Privacy Policy

This Privacy Policy explains how AMP Studio LTD (“AMP Studio”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use the LnkFlow website, applications, and link-tracking and attribution services (together, the “Service”), and when you visit a link created with LnkFlow.

LnkFlow (lnkflow.io) is a product operated by AMP Studio LTD, which also trades under the “appitstudio” brand (appitstudio.com). LnkFlow, AMP Studio LTD and appitstudio refer to the same operation: LnkFlow is the product and its website (lnkflow.io) and application (app.lnkflow.io), AMP Studio LTD is the registered company that operates it, and appitstudio is the brand used for our company domain, support mailboxes, and developer accounts — including the Google Cloud project and OAuth consent screen behind LnkFlow’s “Sign in with Google” feature. Wherever this policy says “we”, it means AMP Studio LTD acting as the operator of LnkFlow.

We have written this policy to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the Bulgarian Personal Data Protection Act, and the ePrivacy rules that apply to information stored on, or read from, a visitor’s device.

1. Who we are (Data Controller)

The data controller responsible for personal data described in this policy is:

• AMP Studio LTD — the company that operates LnkFlow and trades under the appitstudio brand
• Registered address: Boris Rumenov 9 str., Sofia, Bulgaria
• Company registration (UIC/ЕИК): 208265294
• Product and brand names we use: LnkFlow (lnkflow.io, app.lnkflow.io) and appitstudio (appitstudio.com)
• Privacy contact: support@appitstudio.com
• General support: support@appitstudio.com
• Google OAuth / developer contact (the address shown on our Google consent screen): appitstudio@gmail.com

All of these addresses reach the same team at AMP Studio LTD. support@appitstudio.com is the preferred address for privacy and data-protection requests.

We have not appointed a statutory Data Protection Officer, as we are not required to. You can raise any privacy question using the contact details above.

2. Controller and processor roles

LnkFlow is a business-to-business tool. Depending on the data, our role under the GDPR differs:

• We are the controller for the personal data of our account holders, prospective customers, waitlist and contact-form respondents, and visitors to our marketing website — for example, the data we use to operate accounts, take payment, secure the Service, and communicate with you.
• We act as a processor for the click and visitor data generated when someone follows a tracked link that one of our customers created. Our customer decides which links to create, where they redirect, and which analytics tools receive the data; for that processing the customer is the controller and we act on their documented instructions under our Terms & Conditions and applicable data processing terms. The information below describes that processing so it is transparent end-to-end, but requests about a specific tracked link should usually be directed to the customer who created it.

3. Personal data we collect

3.1 Account and profile data

When you register or manage an account, we collect:

• Name and email address;
• Password (stored only as a salted hash — we never store it in readable form);
• Your chosen URL prefix and account/profile settings;
• Plan and subscription status;
• API tokens and browser-extension authorisation records you create.

3.2 Waitlist, contact and sales enquiry data

If you join the waitlist or submit a contact form, we collect the information you provide, such as your name, email address, company name, the plan you are interested in, expected monthly click volume, and any message or use-case details you choose to share.

3.3 Integration credentials

If you connect a third-party analytics tool (for example Google Analytics 4, the Meta Conversions API, DataFast, Mixpanel, or Segment), we store the credentials you provide (such as measurement IDs, access tokens, and API keys) so we can forward your click events to that tool. These credentials are encrypted at rest and are used only to deliver data to the service you connected.

Google user data (“Sign in with Google”). If you connect Google Analytics using the one-click “Sign in with Google” flow, we receive OAuth tokens scoped to your Google Analytics account. We use them only to: (a) list your Google Analytics accounts, properties and web data streams so you can choose which property to connect; (b) create a Measurement Protocol API secret on the data stream you selected — the credential we use to forward your click events to your own property; (c) where Google requires it and you explicitly approve the attestation text shown in the app, record your property’s one-time data collection acknowledgement; and (d) run a one-off Realtime report to confirm your connection works. The OAuth tokens and the API secret are encrypted at rest, are never shared with or sold to anyone, and are deleted when you disconnect the integration — disconnecting also revokes LnkFlow’s access with Google. LnkFlow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use commitment. LnkFlow’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• we do not use Google user data for serving advertisements, and we do not use it to build advertising or marketing profiles;
• we do not sell, rent, or license Google user data, and we do not transfer it to data brokers, information resellers, or any other third party for their own purposes;
• we do not use Google user data for any purpose other than providing or improving the Google Analytics integration features described in this section — it is not used to train generalised or third-party AI or machine-learning models;
• we do not allow humans to read this data, unless: (a) we have your consent for specific messages; (b) it is necessary for security purposes, such as investigating abuse; (c) it is required to comply with applicable law; or (d) the data is aggregated and anonymised so it no longer identifies you or your Google account.

