Privacy Policy
Version 1.0.6 — Last updated: 13 November 2026
This Policy explains how LynkHUB handles information about account holders, visitors and people who contact us.
Karam Guliyev, an individual trading as LynkHUB, at Office 20882, 182-184 High Street North, London, E6 2JA, United Kingdom, is the controller for the processing described here, except where another role is explained for a particular service.
Contact us at [email protected] about privacy, requests or complaints.
1. Information we process
| Category | Examples |
|---|---|
| Account and profile | Email, authentication-provider ID, name, username, profile image, account status and information you choose to publish |
| Links, QR and NFC | Destinations, titles, configuration, relevant identifiers and separately approved NFC access/invitation status, and for beta NFC cards which card was given and any delivery details you provide |
| Wallet pass | Permanent public pass code; while a pass is installed in Apple Wallet, its device's Wallet registration (device library identifier and push token), used only to update or void that pass; for Google Wallet, whether and when you saved the pass |
| Product analytics | Views, clicks, QR scans/resolutions, NFC events where enabled, Wallet pass scans, event time and relevant target, approximate geography, device category, browser, OS, referrer domain, limited UTM attribution and a random pseudonymous visitor identifier; consent-based product/web usage analytics |
| Billing and contract | Plan, invoices, billing contact/location, payment status, transaction references, accepted terms and purchase disclosures |
| Support, safety and legal matters | Messages, reports, relevant evidence, decisions, complaints and dispute records |
| Technical and security | Request, network, authentication and security records needed to operate and protect the service |
Information comes from you, your activity on LynkHUB, authentication/payment/infrastructure providers, or people submitting relevant reports. If you use Google sign-in, we receive the account information authorised for that sign-in. We do not require a date of birth for ordinary signup.
Paddle.com, our reseller and Merchant of Record, processes orders and payment details as an independent controller under its own privacy notice; we receive the order, subscription, payment-status and billing-country information needed to provide your plan. Earlier payments were processed by Stripe; their records are kept as described in section 7. We do not store full payment-card numbers or security codes in the LynkHUB application.
Do not send sensitive personal information unless necessary for your request. Reports may incidentally contain sensitive or criminal-offence information; we limit its use, access and retention and apply any additional legal condition required.
2. Why we use information
| Purpose | UK lawful basis |
|---|---|
| Create/manage accounts and provide requested service features | Contract or steps requested before a contract |
| Manage subscriptions, payments and contract records | Contract; legal obligation for required records |
| Limited server-side product analytics | Legitimate interests in providing service metrics to account holders |
| Analytics visitor cookies and PostHog product/web analytics | Consent |
| Necessary security, fraud prevention and reliability | Legitimate interests in a secure, reliable service; legal obligation where applicable |
| Respond to support, privacy requests, complaints and safety reports | Contract, legitimate interests or legal obligation, depending on the request |
| Administer separate NFC invitations/access | Steps requested before service or legitimate interests in administering access |
| Supply and replace beta NFC cards, including any delivery details | Contract |
| Meet legal obligations and establish or defend claims | Legal obligation or legitimate interests, with additional conditions for sensitive data where required |
Where we rely on legitimate interests, we balance the purpose against the rights and interests of the people concerned. Optional browser analytics is not treated as necessary security processing.
We use automated signals for reliability, fraud and abuse detection, with human review for permanent or similarly high-impact account decisions. We do not use solely automated decisions producing legal or similarly significant effects without appropriate disclosure and safeguards.
3. Public content and third-party sites
Profiles, links and other information you choose to publish can be seen, copied, shared or indexed by others. Account holders are responsible for the information they publish and destinations they select.
Linked websites operate under their own privacy practices. This Policy does not describe what those independent sites do after you leave LynkHUB.
4. Analytics and cookies
LynkHUB uses first-party product analytics to measure service activity and provide account holders with aggregate metrics, including visits and interactions through direct redirects even when no LynkHUB page is viewed. Owners do not receive raw visitor identifiers or individual visitor histories. Unique visitors, views and clicks are estimates.
A random visitor identifier is pseudonymous, not a name or a guarantee of anonymity. We do not link it to your email or signed-in account for visit estimation. We limit referrer information to the domain and filter attribution values to avoid collecting identifying or sensitive query information.
We may transiently process limited network and browser information, including IP address and device/browser information, for security, approximate country/region and estimating unique visits. Raw IP addresses are not intentionally stored in LynkHUB product analytics records. Approximate geography and normalized device/browser/OS information may be retained for those metrics. Separate necessary networking/security processing may include temporary security logs.
PostHog provides analytics solely for LynkHUB's own product and website use. PostHog and our first-party analytics visitor cookie require your choice to Allow Analytics. You can choose Reject Analytics or Allow Analytics where offered and change your choice through Cookie Settings. Rejecting analytics keeps PostHog off and removes the analytics visitor cookie where available; limited server-side product analytics may continue where available. In V1, non-essential analytics, including these server-side metrics, is unavailable for EEA visits or unreliable location results; links and other permitted functionality can still work.
