This policy covers two things: the linkable.link website you are reading, and the Linkable app that merchants install in Shopify. Where a section applies to only one of them it says so.
Linkable Ltd is the data controller for the information described here. We are a company registered in England and Wales, number 14658892, with our registered office at 10 Esprit Court, 21 Brune Street, London, England E1 7ND. You can reach us at support@linkable.link.
The website
What we collect when you visit
Our hosting provider records the usual technical information needed to serve and protect the site: IP address, browser and device type, the pages requested and when. This happens for every visitor because a web server cannot deliver a page without it, and we use it only to run the site and investigate abuse.
Beyond that, nothing is measured unless you allow it. We ask on your first visit and load no analytics or advertising until you answer. Refusing means no third-party request is made at all, and ignoring the banner counts as refusing. The detail of each cookie, and how to change your mind, is in our Cookie Policy.
If you contact us
The contact form and the newsletter box send us the details you type, which reach us by email through Resend, our email provider. We use them to answer you and, for the newsletter, to send what you asked for until you unsubscribe.
Legal basis
Serving and securing the site, and replying to you, rest on our legitimate interest in operating a business and responding to the people who approach us. Analytics and advertising cookies rest on your consent, which you can withdraw at any time without affecting anything that happened before.
The Linkable app
Information from Shopify
When a merchant installs the app we receive, through Shopify’s APIs and limited to the permissions granted:
- Store information: name, URL, currency and time zone.
- Products: titles, descriptions, images, variants and inventory, to build campaigns from.
- Orders: order IDs, timestamps, SKUs, fulfilment status, shipping country and order value, used to attribute and validate creator-driven sales. We do not request full buyer names, email addresses, phone numbers or street addresses unless a commission dispute requires it and the merchant grants it.
- Discount codes, to run and attribute affiliate campaigns.
- Installation data, to keep the app synchronised with the store.
Information merchants and creators give us
- Merchants: name, business email, store address, billing details for the subscription, and the details of any colleague given access.
- Creators: name, email, social media handles, links to content, audience figures, country of residence, and payout details, which are collected and held by Stripe rather than by us.
Information from Instagram
A creator can connect her Instagram professional account, or sign in with it, through Meta’s Instagram API with Instagram Login. Only after she approves it on Instagram, we receive an access token for that account and read: her Instagram user ID, username, name, account type, profile picture, follower, following and post counts; the details of her latest posts (caption, type, link, date, likes and comments); her followers’ breakdown by age, gender and country, as percentages only; and the insights of posts she submits for a Linkable campaign (views, reach, likes, comments, shares, saves).
We use this to verify that she owns the handle on her profile, to keep her profile figures and audience up to date for the brands she works with, and to report how her campaign posts performed. The token is stored encrypted, the data is refreshed daily and replaces the previous copy, and we never post, comment or message on her behalf.
She can disconnect Instagram at any time in Settings, which deletes the token and everything read through it straight away. Removing Linkable in Instagram’s “Apps and websites” settings, or asking Meta to have the data deleted, does the same; a deletion request made through Meta returns a confirmation code she can check on our deletion status page. She can also write to us to have it deleted.
What we do with it
- Run the service: sync products, track clicks and conversions, validate commissions.
- Process creator payouts through Stripe Connect.
- Send transactional and support messages about your account and campaigns.
- Diagnose faults and improve how the product works.
- Detect and prevent fraud and misuse.
We do not sell, rent or otherwise monetise merchant, creator or shopper data.
Legal basis
Providing the service to a merchant or creator is performance of our contract with them. Fraud prevention and product improvement rest on our legitimate interests. Marketing email to people who are not customers rests on consent. Some retention is a legal obligation, described below.
Who we share it with
- Stripe, to process creator payouts through Stripe Connect.
- Suppliers who run our infrastructure: cloud hosting, databases, error reporting and the email provider that delivers our messages. They act on our instructions and may not use the data for their own purposes.
- The other side of a collaboration: when a merchant accepts a creator, each sees what the collaboration requires, such as the product and the shipping details needed to send a sample.
- Google and Meta, but only for website visitors who allowed analytics or marketing cookies, and only what those tags collect. They are separate controllers for that data. See the Cookie Policy.
- Authorities, where we are obliged to respond to a lawful request, or where disclosure is necessary to establish or defend a legal claim.
Transfers outside the UK and EEA
Some of our suppliers operate outside the UK and the EEA, including in the United States. Where personal data goes to a country without an adequacy decision, it is covered by the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the Standard Contractual Clauses, as applicable.
How long we keep it
- Merchant and campaign data: for as long as the store uses Linkable.
- Commission and payout records: six years after the transaction, to meet UK tax and accounting requirements.
- Contact and newsletter messages: two years from our last exchange, or until you unsubscribe.
- Website server logs: kept short-term by our host for security and diagnostics.
- Data read from a connected Instagram account: while it stays connected; deleted as soon as it is disconnected, the app is removed in Instagram or a deletion request is received.
If a merchant uninstalls the app, their store data is deleted or anonymised within 90 days, except records we are required to keep for longer. You may ask us to delete your data sooner.
Your rights
If you are in the UK or the EEA you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where our use rests on consent. Where a decision rests on legitimate interests you may object to it.
Write to support@linkable.link and we will respond within one month. If you are unhappy with the outcome you can complain to a data protection authority. In the UK that is the Information Commissioner’s Office, ico.org.uk or 0303 123 1113; in the EEA it is the authority for the country you live in.
Children
Linkable is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes
When this policy changes we update the date at the top. If a change materially affects how we use personal data we will tell affected merchants and creators directly rather than relying on you to notice.
Contact
support@linkable.link
Linkable Ltd
10 Esprit Court
21 Brune Street
London, England
E1 7ND