AI client connections (including ChatGPT and Codex)

If you connect LnkFlow to an AI client through our MCP integration, we store an authorisation record identifying your account, the client, its callback address, your selected default team, the permissions you approve, and connection approval, last-use and revocation timestamps. OAuth access and refresh tokens allow the client to make authorised requests. Read access is the default; creating or changing records requires you to enable management permission, and your team role still applies. The consent screen displays the configured token lifetimes.

To fulfil your requests, LnkFlow sends the connected client the requested account and workspace context, campaign and link details, influencer information, aggregate click statistics, and available attributed conversion and commission reports. These results may contain names, account email addresses, destination URLs, notes and other information you have stored in LnkFlow. The MCP tools do not expose raw visitor IP addresses, visitor fingerprints or private integration credentials, and do not request your full chat history. Link-management requests can create or change publicly usable redirect links; subsequent visits to those links are processed as described below.

For ChatGPT and Codex connections, the recipient is OpenAI. Other connected AI clients receive the results you request through them. Their handling and retention of those results are governed by your agreement, settings and privacy terms with that provider. You can revoke future LnkFlow access in Settings → Connected AI clients. Revocation does not erase information already returned to the provider or delete links and campaigns created through the connection. Authorisation records are account data covered by section 8; requests to remove information retained by an AI provider must also be directed to that provider.

3.4 Link-click and visitor data (collected when a tracked link is followed)

LnkFlow performs server-side tracking: the redirect itself sets no cookies and runs no scripts in the visitor’s browser. When someone follows a tracked link, the request is served at the edge of our content-delivery network (Cloudflare) and we record information from the HTTP request before redirecting the visitor, including:

• IP address (used for security, fraud/bot detection and geolocation — and automatically truncated/anonymised after 30 days, see section 8);
• User-agent string, referrer, and HTTP headers such as Accept, Accept-Language, Accept-Encoding, Connection, Cache-Control, the browser Sec-Fetch/Purpose hints, and the Sec-CH-UA client hints (browser brand, platform, mobile flag);
• Request metadata (method, requested URI, query string, timestamp, server processing time);
• Ad-platform click identifiers present in the link’s query string (for example the Meta fbclid parameter), which are stored with the click and used only for the attribution and integration features our customer has enabled;
• A fingerprint hash — a pseudonymous SHA-256 value derived from the IP address, user-agent and Accept headers — used to recognise unique visits without storing a direct identifier;
• Approximate location derived at the network edge from the IP address: country, region, city, time zone, continent, and coarse coordinates deliberately rounded to roughly city precision (about 1 km) before storage. We do not collect postal codes or precise coordinates;
• Network information: internet service provider / network operator (ASN), connection metadata (HTTP protocol version, TLS version, network round-trip time), and the CDN data centre that served the request;
• Bot-detection signals (suspected-bot flag, click velocity, and patterns indicating automated traffic).

Some of this data — an IP address in particular — is personal data under EU law. We minimise what we keep (coarse coordinates only, no postal codes, automatic IP anonymisation), rely on it primarily for security, analytics integrity and the reporting our customers see, and apply the retention limits described below.

Forwarding to the customer’s analytics tools. If the customer who created the link has connected an analytics integration, we forward the click event to that tool on the customer’s instructions. The forwarded event can include the visitor’s IP address and user-agent string (so the destination tool attributes the visit to the real visitor rather than to our servers — for example Google Analytics’ ip_override field or the Meta Conversions API’s client_ip_address field) and, where present, an ad-platform click identifier such as fbclid. The customer is the controller for this forwarding and is responsible for their lawful basis and disclosures; the tool’s own privacy terms then apply.

3.5 Conversion tracking and buyer data (optional, configured by our customers)

Customers can enable conversion tracking on a link. When enabled, we attach a random click identifier (for example lnk_id) to the destination URL so the customer can attribute a later sign-up or purchase back to the click. If the customer installs our optional lnk.js snippet on their own website, that snippet stores the click identifier (and, where configured, a promo code) in first-party cookies on the customer’s site — for 90 days by default (the customer can configure a different lifetime). The customer, as controller of their own website, is responsible for disclosing these cookies and obtaining any consent required by the ePrivacy rules — see also section 4.

When a customer reports conversions to us (through our API, the snippet, or a payment-provider webhook such as Stripe), we process the event data on their behalf: event type (lead, sale, or refund), amount and currency, order/invoice references, and — where the customer sends it — the buyer’s name, email address and payment-provider customer identifier. We process this data strictly as a processor on the customer’s instructions, use it only to provide attribution and commission reporting to that customer, and never use it for our own purposes or advertising. Requests about buyer data should be directed to the customer (the controller); we will assist them in fulfilling such requests.

