Privacy Policy

1. Controller

The controller (Verantwortlicher) within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature is:

2. Hosting & server location in Germany

This web application is operated on dedicated servers of netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) in German data centers (Nuremberg / Karlsruhe).

When our website is accessed, the web server processes technically required log data (server log files):

• Browser type and browser version
• Operating system used
• Referrer URL (the previously visited page)
• Date and time of the server request
• IP address of the requesting device — truncated before it is written to the log file (for IPv4 the last octet; for IPv6 only the first three of eight blocks are retained), so that no complete IP address that can be uniquely attributed to a single device is stored

Technically, the log files are captured as console output of the application container and rotated automatically: as soon as a log file reaches around 10 MB, a new one is started; a maximum of 3 files per container are kept — older ones are then overwritten automatically. This rotation depends on the file size, not on a fixed number of days; with normal request volume, the actual retention period is, in our experience, in the range of a few days to a few weeks.

If a server error occurs during a request or the application crashes, we additionally record this in an internal error log for troubleshooting: time, type of request, the address accessed without appended parameters (for one-time links without the link key), status code and the technical error message; in individual cases this may contain parts of the data submitted. We do not store the IP address or browser identifier there; we remove email and IP addresses from error messages before storing them. The entries are deleted automatically after 180 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure, stable and performant provision of our web infrastructure). A data processing agreement (Auftragsverarbeitungsvertrag, AVV) pursuant to Art. 28 GDPR has been concluded with the hosting provider.

Data backup: So that no data is lost in the event of a technical failure or error, we back up the database and the stored files daily (at around 3 a.m.), in particular the uploaded profile pictures and other images. The backups are encrypted and stored on our server and, as a copy outside the data center, on storage space of ALL-INKL.COM — Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf; server location Germany, see also Section 6); there they are only held in encrypted form. We keep the backups of the last 7 days in each case; older ones are deleted automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the availability and recoverability of our service; the backup also serves the obligation under Art. 32 GDPR to be able to restore data quickly after an incident).

3. Technically necessary cookies (Section 25(2) no. 2 TDDDG)

Our web app uses up to three strictly technically necessary cookies. The first two are set as soon as our own pages are accessed (e.g. home page, pricing, login), not only after logging in — they are a prerequisite for a login or registration form to be submitted securely at all. The third (linknetz.lang) is only created if you yourself click “DE” or “EN” in the language switcher. On the public profile pages of our users (/name), by contrast, no cookie is set. If a visitor there starts an embedded video or song themselves, the respective platform may set its own cookies in its player; this is the platform’s responsibility and is described in Section 9a.

If you have not chosen a language, we show you pages that also exist in English (such as the home page, pricing, help, login) in English if your browser prefers English over German. For this we read the language setting that your browser sends with every page request anyway (Accept-Language); for this redirect it is only read and not stored. (Independently of this, our reach measurement records the language setting pseudonymously, see Section 8.) Legal texts, the cancellation page, guides (Ratgeber), profile pages and the logged-in area are not redirected.

Since these cookies are purely technically necessary — for protected dashboard access, for protecting the forms against third-party requests and for the language you have chosen —, no consent banner (cookie banner) is required for them pursuant to Section 25(2) no. 2 TDDDG. We do not use tracking cookies, marketing cookies or third-party cookies on Linknetz. Cookies of the platforms of embedded videos and music are only created after you click the play button (Section 9a).

4. Registration & user account

Registration is required to create a Linknetz profile page. The service is aimed at persons aged 18 and over; by registering, you confirm that you are at least 18 years old. The following data is collected and processed in the process:

• Email address: For identification, login, delivery of system and billing notifications and for password reset.
• Password: Is never stored in plain text, but exclusively as a strong cryptographic hash (using salted bcrypt with a high work factor) in our PostgreSQL database.
• Consent to the Terms and Conditions and the Privacy Policy: The time of your consent at registration and the language version of the registration page (German or English) on which you consented, as well as the version (the date) of the Terms and Conditions (AGB) to which you consented — as proof of the effective incorporation of the Terms and Conditions.
• Account language: The language (German or English) in which we show you the logged-in area and the emails about your account. It is taken over at registration from the language version of the registration page, can be changed in Settings and is deleted together with the account.
• Profile name (slug) / desired name: The unique address component for your profile page (linknetz.de/your-name).
• Profile links & profile data: Links, titles, display name and biography entered by the user themselves.
• Design of your profile page: The template you have chosen or your own design (colors, font, button shape, background). The fonts are located on our own server; when your page is accessed, nothing is loaded from third parties. The only exception is embedded videos and music: their player only loads when a visitor themselves clicks the play button (Section 9a).
• Building blocks of your profile page: Headings, texts and the addresses of your social media profiles that you show on your page. An email address that you provide there is publicly visible on your profile page. We count clicks on these profile icons as anonymous daily figures per platform (Section 7); we do not count clicks on an email address.
• Images and link descriptions (with Pro, voluntary): Images that you upload as an image block, as a link’s preview image or as a background image, together with optional alternative text and an optional link on tap, as well as short descriptions of your links. Details on the images in Section 9.
• Embedded videos and music (with Pro, voluntary): For each video or song that you embed on your page, we store the platform (YouTube, Vimeo, Spotify or SoundCloud), the identifier of the content on that platform (such as the video ID) and an optional title. What applies to visitors of your page in this regard is set out in Section 9a.
• Legal notice (Impressum) details (creation with Pro, voluntary): If you enter your legal notice in Linknetz, we store the data you have provided (name or company, address, email address and, where applicable, phone, representation, register entry, VAT ID number, business identification number (Wirtschafts-Identifikationsnummer), person responsible for content) and publish it on the page linknetz.de/your-name/impressum. The page is blocked for search engines (noindex) and sets no cookies. The details remain stored until you change them or delete your account; after Pro ends, the page remains online so that your provider identification does not disappear unnoticed; you can change or delete the details at any time even after that.
• Discoverability in search engines: Your profile page is public. Search engines such as Google may include it as long as you do not switch this off in Settings (default: on). We mark profiles with fewer than two items and, in the first 7 days after registration, as not to be included (noindex), likewise when the switch is turned off. Search engines only remove pages that have already been included on their next visit; we have no influence on this. Only the setting (on/off) is stored; it is deleted together with the account and is included in the data export.

