Privacy Policy

This policy explains what Blackwood Enterprises Private Limited ("LinkOut", "we") collects when you use the Service, why, where it is stored, who sees it, and the rights you have over it. We wrote it to be read, not skimmed. If something is unclear, email support@linkout.bio.

There are three kinds of people this policy covers: account holders (creators who build pages), visitors (people who open a LinkOut page), and audience members (visitors who give a creator their email, a booking, an order or a form answer). Each is treated differently below.

1. Who is responsible

For account holders and visitors, Blackwood Enterprises Private Limited, D50, Supremework Co-Working Space, 100 Ft. Road, Chhattarpur, New Delhi 110047, India, is the data controller. For audience members, the creator who owns the page is the controller and we are their processor: we store and handle the data on the creator's instructions. If you gave your email to a creator's page, contact that creator first; we will still help if you cannot reach them.

2. What we collect from account holders

• Google account details when you sign in: name, email address and profile photo. We do not receive or store your Google password.
• Profile and page content you create: handle, display name, bio, photos, links, blocks, themes, products, booking settings.
• Locale: country (guessed from your connection, then confirmed by you), timezone and currency.
• Plan and billing state: plan, trial dates, subscription status and Dodo Payments identifiers. Card details never touch our servers; Dodo Payments handles them.
• Payment provider keys you paste (Stripe, PayPal, Razorpay). These are encrypted at rest with a key held separately from the database and are used only to create checkouts and verify payments for your sales.
• Integration tokens you connect (Google Calendar, Mailchimp, Kit, Google Sheets, Instagram), encrypted at rest, used only for the feature you connected.
• Usage and support data: dashboard actions we log for debugging, emails you send us, and the delivery status of emails we send you.

3. What we collect from visitors (cookie-less analytics)

We do not set cookies on public pages and do not use third-party ad trackers. When you open a page we record:

• the page and block you interacted with, and the kind of interaction (view, click, form submission);
• referrer, UTM parameters, browser family, device type, operating system and language;
• country, region and city, derived from your IP address by our hosting provider;
• a visitor identifier that is a one-way hash of a secret, the current date, your IP address and browser signature. It rotates every day, cannot be reversed into your IP, and is never combined with data from other days. We do not store raw IP addresses in analytics.

Creators see aggregate numbers and, on Pro, an event log with the fields above. They never see an IP address. Creators may add their own tracking pixels (Meta, TikTok, Google) to their page; those are governed by the creator's and the pixel provider's policies, not ours.

4. What we collect from audience members

If you submit an email capture, booking, RSVP, order or form on a creator's page we store what you typed, the consent text you agreed to, the time, a hashed IP, your country, and the block you used. The creator can see and export this. We add an unsubscribe link and a consent record to protect you, and we never sell or use this data for our own marketing.

5. Why we use data (legal bases)

• To provide the Service (contract): hosting your page, showing it to visitors, processing your plan, delivering emails you trigger.
• To keep the Service safe (legitimate interest): rate limiting, abuse detection, fraud prevention, moderation of reported pages.
• To improve the Service (legitimate interest): aggregate product analytics on how the dashboard is used.
• To send you emails: transactional and account emails under contract; tips and product news only with your consent, which you can withdraw in Settings or with one click in any email.
• To comply with law: tax records for Pro subscriptions, responding to lawful requests.

6. Where data lives and who processes it

Our infrastructure is hosted in the United States. We use these processors, each under a data processing agreement:

Transfers outside India and the European Economic Area rely on standard contractual clauses or equivalent safeguards. We do not sell personal data and we do not share it with advertisers.

7. How long we keep data

• Account and page content: while your account exists. When you delete your account there is a 14-day grace period, after which everything is permanently deleted, except records we must keep for tax or legal reasons (kept up to 8 years, isolated from the product).
• Visitor analytics: raw events are kept 7 days on the Free plan and 2 years on Pro; aggregate daily counts are kept for the life of the page.
• Audience data: until the creator deletes it, the audience member unsubscribes and asks for deletion, or the creator's account is deleted.
• Email logs: 12 months. Bounce and complaint suppressions are kept indefinitely so we do not email you again.
• Abuse reports and moderation actions: 3 years.

8. Your rights

Under India's Digital Personal Data Protection Act 2023, the EU and UK GDPR, and similar laws, you can:

• Access the personal data we hold about you;
• Correct it if it is wrong;
• Delete it (Settings → Danger zone, or email us);
• Export it in a machine-readable format (Settings → Danger zone);
• Withdraw consent to marketing at any time without affecting the Service;
• Object to processing based on legitimate interest, and nominate someone to exercise your rights if you are unable to;
• Complain to the Data Protection Board of India or your local supervisory authority. We would rather you emailed us first.

We answer rights requests within 30 days. We may ask you to verify your identity through your Google sign-in.

9. Children

LinkOut is not for children. You must be 16 or older to create an account (13 or older to visit a page where local law allows). If you believe a child has created an account, email us and we will delete it.

10. Security

All traffic is encrypted in transit. Secrets you give us are encrypted at rest. Sessions are stored server-side and can be revoked. Access to production systems is limited to staff who need it and is logged. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the relevant authority without undue delay.

11. Grievance officer

As required under Indian law, our grievance officer can be reached at support@linkout.bio or by post at D50, Supremework Co-Working Space, 100 Ft. Road, Chhattarpur, New Delhi 110047, India. Please put "Privacy" in the subject line.

12. Changes

We will email account holders about material changes at least 14 days before they take effect and keep earlier versions available on request.