3.6 Service and technical logs

To keep the Service secure and reliable we keep standard server and application logs (such as error logs and request logs). These may contain IP addresses and timestamps.

3.7 Account, trial and product emails

When you create an account, we use your name, email address, plan/trial status, and high-level account activity (for example whether you have created tracked links and aggregate click totals) to send relevant account onboarding, trial-progress, and trial-expiry messages. These messages may also mention a LnkFlow plan or launch offer when that offer is genuinely available. We do not include raw visitor data in these emails.

Optional product guidance, progress summaries, trial reminders, and promotional content can be turned off at any time using the unsubscribe link in each applicable email or the email preferences in your LnkFlow profile. Essential security, verification, billing, usage-limit, refund, and team-invitation messages are service communications and remain enabled where needed to operate your account.

4. Cookies and similar technologies

We use a small number of strictly necessary cookies that are essential to operate the Service — for example, to keep you signed in, to protect forms against cross-site request forgery (CSRF), and to remember your cookie choice itself (wp_consent, kept for 6 months, so we do not ask you again on every page). These do not require consent under the ePrivacy rules.

We do not use advertising or ad-targeting cookies, we do not build advertising profiles, and the link redirect itself is deliberately cookie-less: it works server-side, which is why it continues to function even when visitors use ad blockers or privacy tools. No analytics cookies are set when someone follows a tracked link.

Analytics on our own marketing website (lnkflow.io). To understand which pages and channels bring people to LnkFlow, and to find usability problems, our public marketing pages load the following measurement tools. They run on our marketing website only — never on the redirect path, and never in our customers’ dashboards:

These tools are not strictly necessary. We apply the following regional policy using country context supplied by Cloudflare to our origin. We accept that country only from a trusted Cloudflare proxy or through a secret origin-authenticated request; we do not infer your country from your time zone, locale, browser language, or other client-controlled settings:

• Strict opt-in regions: in the EEA, United Kingdom, Switzerland, and any other region we configure for strict opt-in, DataFast, Google Tag Manager/Google Analytics, and Hotjar remain off until you grant the relevant permission. The privacy banner is shown.
• Known non-strict regions: DataFast is enabled by default for audience and journey measurement. Google Tag Manager/Google Analytics and Hotjar remain off until you explicitly allow their Analytics or Experience purpose. The initial banner is not shown, but Privacy Choices remains available in the footer.
• Unknown or untrusted geography: if the country is missing, invalid, reported as Tor, or cannot be trusted, only DataFast is enabled by default and the privacy banner remains visible. Google Tag Manager/Google Analytics and Hotjar stay off until you explicitly allow them.
• Global Privacy Control: a recognised GPC signal overrides every regional default, disables all optional services, and suppresses the initial banner.

The marketing site does not currently enable LnkFlow browser persistence or decorate checkout links. Its product click redirects remain server-side and cookie-less, and paid checkout remains owned by the separate application at app.lnkflow.io. Cached public HTML contains only generic loader configuration; the regional decision is returned by a private, uncacheable context request for the current visitor.

When shown, the privacy banner offers “Accept all” and “Reject all” as equally prominent choices and also supports selective choices. Rejecting costs you nothing — every part of our website keeps working. You can change or withdraw your choice at any time through Privacy Choices in our footer. Rejection or withdrawal stops the affected services and deletes applicable DataFast, Google Analytics, and Hotjar cookies. Google Consent Mode stays denied for storage that has not been permitted. We keep a record of each explicit decision (a pseudonymous consent ID, the purposes accepted or rejected, the time, and an anonymised IP address) so we can demonstrate the choice; those records are pruned after two years. The preference cookie itself expires after 182 days.

Independently of the banner you can also block or delete cookies in your browser settings, install Google’s Analytics opt-out add-on, use Hotjar’s opt-out page, or enable the “do not track” / tracking-protection setting in your browser, which Hotjar honours. Ad blockers and privacy browsers may also block these tools. You can object to DataFast's regional-default processing at any time through Privacy Choices or using the contact details in section 13.

We do not use these tools to identify you personally, we do not combine their data with your LnkFlow account data, and we do not sell or share it for advertising. If we introduce any further non-essential cookies, we will update this policy first.