Security log for your account: As long as your account exists, we log security- and contract-relevant events with the time and IP address of the triggering request: logins, changing and resetting the password, changing the email address, Pro orders together with the declarations on the right of withdrawal (Widerrufsrecht) made in the process, a withdrawal (with the name given in it), the subsequent sending of the withdrawal policy in English (only the time and language, without IP address; the time is also stored with your account because your withdrawal period starts again with it, and is deleted there together with your account), cancellations of your Pro subscription with the route (button in Settings, cancellation form or directly at Stripe, i.e. in the Stripe customer portal or by us in the Stripe dashboard) and the day on which Pro ends, the reversal of a cancellation at Stripe (only the time) — cancellations via the cancellation form or at Stripe and reversals without IP address — as well as interventions by our administration in your account (announcement of a suspension and its withdrawal, suspension and unsuspension, termination of your user agreement, hiding and unhiding the profile, deactivating and reactivating links and building blocks, blocking and releasing images, undelivered and resent moderation emails, granting and ending a free Pro activation together with the reason, password reset or confirmation emails triggered by support, viewing your account details, clarification of billing irregularities, handling a cancellation received via the cancellation form, entry by the administration of a cancellation that you declared to us by another route, together with route, date of receipt and note; for these interventions, the stored IP address is that of the administration). Unlike in the server log files (Section 2), in which the IP address is truncated before it is stored, it remains untruncated here for 30 days, because only in this way can an account takeover be traced; after that we truncate it as in the server log files (for IPv4 the last octet; for IPv6 only the first three of eight blocks are retained). Entries on actions of our administration retain the full address; there it is the IP address of the administration, not yours. Purpose: Protection of your account against takeover and misuse, proof of contractual declarations and traceability of administrative interventions. Legal basis: Art. 6(1)(f) GDPR. Storage period: Each entry is automatically deleted 180 days after it was created, even while your account continues to exist – except for the entries on moderation measures (moderation file (Moderationsakte), see below).

Addresses blocked by moderation: If our administration deactivates a link or a building block (including an image block with a link), it can additionally block individual, specifically objected-to target addresses from it (without parameters – except for the identifier of a video, a playlist, a post or a profile on well-known platforms; email addresses excluded). We store these with your account so that, even after deletion, they cannot be added again either as a link or in another profile building block – regardless of whether the blocking (Sperre) originated from a blocked link, a blocked social icons block or the link of a blocked image block. We do not block other addresses of the blocked content. Purpose: Enforcement of the moderation measure. Legal basis: Art. 6(1)(f) GDPR (like the other interventions of our administration). Storage period: until we lift the measure (reactivation or release of the address by our administration) or until your account is deleted; these entries are not subject to the 180-day period of the security log.

Reason for a block: We store the reason that our administration gives when deactivating a link or building block or when blocking an image with the affected content for as long as the measure exists, and delete it as soon as we lift the measure or you delete the content. In addition, it is recorded in the moderation file (Moderationsakte) (see below). Purpose and legal basis: as for the blocked addresses. If we consider content to be unlawful, we state the legal provision to you for each measure (suspension, hiding, deactivation) and explain why, in our view, the content violates it; both are also recorded in the moderation file. Legal basis for this: Art. 6(1)(c) GDPR in conjunction with Art. 17(3)(d) of the Digital Services Act (DSA); insofar as possible criminal offenses are concerned, the processing is covered by this obligation under Union law (Art. 10 GDPR).

