Data controller
This policy describes how Spotilink processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
The data controller is Webiscool, a sole proprietorship (micro-entrepreneur), 12 rue des Dentelles, 67000 Strasbourg, France — SIRET 842 134 223 00010 (the “Publisher”). Publication director: Jules. For any question relating to your data: contact@spotilink.bio.
Data collected
Depending on your use of the Service, we process the following categories of data:
- Account: email, name, profile photo, bio, links to your social networks.
- Content you publish: products, photos, reviews, promo codes, affiliate links, essentials, polls.
- Payment (Creator plan): managed by Stripe. We never store your banking details; we keep only a Stripe customer identifier and the status of your subscription.
- Audience measurement: clicks and views of your page (aggregated data), traffic source, and an anonymous technical identifier used to prevent multiple votes in polls.
- Technical security data: connection logs, IP address and abuse logs, processed for the security of the Service.
Purposes and legal bases
Each processing operation relies on a specific legal basis:
- Providing and operating the Service — performance of the contract (art. 6.1.b GDPR).
- Managing the subscription and billing — performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
- Statistics and product improvement — legitimate interest (art. 6.1.f GDPR).
- Security, prevention and detection of abuse and fraud — legitimate interest (art. 6.1.f GDPR).
- Connecting Creators and Brands within the framework of Collabs — legitimate interest (art. 6.1.f GDPR).
Brand data (Collabs)
When a Brand fills in a Collab proposal via a Creator’s private link, we collect the information it provides: Brand name, contact email, product description and visuals, link and promo code. Legal basis: legitimate interest in connecting Creators and Brands.
The Brand’s contact email is never displayed publicly — only the Creator concerned has access to it. This information is anonymized at the latest 90 days after the end of the Collab, the refusal or the withdrawal of the proposal. For “payment managed by Spotilink” Collabs, where a refund remains due to the Brand, its contact email is kept for the time strictly necessary to process that refund, the 90-day period running only from its completion.
For this collection, Webiscool acts as data controller, and as host of the Content provided by the Brand within the meaning of article 6 of the LCEN. Each Brand remains solely responsible for the accuracy, lawfulness and legal compliance of the items it submits (product claims, visuals, intellectual property). Spotilink is not a party to the contract concluded between the Brand and the Creator. For “off-platform” Collabs, Spotilink processes no payment between them; where the Creator chooses the “payment managed by Spotilink” option, the funds are collected, held in escrow and disbursed via Stripe Payments Europe, in accordance with article 5 bis of the Terms of Use/Sale.
Subscriber emails (a Creator’s newsletter)
When a Creator enables email capture, a visitor may subscribe to their list from their page. We then collect the email address provided and the signup date, on behalf of the Creator concerned (legal basis: the visitor’s consent). These emails are visible only to that Creator, are never shared or used by Spotilink for any other purpose, and the visitor may request their deletion at any time. The Creator remains responsible for how they use their list.
Processors and recipients
Your data is never sold. We use the following providers:
- Supabase — database, authentication and storage. Data hosted in the European Union.
- Stripe — processing of Creator-plan payments and, where applicable, of brand payments held in escrow for collabs paid via Spotilink (Stripe Payments Europe).
- Vercel — application hosting (Vercel Inc., United States).
- OVH SAS (Roubaix) — domain name management.
- Google — only if you choose to sign in with Google.
Transfers outside the EU
Some providers (Vercel, Stripe, Google) may process data outside the European Union. These transfers are governed by appropriate safeguards, in particular the European Commission’s standard contractual clauses and, where applicable, the applicable EU–United States Data Privacy Framework. The data of your account and your Content is, for its part, stored in the EU via Supabase.
Retention periods
We keep the data for the time strictly necessary for each purpose:
- Account and published Content: as long as your account is active; deleted within 30 days after the account is deleted.
- Brand data (Collabs): anonymized at the latest 90 days after the end, refusal or withdrawal of the Collab; where a refund is still due (“payment managed by Spotilink” option), this period runs only from the completion of the refund.
- Billing documents (Creator plan): kept for 10 years, in accordance with the legal accounting obligation.
- Security logs and abuse logs: kept for up to 12 months.
- Audience measurement: kept in aggregated form; the anonymous technical identifier is short-lived.
Your rights
In accordance with the GDPR, you have a right of access, rectification, erasure, portability, restriction and objection, as well as the right to define directives regarding the fate of your data after your death.
To exercise these rights, write to contact@spotilink.bio; we may ask you to prove your identity. If you consider that your rights are not respected, you may lodge a complaint with the CNIL — Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy, 75007 Paris (www.cnil.fr).
Cookies
Spotilink uses only strictly necessary cookies (session and authentication), which are exempt from consent. No advertising cookies or third-party trackers are placed.
Content reporting
In its capacity as host, Webiscool implements a reporting and removal procedure. Any manifestly unlawful Content — including Content published by a Brand as part of a Collab — may be reported to contact@spotilink.bio with a view to its removal, under the conditions of article 6 of the Terms of Use/Sale.
Amendments
This policy may be updated to reflect changes to the Service or to applicable regulations. The date of the last update appears at the top of the page.