Privacy Policy

Last updated: September 17, 2026

Contents

  1. 1. Data Controller
  2. 2. Data We Collect
  3. 3. Purpose and Legal Basis
  4. 4. Cookies and Tracking
  5. 5. Third Parties
  6. 6. Data Retention
  7. 7. Your GDPR Rights
  8. 8. Security
  9. 9. Policy Changes
  10. 10. Contact

1. Data Controller

The data controller for your personal data is:

Kortilink
Website: kortilink.com
Email: privacidade@kortilink.com
Headquarters: Lisbon, Portugal

By using our services, you accept the practices described in this Privacy Policy.

2. Data We Collect

2.1 Data you provide directly

  • Name and email address (when creating an account or contacting us)
  • Profile information (username, profile photo, bio)
  • Payment information (processed by Stripe — we do not store card data)
  • Content you create on the platform (links, Bio Pages, UTM tags)

2.2 Automatically collected data

  • IP address and approximate location (country, city)
  • Device type, operating system and browser
  • Pages visited, links clicked and session duration
  • Click data on shortened links (including referrer, country, device)
  • Cookies and session identifiers (see section 4)
  • On Bio Pages, visits and clicks are counted without cookies and without storing the IP address: the IP is only used to find the country and is not recorded with the visit

2.3 Data obtained from third parties

  • If you sign in with Google OAuth: name, email and profile photo from your Google account
  • If you sign in with Facebook OAuth: name, email and profile photo from your Facebook account

3. Purpose and Legal Basis

We process your personal data for the following purposes and legal bases under the GDPR (General Data Protection Regulation — EU 2016/679):

  • Service provision — necessary for the performance of a contract (Art. 6(1)(b))
  • Account management and authentication — necessary for the performance of a contract (Art. 6(1)(b))
  • Billing and payments — necessary for the performance of a contract (Art. 6(1)(b))
  • Analytics and service improvement — legitimate interest (Art. 6(1)(f))
  • Marketing communications — with your consent (Art. 6(1)(a))
  • Compliance with legal obligations — legal obligation (Art. 6(1)(c))

4. Cookies and Tracking Technologies

We use cookies and similar technologies to ensure the correct functioning of the platform, remember your preferences and analyse service usage. See our Cookie Policy for detailed information.

You can manage your cookie preferences at any time in your browser settings or through our consent management tool.

5. Third Parties and Subprocessors

To provide the service we rely on the following sub-processors. Each one processes only the data it needs for its role:

Sub-processorWhat forWhere
Hetzner Online GmbHServer and database hostingEuropean Union
Cloudflare, Inc. (R2)Storage of the photos, videos and audio you publishEU / USA
Stripe Payments Europe, Ltd.Payments (we do not store card data)Ireland / USA
Resend, Inc.Sending emails (verification, password recovery, notices)USA
Twilio Inc.Sending SMS, when usedUSA
Google LLCGoogle sign-in, Google Analytics (only with your consent), AI assistant (Gemini)USA
Anthropic PBCAI assistantUSA
Functional Software, Inc. (Sentry)Technical error loggingUSA / EU
ip-api.comApproximate country from the IP address of whoever clicksoutside the EU
Meta, Apple, TikTok, TwitchSign-in with that account, only if you choose itUSA

For transfers outside the European Economic Area we rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses, depending on the provider.

We do not sell your personal data.

Nas transferências para fora do Espaço Económico Europeu apoiamo-nos no Quadro de Privacidade de Dados UE-EUA ou nas cláusulas contratuais-tipo, conforme o fornecedor.

Não vendemos os seus dados pessoais.

6. Data Retention

We keep data only for as long as it is needed:

7. Your Rights under GDPR

As a data subject residing in the EU/EEA, you have the following rights:

To exercise any of these rights, contact us at privacidade@kortilink.com. We will respond within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority — in Portugal, the CNPD (National Data Protection Commission): www.cnpd.pt.

8. Security

We protect your data with:

In the event of a data breach that puts your rights at risk, we notify the Portuguese data protection authority (CNPD) within 72 hours and inform you without undue delay.

9. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will change the "last updated" date at the top of the page. For significant changes, we will notify users by email or through a prominent notice on the platform.

We recommend that you review this policy regularly to stay informed about how we protect your data.

10. Contact

For questions about privacy, data protection or to exercise your rights:

Kortilink — Privacy

Email: privacidade@kortilink.com
General support: suporte@kortilink.com
Headquarters: Lisbon, Portugal

You may also lodge a complaint with the Portuguese data protection authority (CNPD) at cnpd.pt.

Pode também apresentar reclamação à Comissão Nacional de Proteção de Dados (CNPD), em cnpd.pt.