S
SPOTILINK Home

Privacy policy

Last updated: August 17, 2026

Data controller

This policy describes how Spotilink processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

The data controller is Webiscool, a sole proprietorship of Jules Carmaux (micro-entrepreneur), 12 rue des Dentelles, 67000 Strasbourg, France, SIRET 842 134 223 00010 (the “Publisher”). Publication director: Jules Carmaux. For any question relating to your data: contact@spotilink.bio.

Data collected

Depending on your use of the Service, we process the following categories of data:

  • Account: email, name, profile photo, bio, links to your social networks.
  • Content you publish: products, photos, reviews, promo codes, affiliate links, essentials, polls.
  • Payment (Creator plan): managed by Stripe. We never store your banking details; we keep only a Stripe customer identifier and the status of your subscription.
  • Audience measurement: clicks and views of your page (aggregated data), traffic source, and an anonymous technical identifier used to prevent multiple votes in polls.
  • Technical security data: connection logs, IP address and abuse logs, processed for the security of the Service.
  • Billing identity (“payment handled by Spotilink” option): legal name, SIRET number and, where applicable, VAT number, together with the payment-account details collected and verified by Stripe Connect.
  • Collab documents: contracts and briefs you upload for a Deal, and supporting documents sent by a Brand in support of a contest. These files are stored in a private area accessible only to the people concerned.

Purposes and legal bases

Each processing operation relies on a specific legal basis:

  • Providing and operating the Service, performance of the contract (art. 6.1.b GDPR).
  • Managing the subscription and billing, performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
  • Statistics and product improvement, legitimate interest (art. 6.1.f GDPR).
  • Security, prevention and detection of abuse and fraud, legitimate interest (art. 6.1.f GDPR).
  • Connecting Creators and Brands within the framework of Collabs, legitimate interest (art. 6.1.f GDPR).
  • Collecting, escrowing, disbursing and handling contests for Collabs paid through Spotilink, performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR).

Brand data (Collabs)

When a Brand fills in a Collab proposal via a Creator’s private link, we collect the information it provides: Brand name, contact email, product description and visuals, link and promo code. Legal basis: legitimate interest in connecting Creators and Brands.

The Brand’s contact email is never displayed publicly, only the Creator concerned has access to it. This information is anonymized at the latest 90 days after the end of the Collab, the refusal or the withdrawal of the proposal. For “payment managed by Spotilink” Collabs, where a refund remains due to the Brand, its contact email is kept for the time strictly necessary to process that refund, the 90-day period running only from its completion.

For this collection, Webiscool acts as data controller, and as host of the Content provided by the Brand within the meaning of article 6 of the LCEN. Each Brand remains solely responsible for the accuracy, lawfulness and legal compliance of the items it submits (product claims, visuals, intellectual property). Spotilink is not a party to the contract concluded between the Brand and the Creator. For “off-platform” Collabs, Spotilink processes no payment between them; where the Creator chooses the “payment managed by Spotilink” option, the funds are collected, held in escrow and disbursed via Stripe Payments Europe, in accordance with article 5 bis of the Terms of Use/Sale.

Subscriber emails (a Creator’s newsletter)

When a Creator enables email capture, a visitor may subscribe to their list from their page. We then collect the email address provided and the signup date, on behalf of the Creator concerned (legal basis: the visitor’s consent). These emails are visible only to that Creator, are never shared or used by Spotilink for any other purpose, and the visitor may request their deletion at any time. The Creator remains responsible for how they use their list.

Processors and recipients

Your data is never sold. We use the following providers:

  • Supabase, database, authentication and storage. Data hosted in the European Union.
  • Stripe, processing of Creator-plan payments and, where applicable, of brand payments held in escrow for collabs paid via Spotilink (Stripe Payments Europe).
  • Vercel, application hosting (Vercel Inc., United States).
  • OVH SAS (Roubaix), domain name management.
  • Google, only if you choose to sign in with Google.
  • PostHog, site audience measurement. European instance, with no cookie and no persistent identifier.
  • Resend, sending of transactional emails (confirmation, Collab notifications, password reset).
  • Upstash, rate limiting and abuse protection. Processes short-lived counters derived from the IP address.
  • Google Ireland Limited, tag management (Google Tag Manager), audience measurement (Google Analytics) and tracking of our ad campaigns (Google Ads). These tools are off by default and only fire after your explicit consent, at which point they set cookies.

Transfers outside the EU

Some providers (Vercel, Stripe, Google, Resend, Upstash) may process data outside the European Union. Those transfers rely on appropriate safeguards, in particular the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. Your account data and your Content are stored in the EU via Supabase, and our primary audience measurement runs on PostHog’s European instance. Measurement and advertising data is only sent to Google after your consent, and may then be processed in the United States by Google LLC.

Retention periods

We keep the data for the time strictly necessary for each purpose:

  • Account and published Content: as long as your account is active; deleted within 30 days after the account is deleted.
  • Brand data (Collabs): anonymized at the latest 90 days after the end, refusal or withdrawal of the Collab; where a refund is still due (“payment managed by Spotilink” option), this period runs only from the completion of the refund.
  • Billing documents (Creator plan): kept for 10 years, in accordance with the legal accounting obligation.
  • Security logs and abuse logs: kept for up to 12 months.
  • Audience measurement: kept in aggregated form; the anonymous technical identifier is short-lived.
  • Collab documents: contracts and briefs are kept for as long as the Collab and your account exist; documents sent in support of a contest are deleted 90 days after it is resolved.

Your rights

In accordance with the GDPR, you have a right of access, rectification, erasure, portability, restriction and objection, as well as the right to define directives regarding the fate of your data after your death.

To exercise these rights, write to contact@spotilink.bio; we may ask you to prove your identity. If you consider that your rights are not respected, you may lodge a complaint with the CNIL, Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy, 75007 Paris (www.cnil.fr).

Cookies

Strictly necessary cookies (session and authentication) are exempt from consent: without them you cannot sign in. Your cookie choice is also kept locally in your browser, so you are not asked again on every page.

The optional cookies are Google’s, for two separate purposes you can accept independently: audience measurement (Google Analytics) and tracking of our ad campaigns (Google Ads). They are off by default and are only set after your explicit agreement. Our primary audience measurement sets no cookie and uses no persistent identifier: it works identically whether you accept or decline.

You can change your mind at any time through the “Manage cookies” link at the bottom of every page. Declining has no effect on your access to the service, and your refusal is remembered so you are not asked again.

Content reporting

In its capacity as host, Webiscool implements a reporting and removal procedure. Any manifestly unlawful Content, including Content published by a Brand as part of a Collab, may be reported to contact@spotilink.bio with a view to its removal, under the conditions of article 6 of the Terms of Use/Sale.

Amendments

This policy may be updated to reflect changes to the Service or to applicable regulations. The date of the last update appears at the top of the page.