Moderation procedure: Before we hide your profile because of a violation, suspend your account or terminate your user agreement, we announce the suspension by email with reasons (which at the same time constitutes a warning notice (Abmahnung)) and give you 7 days to respond; without announcement only if waiting is unreasonable (for example in the case of phishing, malware, criminal content or danger to visitors). This also applies if your account has been suspended for security reasons. After that we withdraw the announcement, hide the profile, suspend the account or terminate the agreement. If a Pro subscription is running, we cancel it together with the suspension at Stripe (Section 5) with effect from the end of the paid term, so that it is not renewed during a suspension for a violation; if we lift the suspension before the end of the current billing period, we reverse this cancellation at Stripe, unless you yourself cancelled during the suspension. For this purpose we note with the account that the cancellation originates from the suspension. If this cancellation is reversed at Stripe during the suspension (for example in the Stripe customer portal), we set it again and review the case. If we terminate the agreement of an account with a Pro subscription, we refund the paid portion from the day on which you can no longer use Linknetz as agreed, for all affected billing periods (even if the subscription has already ended), via Stripe (Section 5); for this we read your paid invoices at Stripe and record the start, status and amount of the refund in the log. If we terminate without prior warning notice (urgent case), the reasons for this are stated in the termination and in the log. A suspension without prior announcement does not count as a warning notice; before a termination we then announce it separately. We end a running Pro subscription immediately at Stripe with the termination. After a termination, the account remains suspended until the end of the agreement (14 days after the termination); on the end date or shortly thereafter (daily run, with a subscription still running up to three days later) we delete it automatically with all content as in the case of an account deletion. For this purpose we store with the account whether and since when an announcement has been running, whether a suspension originates from moderation or from security reasons and whether it was preceded by an expired announcement, as well as the time and end date of a termination. Purpose: fair implementation and enforcement of moderation decisions. Legal basis: Art. 6(1)(b) and (f) GDPR.

Moderation file (Moderationsakte): The entries of the security log on moderation measures (deactivating and reactivating links, building blocks and images, suspension and unsuspension (except for a security suspension), hiding and unhiding the profile, release of blocked addresses, announcement of a suspension and its withdrawal, termination, undelivered, resent and otherwise delivered moderation emails, excluding emails relating to a security suspension) together with the reason, the point of the Terms and Conditions and, where applicable, the legal provision are not deleted after 180 days, but only when no measure exists any longer for your account, at the end of the third calendar year after the most recent of these entries, i.e. after the last measure has been lifted or after the end of the agreement. So that the file remains attributable even after your account has been deleted, each of these entries contains the former account ID, your profile name (slug) and a hash value (SHA-256) of your email address (pseudonymized), not the address itself; the period therefore also runs after deletion from the most recent entry of your former account, or in the case of a termination from the end of the agreement. We use the hash value only to assign to the correct file, after deletion, a complaint, a lawsuit or another claim relating to a moderation decision in which someone contacts us with this email address: we compute the hash value of the stated address and compare it with the stored ones. After 180 days we remove the IP address from these entries. Purpose: Proof of our moderation decisions, handling of complaints and defense against claims until they become time-barred under the regular limitation period (Sections 195, 199 BGB). Legal basis: Art. 6(1)(f) GDPR; until then you cannot demand erasure under Art. 17(3)(e) GDPR.

Undelivered moderation emails: If sending a moderation email to you (or to a person who reported your content) fails, we store the email with its content but without the recipient address until we have resent it or delivered it by another route; after that we delete it after 180 days. Purpose: Fulfillment of our obligation to inform affected persons and reporters about decisions. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16(5) and Art. 17(1) DSA.

Registration process: After submitting the form, you always see the same notice that we have sent you an email; you are not logged in during this. If the address is new, we create the account and send the confirmation email. You can only log in with a confirmed address: you open the confirmation link and log in with your password, which confirms the address. Setting a new password via “Forgot password” also confirms the address. If the address already belongs to an account, we do not create a second one, but send a notice email to it stating that an account already exists there, with links to log in, to request a new confirmation email and to set a new password. The holder of the entered address also receives this email if not they themselves but a third party submitted the form. In this way, only someone who has access to the mailbox learns whether an account exists. For the same reason, the login responds in the same way whether the address is unknown, the password is wrong or the address has not yet been confirmed; in the last case we send a new confirmation email. A new confirmation email can also be requested without logging in via the “Request confirmation email” form, always with the same response. So that no one can flood someone else’s address with such emails, we send per address at most three notice emails per hour and five per day, at most three new confirmation emails per hour and five per day via the form and “Resend confirmation email” in the dashboard, and at most one per hour and five per day from login attempts (separate counter). “Forgot password” also always responds in the same way; we send emails for resetting per address at most three per hour and five per day. For this we count under a pseudonymized check value instead of the address in plain text; spelling variants of the same address (for example with a “+” suffix) are counted together. The counters are deleted at the latest about two days after the time window has expired. If the address already belongs to an account, we block the link name chosen in the form for others for just as long as in the case of a new, never confirmed account: it becomes free again with the daily deletion of unconfirmed accounts as soon as more than seven days have passed since submission. In this way, the link name does not reveal whether the address was new either; only the link name is stored in the process, not the address. So that no one can block link names in large numbers this way, we accept per IP address (for IPv6 only the first 64 bits) at most 30 registrations per day that create an account or reserve a link name; for this we count them per IP address, and the counter is deleted at the latest about two days after the end of the day. Purpose: Protection of account holders against their address being probed and against email floods. Legal basis: Art. 6(1)(f) GDPR.

