% cookieless, privacy-first telemetry for end-user link visitors under GDPR, UK GDPR, and CCPA/CPRA.

End-User Cookies0 Cookies (100% Cookieless)
Visitor IP StorageNever Stored in Plaintext
Compliance FrameworksGDPR / CCPA / ePrivacy
Privacy Contactdouglasdouglasskikcn@outlook.com
01

1. Overview & Dual Data Roles

LinkMax is engineered from the ground up on privacy-by-design principles. Because our platform serves registered SaaS Merchants while routing clicks from End-User Visitors, this Privacy Policy clearly distinguishes between (A) Merchant Account Data (where LinkMax acts as a Data Controller) and (B) End-User Click Telemetry (where LinkMax acts as a Data Processor on behalf of the Merchant).

02

2. 100% Cookieless End-User Click Telemetry

When an end user clicks a LinkMax short link, our Cloudflare Workers edge node executes an HTTP 302 redirect in under 30 milliseconds. During this redirect, LinkMax does NOT set, read, or store any tracking cookies, localStorage items, or persistent device fingerprints on the visitor’s browser.

To provide Merchants with aggregated Unique Visitor (UV) counts without compromising consumer privacy, the edge worker processes the incoming network request strictly in volatile memory using a one-way cryptographic hash:

  • Irreversible Salted IP Hashing: The visitor IP address is combined with a high-entropy secret salt (`SHA-256(clientIp + "-" + SALT_SECRET)`) and truncated to an anonymous 32-character digest. Raw IP addresses are never written to disk, logs, or persistent storage.
  • Coarse Geographic Metadata: Country, region, and city codes (e.g., US, JP, FR) are derived natively from Cloudflare network routing headers without querying external third-party IP profiling brokers.
  • High-Level User-Agent Classification: The User-Agent string is parsed into non-identifying categories (Device Type: Mobile/Tablet/Desktop; OS family: iOS/Android/macOS/Windows; Browser family) and HTTP Referer origin.
No Third-Party Cookie Banners Required

Because LinkMax never drops tracking cookies or stores Personally Identifiable Information (PII) of link visitors, our redirect links comply natively with EU/UK GDPR, ePrivacy Directive, and California CCPA/CPRA.

03

3. Merchant Account & Billing Data Collection

When you register and operate a LinkMax Merchant account, we collect only the minimum information required to provision your workspace, authenticate sessions, and manage billing quotas:

  • Identity & Authentication Data: Work email address, display/business name, Merchant Account UID, and email verification status. Session state is maintained via an encrypted, HttpOnly `__session` cookie.
  • Payment & Billing Identifiers: All payment card details are collected and processed directly by our Merchant of Record, Dodo Payments. LinkMax never receives, processes, or stores your credit card number, CVV, or bank credentials—we store only your `dodoCustomerId`, `dodoSubscriptionId`, active tier, and click quota balances.
  • Workspace Configuration Data: Short link slugs, destination URLs, custom domain names, and generated QR code assets.
04

4. Multi-Tenant Isolation, Zero Data Resale & Sub-Processors

All Merchant configuration records in cloud database clusters and click telemetry rows in the streaming analytics warehouse are logically partitioned and strictly isolated by your `merchantId`. We never sell, rent, or trade Merchant data or click logs to advertising networks or data brokers, nor do we aggregate data across Merchants for ad targeting.

To deliver our global infrastructure, we engage the following industry-leading infrastructure sub-processors under strict data protection commitments:

  • Cloudflare, Inc. — Global Anycast edge worker execution and Workers KV link routing cache.
  • Enterprise Cloud Infrastructure Providers — Scalable container hosting, secure identity verification, encrypted cloud database clusters, streaming telemetry pipelines, and automated URL risk verification.
  • Dodo Payments — Authorized Merchant of Record for global subscription checkout, invoicing, and tax compliance.
05

5. Your Privacy Rights (GDPR / CCPA) & Data Retention

Depending on your jurisdiction (including the European Economic Area, United Kingdom, Switzerland, and California), you have the right to request access to, correction of, export of, or deletion of your personal account data.

You may delete individual short links at any time via the Dashboard, or request full account and telemetry deletion by emailing our Data Protection team at douglasdouglasskikcn@outlook.com. We respond to all verified privacy requests within 30 days.

Compliance & Merchant Support

Need help with billing, GDPR/CCPA requests, or reporting link abuse? Reach our compliance team directly.

douglasdouglasskikcn@outlook.com