We do not sell personal information or analytics, share them for advertising audiences, use advertising or cross-site tracking, retarget visitors or build third-party advertising audiences. We do not match identities across unrelated services or use visit data for unrelated profiling.
Browser Do Not Track signals do not change our practices. Cookie Settings lets you reject analytics, and we honour other opt-out signals where legally required. See the Cookie & Analytics Notice for storage and choice details.
5. Who receives information
We use providers for hosting, authentication, databases/storage, payments, email, security and support, and PostHog for consent-based product/web analytics. They receive the information needed for their functions, under appropriate terms. Payment providers may also process information for their own legally required fraud, financial and compliance purposes.
If you add a LynkHUB pass to Apple Wallet, the pass is stored by Apple Wallet on your device. We use Apple's push notification service to tell your device that the pass has changed. We send the device's push token and an empty notification, with no pass content.
If you add a LynkHUB pass to Google Wallet, we send Google the pass content (your name, username, profile link and permanent QR link) through the Google Wallet API so Google can store, show and update the pass. When your name or username changes we update the pass, and when you delete your account we tell Google to expire it.
We may disclose relevant information to professional advisers, authorities or courts when lawfully necessary for compliance, claims, safety or security. Information may be shared with a business successor or advisers during a genuine transaction, with appropriate safeguards.
Reporter information is restricted. Some legal processes require disclosure, such as forwarding a statutory copyright counter-notice to the complainant; the relevant process explains that disclosure.
6. International transfers
We are based in Azerbaijan, and our providers process information in the UK, the EU, the US and other countries. Where required, we use lawful safeguards such as adequacy arrangements, the UK International Data Transfer Agreement or approved contractual clauses with the UK Addendum. Contact us for information about safeguards relevant to a transfer.
7. Retention and deletion
| Information | Normal retention |
|---|---|
| Account, profile and configuration | While the account operates, followed by necessary cleanup |
| Wallet device registration | While the pass is installed; removed when your device tells us you removed the pass, Apple reports its push token is no longer valid, or, after account deletion, we send your device the update list for the voided pass |
| Google Wallet pass | Stored by Google while it is in your Google Wallet; after account deletion we tell Google to expire it |
| Raw product analytics | Up to 24 months, with earlier removal when required or no longer needed |
| Historical summaries | While needed for the account's history feature; longer retention only if truly anonymous or otherwise lawfully justified |
| Analytics choice / browser visitor cookie | Normally six months / up to twelve months from creation respectively |
| Temporary server-side visit-recognition data | Up to seven days after last use |
| Ordinary security/authentication logs | Up to 90 days, unless needed for a specific incident |
| Support, privacy, safety and payment-dispute records | Normally up to 24 months after closure |
| NFC access records | While needed for access and normally up to 24 months after access ends for justified support/security purposes; stale requests removed when no longer needed; delivery details for a beta card only as long as needed to supply it and handle a related replacement |
| Accounting records | Normally six years from the relevant financial-year end |
| Minimal contract and renewal-consent evidence | Six years after the relationship ends for legal obligations and claims |
| Protected backups | Normally expire within 90 days |
We keep only relevant information for longer where a specific legal obligation, security matter, dispute or claim justifies it. We review such retention and do not use retained records to restore a deleted account or for unrelated marketing.
Final account deletion confirmation immediately disables the account, profile, managed links, QR, NFC and Wallet pass, revokes sessions and stops future renewal. Cleanup of active data and processor records follows in the background. Limited lawful records and protected backups may remain temporarily.
Withdrawing analytics consent stops new consent-based collection and leads to erasure or anonymisation of reasonably linkable consent-based personal events unless a separate lawful retention ground applies. Limited server-side product analytics may continue where available, and truly anonymous totals may remain. If your browser no longer holds the identifier, we may be unable to locate particular events; we do not link visit identifiers to your account or email to locate them.
8. Your rights and requests
Depending on applicable law, you may request access, correction, deletion, restriction or a portable copy of information; object to legitimate-interest processing; or withdraw consent without affecting earlier lawful processing.
Email [email protected]. You may also edit available account fields or use account deletion. We verify identity proportionately and do not require the product deletion button to exercise a legal right.
We handle UK rights requests without undue delay, normally within one calendar month. A lawful extension may be used with notice. If we cannot fully comply, we explain the reason and available complaint or appeal routes. Other mandatory local privacy rights remain available where applicable.
You may complain about our handling of your information through the same email. We acknowledge privacy complaints within thirty days, investigate appropriately and communicate progress and the outcome without undue delay.
You may also complain to the UK Information Commissioner's Office or another competent regulator. Contacting us does not remove that right.
9. Age, security and changes
LynkHUB accounts are 18+. The service is general-audience and not directed to children. We do not knowingly permit under-18 accounts. Contact us if you believe an underage account exists or a child's information has been processed improperly; we investigate and take appropriate restriction/deletion or other legally required action.
We use reasonable security measures, including access controls and provider safeguards, but no online service can guarantee absolute security.
We update this Policy when our practices change. Material changes receive appropriate notice and fresh consent where required. The version and revision date identify this wording.