Changing the email address: You enter a new address while logged in with your password; it only takes effect once you confirm the link that we send to it. Your previous address receives a notice about this. If the new address already belongs to an account, we change nothing and send its holder a short notice without a link and without details about your account; you see the same response as for a free address. We send emails to an address entered in this way (confirmation link or notice) at most three per hour and five per day per address, and per account we accept at most three attempts per hour and five per day (each one counts, including one with a wrong password). We keep the counters as described above. We store the new address until confirmation with the account and at the confirmation link; once the link has been used, replaced by a new request or has expired (after 60 minutes), we delete it – at the latest on the following day. Purpose: Protection of your account and of the holders of other people’s addresses against probing and against email floods. Legal basis: Art. 6(1)(b) and (f) GDPR.

Unconfirmed accounts: If you do not confirm your email address within 7 days and have during this time neither created links nor uploaded a profile picture nor taken out a subscription, we delete the account automatically. Your desired name thereby becomes free again.

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement (Nutzungsvertrag) for the provision of the link-in-bio platform).

5. Payment processing via Stripe

To process paid subscriptions (Pro plan), we use the payment service provider Stripe Inc. (510 Townsend Street, San Francisco, CA 94103, USA or, for customers in the EEA: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland).

As part of the checkout process, payment data (e.g. credit card details, IBAN, name) is processed directly via Stripe's encrypted interface. Linknetz itself never stores complete credit card numbers or sensitive payment secrets, but only a pseudonymous customer and subscription ID (stripe_customer_id, stripe_subscription_id) in order to assign your Pro status.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract (Vertragserfüllung) for billing the booked service). Data is transferred to the USA on the basis of the EU-US Data Privacy Framework (DPF), under which Stripe Inc. is certified, and supplementary standard contractual clauses (SCC) of the EU Commission.

Cancellation via the cancellation form (Kündigungsformular): Via the ‘Cancel contracts here’ page (/en/kuendigen) you can cancel your Pro subscription after logging in. As long as you are not logged in, the page does not set any new cookies. If there is no subscription contract for your account with Stripe (or it has ended) and no free Pro activation, the page only shows a corresponding notice and stores nothing; if a payment is outstanding, it shows the form and we review the cancellation manually. We implement an ordinary termination (ordentliche Kündigung) effective at the earliest possible date immediately at Stripe if the subscription is running, just as with a cancellation via the button in the account settings; the cancellation confirmation with the termination date is sent by email to the address of your account. If you stated a reason, we additionally store the cancellation with the details listed below as already completed, without manual review and without a separate acknowledgment of receipt. All other cancellations (extraordinary (außerordentlich), at a requested date, without a running subscription, shortly after your account was unblocked or your subscription was resumed, or if the immediate implementation fails technically) are reviewed manually by our administration; the same applies to a cancellation via the button in the account settings if its implementation fails technically or if it is received shortly after your account was unblocked or your subscription was resumed. For this purpose we store: the type of cancellation (ordinary or extraordinary), a reason given voluntarily, from your account the name displayed on your profile page (if provided), the email address and the profile address, the requested termination date, the language (German or English; for ‘Cancel contracts here’ the language version of the page, for the button in the account settings your account language), so that we can reply to you in that language, the route (that page or the button in the account settings), the date and time of receipt, the result of the assignment to your account, the processing status, the times at which we sent the emails mentioned below, and, during processing, the confirmed end of the contract or a note on how we confirmed the cancellation. We do not store your IP address with the cancellation. If you submit the same cancellation with identical details again within ten minutes or if your cancellation has already been implemented, we do not store it a second time and do not send another email. To protect against misuse, as with our other forms, we count submission attempts per IP address (for IPv6 only the first 64 bits of the address, so that all addresses of this address block count together) within a time window of one hour; submission attempts with incorrect details are not counted. The counter is then deleted automatically, at the latest after three days.

The details are required: without them we cannot review and confirm the cancellation. If we review a cancellation manually, you will as a rule immediately receive by email (exceptions: the limit per account below and an invalid account address, see “Cancellation by other means”) an acknowledgment of receipt with the content of your cancellation (including any reason given) to the address of your account. If a cancellation remains unprocessed (for example after a restart of our server), we process it again after a few minutes. You give a reason for cancellation voluntarily; if it contains special categories of personal data (for example information about your health), we process it only to review and evidence the cancellation on the basis of Art. 9(2)(f) GDPR (establishment, exercise or defense of legal claims). We acknowledge cancellations after logging in with no more than five acknowledgments of receipt per account within one hour; we nevertheless store and process further ones, our administration reviews them manually and then sends the acknowledgment of receipt stating the time of receipt. For the legacy cases without login (see below), the following also applies so that the form cannot be misused to send mass emails: we automatically send no more than five acknowledgments of receipt to the same address within 24 hours (spellings of the same address, for example with capital letters, a “+” suffix or, with Gmail, with dots, count together); we nevertheless store and process further cancellations, our administration reviews them manually and then sends the acknowledgment of receipt stating the time of receipt. If, across all addresses combined, more than 30 cancellations are received within one hour, we still send the acknowledgment of receipt immediately, but in a short version without your name, your reason and your addresses, and send the full acknowledgment of receipt to the same address afterwards as soon as the limit allows — as a rule within a few hours, otherwise when our administration completes its review; the limit of five acknowledgments of receipt per address within 24 hours also applies to this. If sending fails, we try again. If we review a cancellation manually, our administration confirms the termination date by email to the address of your account, and only once the cancellation has been entered at Stripe for that date; if we close the processing without such a confirmation (for example because no subscription is running), you receive a short notice without details of the subscription. If a cancellation has to be reviewed manually, our support receives a notice by email (no more than one per hour) and, as long as review cases are open, a daily reminder — both without details of your person.

