Privacy Policy

This Privacy Policy explains how Linkwards, operated by Burtlett Zikonde in South Africa (“Linkwards”, “we”, “us”, “our”), collects, uses, shares and protects personal information when you use linkwards.com, the customer app at app.linkwards.com, our free tools, and the public Pages that our customers publish at linkwards.com/username (together, the “Service”). It also explains the rights and choices you have.

We try to comply with the Protection of Personal Information Act, 2013 (POPIA) in South Africa, and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR) and similar laws elsewhere.

1. Who is responsible for your information

There are two different situations, and it matters which one you are in:

If you have a Linkwards account (a “customer”), or you contact us or use our website, Linkwards is the responsible party (controller) for your information. This policy applies directly.
If you are a visitor to a customer’s Page and you send a booking request, join a newsletter list, or just browse, the customer who owns that Page decides why and how your information is used and is the responsible party for it. Linkwards acts as their operator (processor) and handles the information on their behalf. Section 5 explains what is collected on public Pages. If you want to access, correct or delete information you gave to a customer, contact that customer first. You can also contact us and we will pass the request on.

Contact for privacy matters: support@linkwards.com (please put “Privacy request” in the subject line). Our Information Officer is Burtlett Zikonde.

2. Information we collect about our customers

Information you give us

Account details: your email address, password (stored by our authentication provider in hashed form; we never see it in plain text), first name, last name, country and, where requested at sign-up, gender. You may also add a phone number to your account details.
Page and business details: your brand or business name, category, bio, location text, status label, call-to-action labels, accent colour and layout choices, and your page address (slug).
Content you upload or enter: hero image or video, logo or profile photo, media library files, service cards (titles, descriptions, prices, images), content cards (links and thumbnails), strips, testimonials (quotes, author names and titles, ratings), locations and addresses, contact details (phone, WhatsApp, email), social profile and custom links, and SEO titles, descriptions and keywords. Files you upload are stored in a storage bucket where files you use on your Page are publicly accessible by their link.
Settings: notification and report preferences, booking settings (including how long you keep booking requests), newsletter settings, and any Google Analytics (GA4) or Meta Pixel identifiers you choose to add.
Support messages: messages you send through the in-app support inbox or by email, and our replies and internal notes about your case.
Consent records: the version of our Terms of Service and Privacy Policy you agreed to, and when.

Information collected automatically

Sign-in and security data: authentication and session information, including the time of your last activity, and information used by bot protection (Cloudflare Turnstile) at sign-up and login.
Usage and diagnostic data: actions you take in the app that are needed to operate it (for example, onboarding progress, completed product tour, notifications you have read) and technical logs from our hosting and database providers, which may include IP address, browser type, device type and timestamps.
Notifications: in-app notifications we generate for you (for example, new booking requests or milestones).

Billing information

Payments are handled by our payment provider and merchant of record, Lemon Squeezy. They collect your payment details and billing information (such as name, billing address and tax details) under their own privacy policy. We receive information about your subscription (such as your plan, subscription ID, status and renewal or cancellation events) and may receive limited payment information (such as invoices or the last digits of a card), but we do not receive or store your full card number.

Information from our website and tools

Marketing site: we use Google Analytics on linkwards.com to understand how visitors use our site (pages viewed, approximate location, device and browser information, and interactions). See our Cookie Policy.
Contact form: if you contact us through the form on our website, we receive your name, email address, topic and message, and we send them to our support inbox by email.
Free tools: the tools at linkwards.com/tools are designed to work in your browser. Images, PDFs, audio and text you put into a tool are processed on your device and are not uploaded to our servers. Some tools download software or model files from third-party hosts when you first use them, and those hosts may receive technical information such as your IP address.

3. Why we use information, and our legal basis

To provide the Service (create and host your account and Page, process billing events, deliver notifications, provide support). Basis: performing our contract with you.
To communicate with you about your account, trial, billing, security, and changes to the Service, and to send emails you ask for (such as milestone alerts, new-subscriber alerts and weekly or monthly analytics reports, which you can switch off in your notification settings). Basis: contract and our legitimate interests.
To keep the Service safe (detect fraud, spam, abuse and security incidents, enforce our Terms, and keep audit logs of administrative actions). Basis: legitimate interests and legal obligations.
To understand and improve the Service (analytics, troubleshooting, product decisions). Basis: legitimate interests and, where required, consent.
To meet legal and accounting obligations and to establish, exercise or defend legal claims. Basis: legal obligation and legitimate interests.
To tell you about Linkwards (product news and offers) where the law allows. You can unsubscribe at any time. Basis: consent or legitimate interests, depending on where you live.

We do not sell your personal information. We do not use your content or your visitors’ information to train AI models. We do not make decisions about you that have legal effect using solely automated processing.

4. Support staff access

Our team uses an internal administration tool. Access is invite-only, split into roles, protected by mandatory multi-factor authentication, and every administrative action is written to an audit log. Staff can look up accounts, see account and plan details, view and reply to support conversations, and apply approved changes. Staff may also open a time-limited “view as customer” session, for which a reason is recorded; these sessions are clearly marked inside the app and are designed so that they do not expose your visitors’ booking requests, newsletter subscriber lists or analytics data. Staff only access information that they need for their role.

5. Information collected from visitors to a Page

When someone visits a customer’s Page, we collect the following on the customer’s behalf:

Page analytics. We record page views and interactions (such as clicks on buttons, cards, links and contact options, scroll depth, newsletter sign-ups and when certain items are shown on screen). Each event is stored with a random session identifier generated in your browser for that browsing session, the page owner, the referring website, device type (mobile, tablet or desktop), browser name, campaign tags in the link (UTM parameters, if present), and your approximate country, which our hosting provider derives from your IP address when you load the page. We do not store your IP address in the analytics record. We delete analytics events after about one year.
Booking requests. If you submit a booking request, we store the details you enter: your first name and surname, the service or topic you are asking about, the date and optional time you request, and your phone number and/or email address if you provide them, together with the status of the request. The customer is notified and sees the request in their dashboard. If you tick the optional box saying you want news, offers and updates from that business, your email address is also added to that customer’s newsletter list. The box is never pre-ticked.
Newsletter sign-ups. If you subscribe through a customer’s newsletter section, we store your email address and the time you subscribed for that customer.
Tracking set up by the customer. Customers on eligible plans may add their own Google Analytics (GA4) or Meta Pixel to their Page. Those tools are run by Google and Meta, set cookies or similar identifiers, and are controlled by the customer, not by Linkwards. See our Cookie Policy.
Content and links. Pages may link to or display third-party content (for example, videos, social profiles, maps links, booking and payment links, and review links). When you follow those links you leave Linkwards and the other site’s privacy practices apply.

To unsubscribe from a customer’s list, ask the customer directly. To ask us to remove your details from a Page you did not intend to share with, or to report misuse, email support@linkwards.com.

6. Who we share information with

We share personal information only as described here:

Service providers (sub-processors). We use trusted companies to run the Service, including database, authentication and file storage (Supabase), hosting and delivery (Vercel), payments and subscription management (Lemon Squeezy), transactional email (Resend), bot protection (Cloudflare Turnstile), website analytics (Google), and a status page (Instatus). Our current list is on the Sub-processors page. They may only use information to provide services to us and under written terms.
Our customers. When you contact a customer through their Page, your details go to that customer.
The public. Anything a customer publishes on their Page is public, including their business name, text, images, links, contact details, testimonials, locations and the address of the Page. Search engines may index public Pages.
Legal and safety. We may disclose information if we believe it is required by law, regulation, court order or a valid request from authorities, or necessary to protect the rights, property or safety of Linkwards, our customers, visitors or the public, to investigate fraud or abuse, or to enforce our Terms.
Business changes. If Linkwards is involved in a merger, acquisition, restructuring or sale of assets, information may be transferred as part of that transaction, and we will make sure it remains protected by commitments at least as strong as these.
With your consent or at your direction, for example if you ask us to share information with someone.

7. International transfers

Linkwards is operated from South Africa. Our primary database and file storage are hosted by Supabase in the United Kingdom (London), and our other providers operate globally, which means your information may be processed in countries other than where you live, including the United Kingdom, the European Economic Area and the United States. Where we transfer personal information across borders, we do so in line with POPIA and other applicable laws, for example by relying on providers that are bound by agreements and standard contractual clauses providing an adequate level of protection, or on your consent or the performance of our contract with you.

8. How long we keep information

The details are on our Data Retention and Deletion page. In summary:

Account and Page data is kept while your account exists. If you delete your account, your Page goes offline immediately and your data is permanently deleted after a 30-day grace period.
Page analytics events are deleted after about one year.
Booking requests are deleted automatically: resolved or already-viewed requests after the retention period the customer chose (30 to 180 days, 90 days by default), and every request no later than 180 days after it was made.
Read in-app notifications are deleted about 30 days after they were read.
Billing records are kept by our payment provider and by us for as long as tax, accounting and legal rules require.
Security and administrative audit records may be kept longer to protect the Service and show accountability.

9. How we protect information

We use reasonable technical and organisational safeguards, including encrypted connections (HTTPS), row-level access controls in our database so customers can only reach their own data, separate credentials for server-side operations, bot protection on sign-up and login, mandatory multi-factor authentication for staff, role-based staff permissions, and audit logging. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. If a security compromise affects your personal information, we will notify the Information Regulator and affected people as required by law.

10. Your rights

Depending on where you live, you may have the right to:

ask whether we hold personal information about you and get a copy of it;
ask us to correct, update or complete it;
ask us to delete or destroy it (you can delete your own account at any time from your account settings);
object to, or ask us to restrict, certain processing, including direct marketing;
receive your information in a portable format, where we process it by automated means on the basis of consent or contract;
withdraw consent where we rely on consent (this does not affect what we did before you withdrew); and
lodge a complaint with a regulator.

To exercise a right, email support@linkwards.com. We may ask you to verify your identity first, and we will respond within the time the law allows (generally within 30 days). We may decline requests where the law allows, for example if they are manifestly unfounded or would reveal another person’s information.

South Africa. You may complain to the Information Regulator (South Africa) at inforegulator.org.za. EEA and UK. You may complain to your local data protection authority. California and other US states. We do not sell or share personal information for cross-context behavioural advertising, and we do not knowingly collect information from children. You can ask us to access, correct or delete your information, and we will not discriminate against you for doing so.

11. Marketing and email choices

We send essential service emails (such as account confirmation, password reset, billing, trial and security messages) that you cannot opt out of while you have an account. Optional emails, such as milestone alerts, new subscriber alerts and periodic analytics reports, can be switched on or off in your notification settings. If we send you promotional emails, each one will include a way to unsubscribe.

12. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18 and customers must not use the Service to do so. If you believe a child has given us information, contact us and we will delete it.

13. Cookies and similar technologies

We use cookies, local storage and similar technologies to keep you signed in, remember preferences and measure usage. Details are in our Cookie Policy.

14. Automated tools

Some free tools use AI models that run in your browser to perform tasks such as background removal, text recognition and transcription. They run on your device, and we do not receive the files you process.

15. Changes to this policy

We may update this policy from time to time. When we make a material change we will update the “Last updated” date and, where appropriate, notify you by email or in the app and record your agreement to the new version. Previous versions are available on request.

16. Contact us

Email support@linkwards.com or use our contact page. Linkwards is operated by Burtlett Zikonde, South Africa.