--- title: "Privacy Statement" description: "How Linkbreakers collects, uses and protects personal information about its customers, website visitors and the people who scan their QR codes." canonical: "https://linkbreakers.com/privacy" last-updated: 2026-10-28 --- # Privacy Statement > How Linkbreakers collects, uses and protects personal information about its customers, website visitors and the people who scan their QR codes. This Privacy Statement explains what personal information Linkbreakers collects, why, who we share it with, how long we keep it and what rights you have. The terms used here have the same meanings as in our [Terms of Service](/terms). ## Who we are Linkbreakers is a French private company (registration number 531 252 252, EU VAT number FR14531252252), located at 30B Rue de l'Or, 33470 Gujan-Mestras, France. You can reach us about privacy at [support@linkbreakers.com](mailto:support@linkbreakers.com). This statement covers three groups of people: - **Customers:** people who create an account, use the dashboard, the API, the SDKs, the command-line interface, the MCP server or the Assistant. For their data, Linkbreakers is the data controller. - **Website visitors:** people who browse linkbreakers.com. For their data, Linkbreakers is the data controller. - **Visitors of our customers:** people who scan a QR code or open a link created with Linkbreakers, and see the pages our customers build. For their data, the customer who created the link is the data controller, and Linkbreakers processes it on that customer's behalf. ## Information we collect about customers - **Account information:** your email address, your first and last name, your password (stored only as a bcrypt hash) or your Google or Microsoft sign-in identifier, and whether you verified your email. - **Workspace information:** your workspace's name, its members and their roles, your language, timezone and country, and the links, QR codes, forms, workflows, media and other content you create. - **Security and usage information:** the date of your last sign-in, the IP address you last used to sign in and the IP address that last used each API token, as well as logs of requests to our services. - **Billing information:** your plan and subscription. Payment details are collected and stored by Stripe, not by us. - **Support and Assistant conversations:** the messages you send to our support team and to the in-product Assistant, and the Assistant's answers. - **Marketing attribution:** how you found us (campaign parameters, referrer and ad click identifiers) when you sign up. ## Information we collect about website visitors Our website analytics use Plausible, which sets no cookies and does not identify you. With your consent where it is required, we also use the Meta Pixel and Google Tag Manager to measure our advertising and record how you found us, and PostHog to record how visitors use our pages (session recordings, with every form field masked) and to test changes to them. See [Cookies](#cookies) below. ## Information processed for our customers' visitors When someone scans a QR code or opens a link created with Linkbreakers, we process the following on behalf of the customer who created it. Each customer chooses a data collection level (None, Basic or Advanced) for their links. - **At every level:** the time of the scan, the link that was opened and where it led, and the steps of the customer's workflow the visitor went through. We also set the `linkbreakers.browser` cookie, which lets us recognize the same browser when it scans again (see [Cookies](#cookies)). - **At the Basic and Advanced levels:** the IP address, the browser's user agent, the device type, brand and model, the browser and operating system and their versions, the language and timezone, and the approximate location derived from the IP address (country, region and city, and the network provider). - **At the Advanced level:** technical characteristics of the device, such as screen size, graphics card, memory, number of processor cores, touch support and network information. - **What visitors enter:** the answers visitors type into a customer's forms, such as an email address, phone number or name, and any other attribute the customer asks for. - **Precise location, only with the visitor's permission:** when a customer's link includes a location request, the page asks the visitor to share their location. Only if the visitor agrees in their browser do we record the latitude, longitude and accuracy their device reports. Visitors can refuse or skip it, and can withdraw the permission at any time in their browser settings. We never read precise location any other way. If you are a visitor and want to exercise your rights over this data, contact the business that showed you the QR code or link: it decides what is collected and why. If you contact us instead, we will forward your request to that business. ## How we use information We use information to: - provide, operate and secure the Services, including signing you in, sending service emails, processing payments and detecting abuse such as phishing links (performance of our contract with you, and our legitimate interest in keeping the Services safe); - provide support and improve the Services, including reviewing Assistant conversations to improve its answers (our legitimate interest); - understand how the Services are used, with product analytics and error monitoring (our legitimate interest); - measure and target our advertising, including on Meta (your consent where it is required, otherwise our legitimate interest, which you can object to at any time); - comply with our legal obligations, for example for invoicing and tax. We do not sell personal information. ## Who we share information with We share information with service providers that process it on our behalf, only as needed for the purposes above: - **Hosting and infrastructure:** DigitalOcean (application hosting), Cockroach Labs on Google Cloud (database), Redis (cache), Cloudflare (storage of media and QR code images, domains and network) and Grafana Labs (logs and monitoring). - **Authentication:** Google Firebase, for sign-in with Google or Microsoft. - **Payments:** Stripe. - **Email:** Postmark, for service emails. - **Analytics and monitoring:** Mixpanel (product analytics), Sentry (error monitoring, including recordings of some dashboard sessions to understand errors), PostHog (product analytics and session recordings, hosted in the