Cancellations that were received via the page without login before the switch to login and are still open (legacy cases) are processed to completion under the previous rules: we assign them to an account via the email address given, compare the name given with the billing name stored at Stripe (for this purpose we retrieve it from Stripe but do not store it) and, where applicable, inform the account behind a profile address given, no more than once a day.

Cancellation by other means (for example by email to support): our administration enters it with the day of receipt and the channel. In the normal case we implement it at Stripe effective at the end of the current billing period and send you the cancellation confirmation stating the day of receipt to the address of your account. An annual subscription that has already been renewed, a cancellation processed only after the start of the current billing period, or an error is instead handled manually as a review case; you will then receive the confirmation from us personally. For this purpose we store the name displayed on your profile page (if provided), your email and profile address, the day of receipt, the channel, the language in which we reply to you and our processing note in the same way as a cancellation via the form (same retention period, without acknowledgment of receipt). We create the same record if, after a cancellation implemented immediately via ‘Cancel contracts here’ or the button in the account settings, the cancellation confirmation could not be sent; our administration then sends it to you manually. If, for a cancellation implemented immediately, the reason given cannot be stored, we likewise create a record containing the reason and the time. We also create it, stating the date and time of receipt, if a cancellation to be reviewed manually is received via ‘Cancel contracts here’ (or the immediate implementation via the button in the account settings fails technically) but the email address of your account is invalid (for example from an older data set): in that case we do not store the cancellation as described above, and the page asks you to write to us from a valid address at support@linknetz.de so that we can confirm the cancellation to you.

Purpose: implementation and evidence of your cancellation as well as the legally required confirmation (Section 312k of the German Civil Code (BGB)); for the legacy cases without login, the name comparison and the notice to the account's address protect against cancellations by unauthorized persons. Legal basis: for the implementation and confirmation of the cancellation, Art. 6(1)(c) GDPR in conjunction with Section 312k BGB; for retention as evidence, Art. 6(1)(f) GDPR (legitimate interest in being able to prove the receipt and content of the cancellation and to defend against claims); for the name comparison and the notice to the account's address (both legacy cases only) and for limiting the emails, Art. 6(1)(f) GDPR (legitimate interest in protection against cancellations by third parties and against misuse of the form). Recipients: our email service provider (Section 6) for the emails, Stripe (see above) for cancelling the subscription and, in legacy cases, for the name comparison. Retention period: we automatically delete every cancellation submitted via the form at the end of the third calendar year after the year of its receipt (regular limitation period (regelmäßige Verjährungsfrist), Sections 195, 199 BGB), regardless of the processing status. If you delete your account, the cancellation is retained as evidence until this period expires, then without a link to the account.

6. Email delivery (transactional emails)

To send transactional emails (e.g. registration confirmations, notice emails upon registration with an address that is already in use — see Section 4, password reset, confirmation and notices upon a change of email address including a notice to the holder of an address that is already in use — see Section 4, contract-related communications), we use the service ALL-INKL.COM — Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany).

Emails are transmitted exclusively via encrypted TLS connections. The server location is Germany. A legally valid data processing agreement (Auftragsverarbeitungsvertrag, AVV) pursuant to Art. 28 GDPR is in place.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in reliable system communication).

7. GDPR-compliant click & profile statistics (anonymous aggregation)

To give users insight into the reach of their profile page and the popularity of the links they share, Linknetz offers all users privacy-friendly click and profile view statistics: in the free plan as totals of profile views and link clicks over the last 7 days, with Pro as a history of up to 12 months, also per link and per social media icon.

Special features of our system:

• No IP addresses are stored for the statistics.
• No tracking cookies, web beacons or canvas/fingerprinting techniques are used.
• Clicks and profile views are aggregated in memory on the server and recorded in the database only as a purely summary counter value (e.g. “number of clicks per hour / day”).
• Clicks on the social media icons of a profile page pass briefly through our server and are counted only as a daily value per platform (e.g. “Instagram, 3 clicks on 1 October”). Clicks on an email address given there open your email program directly and are not counted.
• In the statistics, a click cannot be attributed to any specific person or any individual device: the counter values contain neither IP addresses nor other identifiers. Like every page view, however, a click appears with a truncated IP address for a limited time in our server log files (Section 2).
• To protect against misuse, we briefly count views per pseudonymized check value (hash) of the IP address (for no more than about two days), separately from the statistics; the IP address itself is not stored in plain text in the database.

Retention period: hourly raw counters are automatically combined into daily values after 90 days; the daily values themselves (including those of the social media icons) are automatically deleted after 2 years (730 days), and all counter values of an account are also deleted together with the account. At most the last 12 months are displayed.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the profile owner and the platform operator in the anonymous statistical evaluation of reach).

8. Reach measurement of our own pages (Umami)

To see how many people visit our public information pages, we use the self-hosted, open-source analytics tool Umami. It runs on our own infrastructure with the same German provider as Linknetz itself — so no data is transferred to an external analytics provider (e.g. Google Analytics).