One exception exists for conversion tracking (section 3.5): if a customer installs the optional lnk.js snippet on their own website, it stores a click identifier and, where configured, a promo code in first-party cookies on that customer’s site — for 90 days by default, or a different lifetime the customer configures. Those cookies live on the customer’s domain, not ours; the customer is responsible for including them in their own cookie notice and consent flow where required.

5. Why we use your data and our legal bases

6. Who we share data with

We do not sell personal data. We share it only as needed to run the Service:

• Analytics integrations you connect. When you connect a tool such as Google Analytics 4, the Meta Conversions API, DataFast, Mixpanel or Segment, click data — including the visitor’s IP address, user-agent, and any ad-platform click identifier, as described in section 3.4 — is forwarded to that provider at your direction. These providers act on your behalf, not ours; your use of those tools is governed by their own privacy terms.
• Service providers (processors) who help us operate. Our current subprocessors are: Cloudflare (content-delivery network that serves tracked-link redirects at the edge and derives the approximate, network-level geolocation described in section 3.4); Cloudways / DigitalOcean (cloud hosting of our application and database); Stripe (payment processing for paid plans); WorkOS (secure sign-in / authentication); Bunny Fonts / bunny.net (privacy-friendly web fonts on our marketing site); and Google (Tag Manager and Analytics 4), Hotjar and DataFast for the marketing-website analytics described in section 4. These providers process data under contract and only on our instructions. An up-to-date list, including what each provider does and the data it touches, is published on our Subprocessors page.
• Professional advisers and authorities where required by law, to establish or defend legal claims, or to comply with a lawful request.
• In a business transfer — if we are involved in a merger, acquisition or sale of assets, data may be transferred subject to this policy.

7. International transfers

We aim to keep processing within the European Economic Area (EEA) where practical. Where a service provider processes data outside the EEA, we rely on an appropriate safeguard under the GDPR — typically an adequacy decision or the European Commission’s Standard Contractual Clauses, with additional measures where needed. You can ask us for more detail about the safeguards in place using the contact details above.

8. How long we keep data

• Account data: for as long as your account is active, and then deleted or anonymised within a reasonable period after closure, unless we must keep it longer for legal reasons.
• Click and visitor data: retained in line with the click-history window of your plan (currently 30 days, 12 months, or 24 months depending on tier), after which the click records are deleted automatically. In addition, and regardless of plan, we anonymise the stored IP address of every click after 30 days by truncating it (removing the last part of the address) so it no longer identifies a specific connection; aggregate statistics are unaffected. Customers may request shorter retention.
• Waitlist and enquiry data: kept while we evaluate or pursue the enquiry and for a reasonable follow-up period.
• Billing and tax records: kept for the periods required by applicable accounting and tax law.
• Cookie-consent records: the proof-of-consent record described in section 4 is kept for 2 years from the decision and then deleted automatically.
• Marketing analytics: browser identifiers expire as described in section 4. Provider-side analytics, heatmaps, and replay follow the retention settings approved in the relevant provider account.
• Logs: kept for a short period for security and troubleshooting.

9. Your rights

If you are in the EEA/UK, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure (the “right to be forgotten”) in certain circumstances;
• restrict or object to certain processing, including direct marketing;
• data portability for data you provided to us, where applicable;
• withdraw consent at any time, where processing is based on consent (without affecting prior processing).

You have an unconditional right to object to direct marketing at any time and free of charge. Use the unsubscribe link in an applicable email or switch off product emails in your LnkFlow profile; once you do, we will stop using your account data for those optional emails.

To exercise these rights, contact us at support@appitstudio.com. We will respond within the timeframe required by law (normally one month). If your request concerns data processed through a link created by one of our customers, we may need to refer you to that customer, who is the controller for that data, and we will help facilitate the request.

You also have the right to lodge a complaint with a supervisory authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg. You may also contact the authority in your country of residence.

10. How we protect data

We apply technical and organisational measures appropriate to the risk, including encryption of integration credentials at rest, hashing of passwords, encryption in transit (HTTPS), access controls, pseudonymous fingerprint hashing and automatic IP anonymisation for visitor data, coarsening of location data at collection, and rate-limiting and bot detection to protect the Service. No method of transmission or storage is completely secure, but we work to protect your data and to address incidents promptly.

11. Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date. If the changes are significant, we will take reasonable steps to notify you.

13. Contact us

For any privacy question or to exercise your rights, contact AMP Studio LTD — the operator of LnkFlow, trading as appitstudio — at support@appitstudio.com, or write to us at Boris Rumenov 9 str., Sofia, Bulgaria.

Questions specifically about our Google API integration or the “Sign in with Google” flow can also be sent to appitstudio@gmail.com, the developer contact listed on our Google OAuth consent screen. Both mailboxes are monitored by the same team.