Privacy Policy

Last updated: October 10, 2026

This policy explains what personal data LinkLuup (linkluup.com) processes, why, who we share it with and how you can exercise your rights. It is written under Chilean Law No. 19.628 on the protection of privacy, as amended by Law No. 21.719, whose main rules take effect on December 1, 2026. The Spanish version is the authoritative text; if the two differ, the Spanish version prevails.

1. Who is responsible for your data

The controller of your personal data is Locus SpA, RUT 76.431.612-6, Chile, which operates LinkLuup. For any question or request about your data, write to contacto@locu.cl.

2. What data we process

If you create an account (creator):

Sign-in. When you sign in with Google or X we receive your account identifier at that provider, your name and, if the provider shares it, your email address. We do not use the provider’s profile photo.
Your page. Username, display name, bio, profile photo (only if you upload one), the theme you picked and the links you add: title, address, whether they are active, whether they are sensitive content and the countries where you hide them.
Preferences. Your language and whether you let search engines index your page.
Click statistics. Each time a visitor opens one of your links we record which link, the date and time, and the visitor’s country (a two-letter code). We do not store the visitor’s IP address or tie it to the click.

If you visit a public page (visitor):

We do not use cookies, analytics or advertising on public pages. Like any web service, our hosting provider processes your IP address and technical browser data in its server logs to deliver the page and protect the service.
To apply the countries a creator chose to hide a link from, we determine your country from your IP address at the time of the request. We do not store it, other than the country code in the click record.

If you write to us: we process your email and the content of your message to reply.

We do not ask for sensitive personal data (such as health, ethnic origin, sex life or orientation, beliefs or biometric data). Please do not include it in your bio or link titles.

3. Why we use your data, and on what basis

Create and keep your account, publish your page and let you manage it. Basis: performance of the contract (the Terms and Conditions).
Send visitors to your links and record clicks. Basis: performance of the contract and our legitimate interest in offering statistics to the creator.
Security, preventing abuse and fraud, and complying with the law. Basis: legitimate interest and legal obligation.
Run the service, for example an internal notice that a new account was created. Basis: legitimate interest.
Answer your questions and requests. Basis: performance of the contract, legitimate interest and legal obligation, as applicable.

We do not sell your data, we do not use it for advertising, and we do not make automated decisions that have legal effects on you.

4. What is public

Your page is public by design. Anyone can see your username, display name, bio, photo and active links (except links you hide in certain countries; this is a best-effort filter, not a guarantee).

Search engines may index your page unless you turn off “Search engines” in Settings. The address may also appear in previews when someone shares it on social media. Your photo is stored in publicly accessible storage: anyone who knows its address can view it. Before publishing, think about what you want to be public.

5. Who we share data with

We use providers that process data on our behalf to run the service:

Supabase: database, authentication and file storage (servers in São Paulo, Brazil).
Vercel: hosting and delivery of the website (United States and a global network).
Cloudflare: DNS for the linkluup.com domain.
Google and X: sign-in. They learn that you signed in to LinkLuup and handle that under their own policies. Also, to show each site’s icon on your page, our servers ask a Google icon service for only the domain of the linked site, never visitor data.
Discord: an internal admin channel. When you finish signing up we post your username, display name and page address there.

We do not share your data with other third parties, unless the law or a competent authority requires it.

6. International transfers

Some of these providers process data outside Chile: in Brazil (Supabase) and in the United States (Vercel, Cloudflare, Google, X and Discord). We do this only as far as needed to provide the service, with providers that offer contractual data protection commitments and security measures. If you want more information about these transfers, write to us.

7. Cookies and similar technologies

Session: if you sign in, we use cookies needed to keep you authenticated. They are removed when you log out or when they expire.
Language: if you pick a language manually in Settings, we store that preference in a cookie for one year.

We do not use analytics, advertising or tracking cookies, and public pages set no cookies at all.

8. How long we keep your data

We keep your account data while your account is active. If you delete a link, its click records are deleted too. Today you can ask us to delete your account by writing to contacto@locu.cl; we will delete your account, page, links and photo data, except what we must keep for a legal obligation or to defend against claims, which will be blocked and deleted once that period ends.

Our providers’ server logs are kept for the periods each of them sets.

9. Security

We use encrypted connections (HTTPS), database access rules so each account can only change its own data, and secret credentials kept separate from the code. No system is completely secure. If a breach affects your data, we will report it to the Personal Data Protection Agency and to affected people when the law requires it.

10. Your rights

The law gives you these rights over your personal data:

Access: know what data of yours we process and receive a copy.
Rectification: correct inaccurate or incomplete data.
Erasure: ask us to delete your data.
Objection: object to processing in the cases the law allows, and withdraw your consent when consent is the basis.
Portability: receive your data in a structured, commonly used format.
Temporary blocking: ask us to pause processing while a request is being resolved.
Not being subject to automated decisions that significantly affect you. We do not make decisions of that kind.

To exercise them, write to contacto@locu.cl from the email tied to your account, stating your username and the right you want to exercise. We may ask for extra information to verify your identity. We answer within 30 calendar days, extendable by another 30 when necessary, explaining why; temporary-blocking requests are resolved within 2 business days. You can also edit your profile and links in the dashboard, and hide your page from search engines in Settings.

If you are not satisfied with our answer, or do not get one in time, you can file a complaint with the Personal Data Protection Agency (Agencia de Protección de Datos Personales) within the period set by law (30 business days).

11. Minors

LinkLuup is only for people over 18 and does not knowingly process data of minors. If we find a minor’s account, we will delete it. If you think that happened, tell us.

12. Changes to this policy

We may update this policy. We will publish the new version with its date and, if the change is significant, tell you by a reasonable means, such as a notice in the service.

13. Contact

Locus SpA, RUT 76.431.612-6. Email: contacto@locu.cl. See also the Terms and Conditions.