What is measured: exclusively our own information and legal pages as well as registration, for example the home page, pricing, roadmap, transparency page, legal notice (Impressum), privacy policy, terms and conditions (AGB), withdrawal and registration.

What is expressly not measured:

• our users' profile pages (linknetz.de/your-name) — anyone who visits a Linknetz profile page is not counted by us in any way;
• the entire logged-in area, including settings and statistics;
• any page whose address contains a personal one-time link (password reset, confirmation of an email change) — not even if an error or “page not found” message appears at such an address;
• the report form, whose address contains the name of the reported profile;
• the login page, the pages for resetting the password and for requesting the confirmation email again, and the guide (Ratgeber);
• error and “page not found” pages.

How it is measured: no script runs in your browser for this. Once our server has successfully delivered one of the measured pages to you, it reports the view to our Umami instance itself. In doing so, it transmits only:

• the identifier of our website in Umami and the name of our domain;
• the page visited without parameters (i.e. without everything from a “?” in the address) – except campaign suffixes beginning with utm_. Anyone who clicks on “Erstellt mit Linknetz” (Made with Linknetz) on a profile page visits our home page with the fixed suffix ?utm_source=profil. This lets us see how many visitors come to us via profile pages – it does not tell us from which profile;
• the referring page, if your browser sends it – only origin and path, without parameters, at most 500 characters;
• your preferred language (only the first entry of your browser's language setting);
• your IP address, truncated as in our server log files (for IPv4 the last octet, for IPv6 only the first three of eight blocks are retained);
• the browser identifier (user agent), from which Umami derives the browser type, operating system and device type.

We do not record the screen size. From the truncated IP address, Umami derives an approximate location (country, region, city). Your name, your email address or any other directly identifying feature is never recorded. Your full IP address does not reach Umami, and Umami sets no cookies. In addition, views by search engines and other bots as well as pages that your browser only preloads without displaying them are not reported.

Pseudonymous visitor identifier: Umami calculates a pseudonymous visitor identifier from the truncated IP address, the browser identifier and a key that changes every month. Within one month, the same combination results in the same identifier; we can therefore recognize that the same access has visited our pages several times. When the key changes, a new identifier is created, so that visits cannot be linked across month boundaries. This does not tell us who you are, and no merging takes place across other websites: the identifier applies only to our own instance.

Retention period: there is currently no automatic deletion of the measurement data in our Umami instance; deletion after 12 months is being set up. We will update this paragraph as soon as it is in place.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in learning how our service is found and used, without involving an external provider for this purpose. We do not access your terminal device in doing so: no script runs, and nothing is stored on it or read from it; we only use information that your browser sends to our server with every page view anyway. Consent under Section 25(1) TDDDG is therefore not required.

How you can object: if your browser sends the “Do Not Track” (DNT) or “Global Privacy Control” (GPC) signal, we do not report your views to Umami. Irrespective of this, you can object to the processing at any time informally by writing to office@mwolf94.de (Art. 21 GDPR).

Loading times of our home page, the legal notice and this page: we measure these from our own server: it retrieves the three pages itself every hour, including their stylesheets, scripts and preloaded fonts, and measures how long this takes. Per day and page we store only the sum of the loading times, the number of measurements and how many measurements fell into which 50-millisecond range. Your browser reports nothing to us for this; no visitor data is processed in the process. We publicly show the median (middle value) per page calculated from this on our transparency page.

9. Profile picture, images & local storage

Users can optionally upload a profile picture. With Pro they can also show images on their profile page: as an image block between the links (optionally with alternative text and a link when tapped), as a preview image of a link and as the background image of the page. The sole purpose is the design of their profile page as desired by the user.

We only accept images in JPEG, PNG or WebP format and check the type based on the file content. Every image is re-encoded on our server (as WebP, images on the page at most 1200 pixels, background images at most 1600 pixels wide or high). In the process, all embedded EXIF and metadata (such as GPS location data, camera and shooting details) are automatically and irrevocably removed; we do not store the original file. We store the re-encoded image file under a random file name as well as information on which account and which position on the page the image belongs to, size, dimensions, time and, where applicable, alternative text and link.

The images are stored directly and locally on our German server and delivered from there — without cookies and without reach measurement. They are not transferred to external cloud storage or CDNs and not passed on to third parties. The profile picture and images on the profile page are public and visible to anyone who visits the profile page. The profile picture remains retrievable via its address until you replace it or delete your account, and browsers may cache it for longer. The images uploaded with Pro (image blocks, preview images of links, background image), by contrast, are only retrievable via their address as long as they are shown on the profile page: while a Pro subscription exists, as a preview image only as long as the link is active, as a background image only as long as it is selected as the background, and only as long as neither the image nor the associated block or link nor your account has been blocked or hidden by moderation. Otherwise the address cannot be reached. We deliver these images without long caching: every display asks our server whether the image is still being shown. If the Pro subscription ends, the images uploaded with Pro remain stored but are no longer shown publicly; with a new Pro subscription they become visible again.

Retention period: your images remain stored until you delete them or delete your account – including after the end of Pro, so that they reappear with a new Pro subscription. Deletion: if you remove an image, an image block or a link with a preview image, or delete your account, we delete the image file from our server immediately; a daily clean-up run additionally removes files that are no longer assigned to any entry. A deleted image may still be contained in our backups (Section 2) for up to about one week.