United States) and Plausible (website analytics). - **Customer relationship and support:** HubSpot (customer records) and Help Scout (support conversations). - **Advertising:** Meta and Google. For customers, we may share a hashed (unreadable) version of your email address with Meta to measure our advertising and reach similar audiences. - **AI:** OpenRouter, which forwards Assistant requests to AI model providers such as OpenAI and Google, and OpenAI, which summarizes the answers visitors give to a customer's forms. For the Assistant, we only use providers that do not retain prompts or use them to train their models. - **Internal collaboration:** Slack, where our team receives copies of Assistant conversations to review and improve the Assistant. - **Security:** Google Safe Browsing, which receives the destinations of links to check them for malicious content. Customers can also connect integrations, such as Slack, Google Forms or webhooks to tools like Zapier or Make. When they do, we send data to those tools on their instructions. We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition of our business. ## International transfers Our servers and most of our service providers are located in the United States. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to countries that do not offer an adequate level of protection, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission. ## How long we keep information - **Account and workspace data:** for as long as your workspace exists. When you delete a workspace, its links, media, members, visitors and analytics are deleted. If the workspace still has a subscription, they are deleted once the subscription ends. - **Unused workspaces:** a free workspace that has no email address after 7 days, or that never verified its email and never received a visit after 21 days, is deleted. A workspace created by an AI agent and not claimed within 24 hours is deleted. - **Expiring links:** when a link expires, the link and its analytics are deleted. - **Visitor data:** for as long as the customer keeps it, precise location included. Customers can delete a visitor's profile at any time; the scans of that visitor are then kept only without the link to their profile. Visits beyond a plan's allowance are kept but hidden until the plan allows more. - **Logs and backups:** for a limited time, after which they are deleted or overwritten. - **Billing records:** for as long as tax and accounting law requires. ## Security We protect information with encryption in transit (HTTPS), password hashing, optional multi-factor authentication that workspaces can enforce, role-based access within workspaces, and encryption of the credentials of connected integrations. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. ## Your rights If you are in the European Economic Area, the United Kingdom, Switzerland or another region with similar laws, you have the right to: - access the personal information we hold about you and get a copy of it; - correct it if it is inaccurate; - have it deleted; - restrict or object to its processing, including for advertising; - receive it in a portable format; - withdraw your consent at any time, where we rely on consent. To exercise these rights, contact us at [support@linkbreakers.com](mailto:support@linkbreakers.com). You can also update most of your information in the dashboard and delete your workspace yourself. You have the right to lodge a complaint with a data protection authority, in France the CNIL ([cnil.fr](https://www.cnil.fr)). ## Cookies Cookies are small files a website stores in your browser. ### On linkbreakers.com **Always set:** - `lb-consent` remembers whether you accepted or refused cookies, for six months. - `client-preferences` remembers your language, for one hour. - Your light or dark theme choice is kept in your browser's local storage. - Campaign parameters from the link you arrived on (such as `ref` or `utm_source`) are kept in your browser's session storage so they reach our sign-up page. They are cleared when you close the tab. **Set only after you accept, if you are in the European Union, the European Economic Area, the United Kingdom or Switzerland:** - `client-origin` records how you first found us (campaign, referrer, ad click identifier) so we can attribute a sign-up to the right campaign. It lasts one year. - Meta Pixel (`_fbp`) and Google Tag Manager (`_ga` and related cookies) measure the performance of our advertising. - PostHog (`ph_..._posthog`, shared with app.linkbreakers.com) records how you use the site, with form fields masked, so a visit can be followed into sign-up, and assigns the version of a page you see when we test one. It lasts one year. Elsewhere, these are set without asking. You can refuse or change your choice at any time with "Cookie preferences" at the bottom of every page; refusing deletes the cookies above that we can reach. ### In the dashboard The dashboard at app.linkbreakers.com keeps your session and preferences in your browser's local storage. Mixpanel and Sentry store identifiers there too, to measure product usage and diagnose errors. PostHog records product usage and sessions with form fields masked, under the same consent rule as the website: if you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, only after you accepted cookies on linkbreakers.com. ### On links and QR codes When someone scans a QR code or opens a link created with Linkbreakers, we set the `linkbreakers.browser` cookie on the link's domain. It lasts one year and lets the customer's analytics recognize a returning browser. It is not used for advertising. ## Children The Services are intended for businesses and professionals and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it. ## Links to other sites Our Services contain links to other sites, and our customers' links lead to sites we do not operate. We are not responsible for their content or privacy practices, so we advise you to review their privacy policies. ## Changes to this Privacy Statement We may update this Privacy Statement from time to time. We post the new version on this page and update the date above, and we notify customers by email or in the dashboard before material changes take effect. ## Contact us If you have any questions about this Privacy Statement or how we handle your information, contact us at [support@linkbreakers.com](mailto:support@linkbreakers.com). Last updated: 2026-10-28 --- Source: https://linkbreakers.com/privacy