Privacy Policy

Last updated: April 2026

Data Controller

TOMASZ CY LTD
Antigonou 3, 1016 Nicosia, Cyprus
HE 487351
Email: [email protected]
Phone: +357 96560209

Data We Collect

Account Data (Creators)

When you register and use our service, we collect:

• Email address (for login, verification, and notifications)
• Password (stored only as a bcrypt hash, never in plain text)
• Username (public, part of your link URL)
• TikTok handle (optional)
• Redirect URL (the destination your link redirects visitors to)
• Payment data (processed directly by Stripe — we only store your Stripe customer ID)

Analytics Data (Visitors)

When someone visits a creator's link, we collect anonymized usage data:

• User agent (browser and device information)
• Referrer (where the visitor came from)
• IP address — immediately hashed with SHA-256 and stored only as an irreversible hash. The original IP address is never stored.
• TikTok detection (whether the visit came from the TikTok app)
• Time of visit

Legal Basis

Your data is processed on the following legal grounds:

• Performance of contract (Art. 6(1)(b) GDPR) — Processing your account data is necessary to provide our service.
• Legitimate interest (Art. 6(1)(f) GDPR) — Collecting anonymized analytics data serves to provide usage statistics for creators and to improve our service.

Data Processors

We use the following service providers, with each of whom we have a data processing agreement (DPA) in place:

Service	Purpose	Location
Stripe Inc.	Payment processing, invoicing	USA (EU-US DPF)
Resend Inc.	Email delivery (verification, password reset, notifications)	USA (Standard Contractual Clauses)
Supabase Inc.	Database hosting	Ireland (AWS EU-West-1)
Cloudflare Inc.	CDN, DDoS protection, SSL	Global (EU-US DPF)

Data Transfers to Third Countries

Some of our service providers are based in the USA. Transfer of personal data to the USA is carried out on the basis of the EU-US Data Privacy Framework (DPF) and/or EU Standard Contractual Clauses (SCC). All service providers have signed appropriate data protection agreements with us.

Data Retention

Your account data is retained as long as your account exists. Upon account deletion, all personal data is irrevocably deleted after a 30-day grace period. Analytics data is retained on the basis of our legitimate interest but cannot be attributed to an identifiable person (IP addresses are stored only as hashes).

Cookies

We only use a technically necessary session cookie (PHPSESSID), required for login functionality. It is deleted when you close your browser. We do not use tracking cookies, marketing cookies, or third-party cookies.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — You can request information about your stored data.
• Right to rectification (Art. 16) — You can request correction of inaccurate data.
• Right to erasure (Art. 17) — You can request deletion of your data.
• Right to restriction (Art. 18) — You can request restriction of processing.
• Right to data portability (Art. 20) — You can request your data in a machine-readable format.
• Right to object (Art. 21) — You can object to processing based on legitimate interest.

To exercise your rights, please contact [email protected].

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data violates the GDPR.