--- title: "Is Linkbreakers GDPR compliant?" description: "What Linkbreakers does to support GDPR, what data it processes for your QR codes and links, and what you remain responsible for as the controller of your visitors' data." canonical: "https://linkbreakers.com/help/article/is-linkbreakers-gdpr-compliant" last-updated: 2026-10-24 --- # Is Linkbreakers GDPR compliant? > What Linkbreakers does to support GDPR, what data it processes for your QR codes and links, and what you remain responsible for as the controller of your visitors' data. ## Short answer Linkbreakers is built to be used under GDPR, but no tool makes you compliant on its own and Linkbreakers holds no GDPR certification. For the people who scan your QR codes or open your links, you are the data controller and Linkbreakers processes their data on your behalf. You decide how much is collected (None, Basic or Advanced), you can delete, edit and export visitor data, and Linkbreakers secures it and lists its subprocessors in the [Privacy Statement](https://linkbreakers.com/privacy). Choosing a lawful basis, informing your visitors and answering their requests stays your responsibility. ## Quick summary - **Roles:** you are the controller of your visitors' data, Linkbreakers is the processor. For your own account, Linkbreakers is the controller. - **Data minimization:** each workspace or link uses a data collection level: None, Basic or Advanced. A workspace with no setting uses None. - **Visitor rights tools:** delete a visitor profile, edit visitor attributes, export events and visitors as CSV, and lower the collection level for future scans. - **Retention:** there are no configurable retention periods. Data is kept as long as your workspace exists, and deleting the workspace deletes it. - **Security:** HTTPS, bcrypt password hashing, email-code MFA that a workspace can enforce, workspace roles and encrypted integration credentials. - **Hosting:** in the United States, with transfers from Europe relying on safeguards such as Standard Contractual Clauses. There is no EU data residency option. ## How it works ### Who is responsible for what | Data | Controller | Linkbreakers' role | |---|---|---| | People who scan your QR codes or open your links, and what they type into your forms | You | Processor, acting on your instructions | | Your account, workspace members and billing | Linkbreakers | Controller | | Visitors of linkbreakers.com | Linkbreakers | Controller | As controller you choose the purpose and the lawful basis (for example legitimate interest or consent), tell your visitors what you collect, and answer their requests. Linkbreakers does not provide a consent banner or consent management on your links, so if your use needs consent, you have to collect it yourself, for example with a form step in your workflow. ### What is collected at each level **At every level, including None:** the time of the scan, the link or entry point that was opened, the destination, the workflow steps the visitor went through, and the `linkbreakers.browser` cookie. This first-party cookie is set on the link's domain, is HttpOnly, lasts one year and lets your analytics recognize a returning browser. Device identifiers are derived from it per workspace with a server-side secret. **Basic adds:** the IP address (stored as is, not anonymized), user agent, device type, brand and model, browser and version, operating system and version, language, timezone, and the country, region, city and network provider (ISP and ASN) derived from the IP address. The IP lookup uses a local MaxMind GeoLite2 database, so IP addresses are not sent to MaxMind. No GPS, latitude and longitude or postcode is collected. **Advanced adds:** screen size and ratio, graphics card, memory, number of processor cores, touch support and network information. **What visitors type into your forms** (email, phone, first and last name and any other attribute you ask for) is stored as visitor attributes at any level. Form answers may be summarized by OpenAI. ### Handling visitor requests | Request | What you can do in Linkbreakers | |---|---| | Access or portability | Export events and visitors as CSV from the dashboard. | | Rectification | Edit the visitor's attributes in the dashboard or through the API. | | Erasure | Delete the visitor profile in the dashboard or through the API. See the caveat below. | | Objection or restriction | Lower the data collection level for future scans. Past data is not changed. | If a visitor contacts Linkbreakers directly, we forward the request to the business that created the link. ### Retention - Data is kept for as long as the workspace exists. There are no configurable or automated retention periods. - Deleting a workspace deletes its links, media, members, events and visitors. If it has a subscription, this happens once the subscription ends. - When an expiring link expires, the link and its analytics are deleted. - Unused free workspaces are deleted: those with no email after 7 days, or unverified with no visits after 21 days. - Visits beyond your plan's allowance are kept but hidden until your plan allows more. ### Security - Encryption in transit with HTTPS (TLS certificates from Let's Encrypt). - Passwords stored as bcrypt hashes. - Multi-factor authentication by email code, which a workspace can enforce. See [how to activate MFA](https://linkbreakers.com/help/article/how-do-you-activate-mfa-in-linkbreakers). - [Workspace roles](https://linkbreakers.com/help/article/what-are-the-workspace-roles-in-linkbreakers): Viewer, Admin and Tech. - Credentials of connected integrations (OAuth tokens) are encrypted. ### Hosting and subprocessors Linkbreakers runs in the United States: DigitalOcean (SFO3), CockroachDB on Google Cloud (us-west2), Redis on AWS (us-west-1), Cloudflare R2 (Western North America) and Grafana Cloud (US). Transfers from the EEA, the UK and Switzerland rely on safeguards such as the Standard Contractual Clauses. The full list of service providers is in the "Who we share information with" section of the [Privacy Statement](https://linkbreakers.com/privacy). ## Limits and caveats - **Deleting a visitor is not a full erasure.** It removes the profile and its attributes, but the visitor's scan events and devices, including the IP address at Basic and Advanced, are kept and only unlinked from the profile. - **Lowering the collection level only affects future scans.** It does not remove data already collected. - **IP addresses are personal data** and are stored in full at Basic and Advanced. Use None if you do not need them. - **The `linkbreakers.browser` cookie is set at every level.** Assess whether your use requires consent under the ePrivacy rules in your visitors' countries. - **No EU data residency.** All data is hosted in the United States. - **No consent management or automated retention.** You collect consent and decide when to delete data yourself. ## Frequently asked questions ### Is Linkbreakers certified GDPR compliant? No. There is no official GDPR certification that Linkbreakers holds. This page describes what the product does so you can assess it for your own use. ### Do you provide a Data Processing Agreement? Contact [support@linkbreakers.com](mailto:support@linkbreakers.com) with your data protection questions and requirements. ### Can I use different privacy settings for different links? Yes. The data collection level can be set for the workspace and per link. ### What happens to analytics when I delete a visitor? The visitor profile and its attributes are deleted. The scan events and devices remain in your analytics, unlinked from the profile. ### Does Linkbreakers transfer data outside the EU? Yes. Data is hosted in the United States, and transfers rely on safeguards such as the Standard Contractual Clauses. ### How long is data kept? As long as your workspace exists, unless a link expires or you delete visitors or the workspace. See the retention section above. ### Who do I contact about data protection? Write to [support@linkbreakers.com](mailto:support@linkbreakers.com). Linkbreakers is a French company, and the supervisory authority in France is the CNIL. ## Sources - [Linkbreakers Privacy Statement](https://linkbreakers.com/privacy) - [Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [CNIL: controllers and processors](https://www.cnil.fr/en/obligations-and-responsibilities-controllers-and-processors) - [European Commission: Standard Contractual Clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) ## Last reviewed October 24, 2026.