The user is responsible for the content of the images. The user only uploads images for which they hold the necessary rights and obtains the consent of recognizably depicted persons where required (section 5 of the terms and conditions (AGB)). Anyone who considers their rights infringed by an image can report it via the report function (Section 10).

Legal basis: Art. 6(1)(b) GDPR (provision of the profile design desired by the user).

9a. Embedded videos and music (two-click solution)

Users with Pro can embed videos and music from YouTube, Vimeo, Spotify and SoundCloud on their profile page. So that no data flows to these platforms when a profile page is merely visited, we use a two-click solution.

Before the click: you only see a card from us with the name of the platform, an optional title, a button “Abspielen” (Play), a short notice of what the click does, and a link through which you can open the content directly on the platform. Nothing is loaded from the platform in the process — no player, no preview image, no script — and no data is transferred to it.

After clicking “Abspielen” (Play): only then does your browser load the platform's player at this position directly from its servers. In doing so, the platform receives in particular your IP address, information about your browser and terminal device (e.g. browser type, language, screen size), the time of retrieval and, as the origin, only the address https://linknetz.de — not the name of the profile page visited. Within the player, the platform can set or read its own cookies or comparable storage on your device and run its own scripts, for example to deliver playback, measure usage or — if you are logged in there — attribute the retrieval to your account with the platform. A click on “Auf … öffnen” (Open on …) also takes you to the platform; its privacy policy applies there.

We embed the players as data-economically as the platforms allow: YouTube videos load exclusively via the privacy-enhanced mode (www.youtube-nocookie.com), Vimeo videos with the “Do Not Track” parameter (dnt=1). We have no influence on what the platform processes after loading its player: the platform processes this data under its own responsibility. For loading the player after your click, i.e. the collection and transmission of your data to the platform, we are, according to the case law of the CJEU (judgment of 29 July 2019, C-40/17 “Fashion ID”), jointly responsible with the platform (joint controllers, Art. 26 GDPR); our responsibility ends with this transmission.

Allocation of tasks (Art. 26 GDPR): there is no arrangement under Art. 26(1) GDPR between us and the platforms; the platforms do not offer one for such embeddings, only their general terms of use and embedding apply. We therefore disclose which part we take on: we inform you before the click, obtain your consent through the click on “Abspielen” (Play), load nothing from the platform beforehand, accept your requests regarding the collection and transmission when the player is loaded, and forward questions about further processing to the platform. The platform alone is responsible for everything that happens at the platform after the transmission. You can assert your rights against us and against the platform (Art. 26(3) GDPR).

Transfers to the USA are thus based, for YouTube and Vimeo, on the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) and, for Spotify and SoundCloud, on standard contractual clauses of the respective provider (Art. 46(2)(c) GDPR). Nevertheless, a lower level of data protection may exist in the USA, for example with regard to access by authorities to transferred data.

Legal basis: your consent, which you give by clicking “Abspielen” (Play) (Art. 6(1)(a) GDPR; for the storing and reading of information on your device by the platform, Section 25(1) TDDDG). The consent applies only to this one player and only until you leave or reload the page: there is deliberately no “always allow”, and we do not store your decision — on the next visit the card asks again.

Withdrawal: you can withdraw your consent at any time with effect for the future by reloading or leaving the page; after that, no further data is transmitted via this player. You can delete cookies or storage that the platform has already set in the settings of your browser. The lawfulness of the processing carried out until the withdrawal remains unaffected.

For Pro users who embed content: for each embedded item we store only the platform, the identifier of the content (e.g. the video ID) and an optional title, never the address of a third-party player (legal basis: Art. 6(1)(b) GDPR, provision of the desired profile design). The details are included in your data export under the blocks and are deleted when you delete the block or your account. If the Pro subscription ends, they remain stored but are no longer shown publicly. Please only embed content that is lawfully accessible on the platform and that you are permitted to show (section 5 of the terms and conditions (AGB)). If you use Linknetz for business purposes (geschäftsmäßig), also name the embedded platforms, the two-click solution and a possible transfer to third countries such as the USA in your own privacy policy.

10. Report/abuse function

Via the publicly accessible report form (link “Missbrauch melden” (report abuse) at the bottom of every profile page, in German), any person can report a Linknetz profile page for a suspected violation of our terms and conditions (AGB) or applicable law. The following is processed: the reported profile name (slug), the selected reason for the report, a mandatory description of why the content is unlawful or impermissible, an optional address (URL) of the content, the name and email address of the reporting person, if they provide these voluntarily (for possible queries), the language of the report page (so that we reply in that language), and the time of their declaration that the information is accurate and complete to the best of their knowledge (Art. 16(2) DSA).

Purpose: defense against misuse (e.g. content that is unlawful or violates our terms and conditions) and carrying out the reporting and blocking procedure described in section 6 of our terms and conditions (AGB).

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA (notice and action mechanism (Melde- und Abhilfeverfahren)) and Art. 6(1)(f) GDPR (legitimate interest in detecting and preventing misuse on the platform and in protecting affected third parties).

Access: incoming reports can be accessed exclusively by administrators in the moderation area; they are not passed on to third parties, except where we are legally obliged to do so.

Notification of the reporting person: if they have provided an email address, we inform them of our decision (Art. 16(5) DSA) — in a fixed sentence (“measures taken”, “review completed” or “no measures”, depending on the actual situation) and with a reference to legal remedies. If such a notification was incorrect, we send a correction. We do not tell them which measure we have taken against the reported person, which legal provision we relied on, or the internal reasoning of our administration.

Retention period: completed reports (status “erledigt” (resolved) or “abgelehnt” (rejected)) are automatically deleted 12 months after processing has been completed, including any name and email address given. Reports still open remain stored until they are completed, so that the moderation history remains traceable for ongoing cases. Irrespective of this, you can request the deletion of a report you submitted, including name and email address, at any time informally at office@mwolf94.de.

11. Your rights as a data subject under the GDPR

As a data subject, you have extensive rights under the General Data Protection Regulation, which you can exercise free of charge at any time:

• Art. 15 GDPR — right of access: you can request information about the personal data we process at any time.
• Art. 16 GDPR — right to rectification: if any information is incorrect, you can change it directly in your user profile or have us correct it.
• Art. 17 GDPR — right to erasure (“right to be forgotten”): you can arrange for the deletion of your account and all linked links, statistics, profile pictures and uploaded images at any time via the self-service function in the dashboard (or informally by email). After that, the following information remains for a limited time: your previous profile name (slug) remains blocked for 30 days so that nobody can take it over immediately and impersonate you; an internal log entry on the deletion with this slug and your IP address at the time of deletion (without email address; the IP address truncated after 30 days as in the server log files) is automatically deleted after 180 days. Earlier log entries on actions in your account (time, IP address – truncated after 30 days –, in the case of a withdrawal also the name you provided) are no longer linked to the account from the time of deletion and are likewise automatically deleted no later than 180 days after their creation. The legal basis for this time-limited retention is Art. 6(1)(f) GDPR. The slug block and the log entry on the deletion serve to protect against identity misuse and to ensure the traceability of administrative interventions. The name provided in the case of a withdrawal and the earlier log entries (for example on logins) serve as evidence of the withdrawal or to defend against claims; to that extent, erasure is excluded under Art. 17(3)(e) GDPR until the period expires. A cancellation submitted via the cancellation form (Kündigungsformular) remains stored as evidence without a link to the account until the end of the third calendar year after the year of its receipt (legal basis: Art. 6(1)(f) GDPR; purpose: preservation of evidence and defense against claims; to that extent, erasure is excluded under Art. 17(3)(e) GDPR). If the deletion ends a running Pro subscription whose unused portion we refund to you (section 9 of the terms and conditions (AGB)), or if a review of your billing is still open (for example after a withdrawal, a cancellation or a chargeback), we create a record for this purpose: your display name, your email address and your profile name, the status of your subscription, the reason and date of an open review and any amount already refunded automatically. It serves the refund and ensures that nothing is refunded or charged twice, and remains stored without a link to the account for the same length of time (legal basis: Art. 6(1)(b) GDPR for the refund, thereafter (f) as evidence). If the deletion ends a Pro subscription that you can still withdraw from, we send you, after the deletion, a one-time confirmation stating the end of the withdrawal period to your previous email address; we do not store the address additionally for this purpose (legal basis: Art. 6(1)(b) GDPR). In the record mentioned, we note whether this confirmation is pending, has been sent, is no longer applicable or could not be sent. Reports by third parties about your profile follow their own period (Section 10: 12 months after processing has been completed). If you requested the deletion by email, the case file on your request (see below) additionally contains your previous account ID and your slug; it is automatically deleted 3 years after the case has been closed (accountability under Art. 5(2) GDPR). Entries in the moderation file (Moderationsakte) (Section 4) remain stored with your previous account ID, your profile name (slug) and a hash value of your email address until the end of the third calendar year after the last measure was lifted or after the end of the contract (legal basis: Art. 6(1)(f) GDPR; purpose: evidence of our moderation decisions and defense against claims; to that extent, erasure is excluded under Art. 17(3)(e) GDPR). Deleted data usually also disappears from our backups (Section 2) within about one week.
• Art. 18 GDPR — right to restriction of processing: you have the right to request the restriction of the processing of your data.
• Art. 20 GDPR — right to data portability: you can download all of your data stored with us at any time (account master data, links and blocks including moderation blocking notes, descriptions of your links, addresses blocked by moderation, your uploaded images with position on the page, size, moderation blocking note and download address, click and profile statistics) in a machine-readable, structured JSON format via the 1-click export in the dashboard (GET /api/account/export).
• Art. 21 GDPR — right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

Documentation of processing: if you exercise one of the rights listed above by email instead of via the self-service function, we keep a short internal case file (date of receipt, your contact details, type of request, outcome and, in the case of an account deletion, additionally your previous account ID and your slug) as evidence of timely processing under Art. 12(3) GDPR. We keep these records for 3 years after the respective case has been closed and then delete them automatically — a separate, documented decision to fulfill our accountability obligation under Art. 5(2) GDPR, not a legally prescribed period.

12. Right to lodge a complaint with the competent supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority competent for our registered office is: