Privacy Policy

Just Link is a link-in-bio service that lets you build a single, customisable public page (your “User Page”) to share your most relevant links, social profiles, and content with your audience. The Service is operated by 54.535.421 GUILHERME SCHIRMANN BRANDALISE (“Just Link”, “we”, “us”), a company registered in Brazil under CNPJ 54.535.421/0001-46, with registered address at Rua Alecrim, 30, Arvoredo, Concórdia/SC, CEP 89701-414, Brasil. This Privacy Policy applies to jstl.ink, the editor dashboard and any related features (collectively, the “Service”). User Pages and the content displayed on them are public by default and may be discovered and visited by anyone on the internet.

Public content may also be indexed, cached, copied, quoted, archived, mirrored or republished by search engines, browsers, social platforms, internet archives and other third parties. Even after content is edited or removed, copies may remain available in systems we do not control.

This Privacy Policy describes the personal information we collect and handle about:

• People who visit jstl.ink or any User Page.

• People who sign up for an account on a free or paid plan.

• People who contact us, for example through our support channels.

Each User independently decides what to publish on their User Page, what destinations to link to, and how they interact with visitors, customers or contacts. Users and the operators of third-party destinations linked from User Pages act independently from us and are solely responsible for their own privacy practices, disclosures, legal bases, consents and compliance obligations.

If you interact with a User through their page or click through to a third-party destination, that User and the destination may collect and process information under their own terms and privacy notices. If you want to know how they handle your information, you should contact them directly. We are not responsible for, and cannot answer questions about, the privacy practices of Users or third parties.

For the personal information we collect to operate the Service ourselves — such as account credentials, billing details and dashboard analytics — we act as the controller (or equivalent role under your local law).

For any personal information that a User chooses to publish on a User Page, collect from visitors through forms, links, integrations or analytics they configure, or otherwise process in connection with their own activity, the User is the independent controller of that information. We act only as a neutral hosting and technology provider with respect to that data and do not decide why or how it is processed by the User.

This means that, with respect to personal data processed by a User, the User is solely responsible for: (a) having a valid legal basis and any required consents; (b) providing visitors with their own privacy notice and any required cookie or marketing notices; (c) honouring data-subject rights (such as access, deletion or objection requests); (d) managing data-breach obligations relating to their own integrations; and (e) complying with all applicable privacy, data-protection and electronic-communications laws.

If you are a visitor and you want to exercise rights or get information about data processed by a User, you must contact that User directly. We may forward your request to the relevant User but are not obligated to act on it on the User’s behalf.

The personal information we may collect about you broadly falls into the following categories:

Information you provide voluntarily.

• Account and profile information: name, email address, password (stored hashed), username/slug, profile picture, biography, phone number, date of birth, and other information you choose to add to your account or page.

• Authentication information: one-time passcodes (OTP) we send by email, and identifiers returned by Google or Discord when you use social log-in.

• Page content: the text, images, links, social profiles, styling and any other materials you publish through the editor. This content is intended to be displayed publicly on your User Page. You should not upload confidential information or sensitive personal data unless you are legally entitled to do so and are comfortable making it public. If you include personal data about another person, you are responsible for having an appropriate legal basis and any required notices or permissions.

• Billing information: if you subscribe to a paid plan, the name, billing address, country and tax identifier you provide at checkout. Card and bank details are collected and stored directly by our payment processor — we never see or store your full card number.

• Communications: the content of messages you send us through support, contact forms or email, together with the contact details you use.

Information we collect automatically.

• Usage and analytics data: aggregated information about visits and clicks on User Pages, the pages you view in the dashboard and how you interact with the editor. This helps us improve the Service and lets Users see how their page is performing.

• Technical and device data: IP address, broad geographic location derived from the IP address, browser type and version, device type, operating system, language, referring URL and timestamps.

• Security logs: events related to authentication, rate limiting, abuse detection and other activity needed to keep accounts and the Service safe.

• Cookies and similar technologies: as described in the “Cookies” section below.

Information we receive from third parties.

• If you choose to sign in with Google or Discord, we receive basic profile information (such as your name, email address and profile picture) from those providers, in line with the permissions you grant.

• If you subscribe to a paid plan, our payment processor shares with us the information we need to provision your subscription (for example, plan, status, country and tax identifier), without sharing your full card details.

We use the information we collect for the following purposes:

• Provide and operate the Service: create and maintain your account, render your User Page, host your content, generate previews, maintain caches and backups, deliver email notifications, and respond to your support requests.

• Authenticate you and keep accounts secure: verify log-ins, send one-time passcodes, detect and prevent fraud, abuse, spam and unauthorised access, and enforce our Terms of Service.

• Process payments: manage subscriptions, renewals, refunds, payment disputes, chargebacks and tax obligations through our payment processor.

• Improve the Service: analyse usage in aggregate to understand which features are useful, fix bugs, monitor errors, investigate incidents and plan new functionality.

• Provide page analytics to Users: aggregate visit and click metrics so the owner of a User Page can understand how it is performing.

• Communicate with you: send transactional messages about your account, security alerts, billing receipts, and service announcements.

• Comply with legal obligations and protect the Service: respond to lawful requests from authorities, meet tax and accounting requirements, enforce our Terms of Service, and exercise or defend legal claims.

We do not sell your personal information, and we do not use it for behavioural advertising on third-party platforms.

Public information. Your User Page and everything you publish on it (links, text, images, social profiles, styling, etc.) is publicly accessible to anyone with the URL and may be indexed, copied, cached, archived, mirrored, quoted or republished by third parties. Only include on your page information you are comfortable sharing publicly. We cannot control third-party use of public content or guarantee deletion from systems we do not operate.

Service providers. We share information only with service providers that help us operate the Service, and only to the extent necessary for them to perform their function. These currently include providers for:

• Payments and billing (Paddle, who acts as the merchant of record for paid plans).

• Object storage for files and images you upload (Cloudflare R2).

• Authentication via Google and Discord, when you choose those sign-in methods.

• Email delivery for one-time passcodes, transactional messages and support replies.

• Error monitoring and performance (Sentry) to help us detect and fix issues.

• Hosting and infrastructure required to keep the Service available.

Cursor assets on User Pages. Some User Pages optionally display a custom cursor using assets (CSS or image files) loaded directly from cdn.cursors-4u.net, a CDN operated by cursors-4u.com. When a User enables this feature, your browser fetches the cursor file directly from that third-party CDN, and cursors-4u.com may receive and log your IP address and standard HTTP request headers under their own privacy policy. Just Link does not receive, control or have visibility over this data exchange. The custom cursor feature is entirely optional and is enabled solely at the discretion of each individual User — not all User Pages use it.

Users and third-party destinations act independently. If a visitor clicks a link or otherwise leaves a User Page for a third-party destination selected by the User, that destination receives information directly from the visitor’s device under its own privacy practices. We do not control and are not responsible for the privacy, security or content practices of Users, linked destinations or other third parties.

Legal and safety. We may disclose information to law enforcement, courts, regulators or other third parties where we believe disclosure is required by law, necessary to enforce our Terms of Service, or necessary to protect the rights, property or safety of Just Link, our Users or others.

Business transfers. If we are involved in a merger, acquisition, reorganisation or sale of assets, your information may be transferred as part of that transaction, subject to the protections of this Privacy Policy.

With your consent. We may share your information for any other purpose with your consent.

We use cookies and similar technologies to:

• Keep you signed in and protect your session (strictly necessary).

• Protect forms and account actions against cross-site request forgery (CSRF).

• Remember preferences such as language or interface choices.

• Measure aggregate usage to understand how the Service is used and improve it.

You can control or block cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from signing in or using key parts of the Service. Because there is no consensus standard for “Do Not Track” signals, we do not currently respond to them. Cookies, pixels, analytics or similar technologies that a User chooses to add to their User Page are the responsibility of that User, not ours.

We use the Meta Pixel (provided by Meta Platforms, Inc. and Meta Platforms Ireland Ltd.) on selected pages we operate ourselves to measure the performance of our advertising, build advertising audiences, and understand the conversion funnel for our paid plans. The Meta Pixel only loads after you give us your consent for the “marketing” cookie category through our consent banner — until then, no Meta script runs and no Meta cookies are set.

We load the Meta Pixel on the following groups of pages we operate (it is not loaded on any User Page):

• Our institutional and marketing pages (such as the homepage, contact, privacy, terms and refund-policy pages).

• Our authentication funnel (sign-up, sign-in, OTP verification and account-info screens).

• Our billing funnel (plan selection, checkout and billing management screens).

When the pixel is active, Meta may receive directly from your browser:

• Your IP address and user-agent string.

• The URL of the page you are on and basic interactions inside the funnel, sent as standard pixel events such as PageView, ViewContent, CompleteRegistration, InitiateCheckout and Purchase.

• The values of the Meta cookies described below.

• If you are also signed in to Facebook or Instagram in the same browser, Meta may correlate this activity with your Meta account.

When loaded, the Meta Pixel sets the following cookies in your browser, with the retention configured by Meta (we do not set or read them ourselves):

• _fbp — used by Meta to identify browsers for advertising and measurement; set by Meta for approximately 90 days.

• _fbc — set only when you arrive on our site through a Meta-tagged link (containing an fbclid URL parameter), used to attribute the visit to a specific Meta ad; set by Meta for approximately 90 days.

Our legal basis for loading the Meta Pixel and for the Meta cookies above is your consent (Article 6(1)(a) of the GDPR and Article 7, IX of the LGPD). You can refuse all optional cookies in our consent banner the first time you visit, and you can change your mind at any time by opening the “Cookie settings” link in the footer of our pages. Withdrawing your consent stops further pixel activity, but does not affect the lawfulness of any processing carried out before the withdrawal.

Meta acts as the recipient of this data and processes it on its own infrastructure, including in the United States, Ireland and other countries where Meta operates. Meta states that it relies on its own safeguards for international transfers of personal data, including standard contractual clauses and its participation in the EU–U.S. Data Privacy Framework. We do not control these safeguards and provide this information for transparency only; you can review Meta’s own privacy and cookie disclosures for further details.

If you are a California resident, the use of the Meta Pixel for our advertising may qualify as “sharing” of personal information for cross-context behavioural advertising under the California Consumer Privacy Act, as amended by the CPRA. You can opt out of this sharing at any time by refusing or revoking the “marketing” category in our consent banner, or by opening the “Cookie settings” link in the footer of our pages.

We use Microsoft Clarity (provided by Microsoft Corporation and, for visitors in the European Economic Area, the United Kingdom and Switzerland, Microsoft Ireland Operations Limited) on a limited set of pages we operate to understand how visitors navigate and use those pages, through session replay (recordings of on-page interactions) and aggregated heatmaps. We use Clarity solely to diagnose usability problems and improve the Service — not for advertising. Clarity only loads after you give us your consent for the “analytics” cookie category through our consent banner, which is a separate choice from the “marketing” category used by the Meta Pixel. Until you grant analytics consent, no Clarity script runs and no Clarity cookies are set.

Clarity runs on a narrower set of pages than the Meta Pixel. We load it only on:

• Our homepage and main landing page.

• Our authentication funnel (sign-up, sign-in, OTP verification and account-info screens).

We deliberately do not load Clarity on our checkout or billing pages, on our other institutional and legal pages, or on any User Page. Because session replay on payment and account-management screens could capture sensitive information, we exclude those surfaces entirely.

When Clarity is active, Microsoft may receive directly from your browser:

• Your IP address (which Microsoft states it uses to derive an approximate location and does not store in a form that identifies you), user-agent string, device type, operating system, browser and screen dimensions.

• The URLs of the pages you view and the referring URL.

• A recording of your interactions on the page — such as mouse movements, clicks, taps and scrolling — used to reconstruct an anonymised session replay and to build aggregated heatmaps.

By default, Clarity is configured to mask text content and form-field input in its recordings, so the characters you type into fields (such as your email address or password) are not intended to be captured in the replay. You should nevertheless avoid entering sensitive personal data into any field that is not strictly required.

When loaded, Microsoft Clarity sets the following cookies in your browser, with the retention configured by Microsoft (we do not set or read them ourselves):

• _clck — a persistent Clarity user identifier used to associate multiple page views with a single user; set by Microsoft for approximately 1 year.

• _clsk — a session cookie that links the page views within a single browsing session; set by Microsoft for approximately 1 day.

• Microsoft may also set additional cookies (for example CLID, ANONCHK, MR, MUID and SM) on its own clarity.ms and related Microsoft domains to operate the service and to detect and prevent fraud.

Our legal basis for loading Microsoft Clarity and for the Clarity cookies above is your consent (Article 6(1)(a) of the GDPR and Article 7, IX of the LGPD). You can refuse the “analytics” category in our consent banner the first time you visit, and you can change your mind at any time by opening the “Cookie settings” link in the footer of our pages. Withdrawing your consent stops further Clarity activity, but does not affect the lawfulness of any processing carried out before the withdrawal.

Microsoft acts as the recipient of this data and processes it on its own infrastructure, including in the United States and other countries where Microsoft operates. Microsoft states that it relies on its own safeguards for international transfers of personal data, including standard contractual clauses and its participation in the EU–U.S. Data Privacy Framework. We do not control these safeguards and provide this information for transparency only; you can review Microsoft’s own privacy statement and Clarity disclosures for further details.

Apart from the Meta Pixel and Microsoft Clarity described in this section, we do not currently use any other third-party advertising or analytics tool on the pages we operate. If we add one in the future, we will update this Policy and request your consent again where required.

For the avoidance of doubt, the Meta Pixel and Microsoft Clarity described in this section run only on the pages we operate. We do not inject the Meta Pixel, Microsoft Clarity, or any other advertising or analytics tracker, into User Pages — any such tools placed on a User Page are the sole responsibility of the User who configured them.

The Service is operated using infrastructure and service providers that may be located in countries other than your own. By using the Service, you understand that your personal information may be transferred to, stored, and processed in those countries, where data-protection laws may differ from the ones in your country. Where required, we rely on appropriate safeguards (such as the standard contractual clauses approved by the European Commission) for international transfers.

We keep your account and page information for as long as your account is active. If you delete your account, we delete or anonymise your personal information within a reasonable period, except where we are required or allowed by law to keep it longer (for example, billing records for tax purposes, security logs needed to investigate abuse, or short-term retention in backups, logs, caches, storage replicas or dispute-resolution records).

Residual copies may remain for a limited period in backups, logs, search engine indexes, browser caches, internet archives or other third-party systems we do not control, and immediate removal from those systems may not be possible.

Inactive free accounts may be removed after an extended period of inactivity, with notice where reasonably possible.

We use technical and organisational measures designed to protect your information, including encrypted transport (HTTPS), hashed credentials, parameterised database queries, CSRF protection, rate limiting, abuse detection, and access controls on our internal systems. No system, product or method of transmission or storage is perfectly secure, and we cannot and do not guarantee absolute security. You acknowledge that you provide and publish information through the Service at your own risk.

You are responsible for keeping your credentials confidential, using strong and unique passwords, enabling any available additional authentication, keeping your devices secure, and choosing carefully what information you publish on your User Page or disclose to third parties. Notify us promptly at [email protected] if you suspect any unauthorised access to your account.

To the maximum extent permitted by applicable law, we are not liable for any unauthorised access, loss, alteration, disclosure, theft or destruction of information that occurs despite our reasonable security measures, including incidents caused by you, by other Users, by visitors, by third-party service providers, by linked destinations, or by events beyond our reasonable control. Where required by law we will notify affected Users and authorities of qualifying security incidents within applicable deadlines.

The Service is intended exclusively for adults. You must be at least 18 years old to create an account, publish a User Page or otherwise use the Service. We do not knowingly direct the Service to, or knowingly collect personal information from, anyone under 18. If you believe a minor has provided us with personal information or created an account, please contact us at [email protected] and we will take appropriate steps to disable the account and delete the information.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you and request a copy.

• Correct or update inaccurate or incomplete personal information.

• Delete your personal information, subject to limited legal exceptions.

• Object to or restrict certain processing of your personal information.

• Receive your information in a portable format and ask us to transfer it to another provider where technically feasible.

• Withdraw consent where we rely on consent to process your information.

• Lodge a complaint with your local data-protection authority.

You can exercise most of these rights directly from your account settings, including deleting your account. For anything else, contact us at [email protected]. We may need to verify your identity before responding to your request. In some cases we may refuse or limit a request where the law allows, where the rights of others would be affected, or where the relevant data is controlled by a User or third party rather than by us. If your request concerns information collected by a User or a third-party destination linked from a User Page, you should contact that User or third party directly.

This Privacy Policy describes our current data practices and is provided for transparency. To the maximum extent permitted by applicable law, our liability in connection with this Privacy Policy and our processing of personal information is limited and excluded to the same extent as set out in our Terms of Service (including the disclaimers and limitation of liability sections), which are incorporated into this Privacy Policy by reference.

We are not responsible for the privacy or data-protection practices of Users, visitors, third-party service providers, linked destinations, social networks, search engines, browsers, internet archives or any other party we do not control, or for any decision you make based on this Privacy Policy. Nothing in this Privacy Policy excludes or limits any liability that cannot be excluded or limited under applicable law.

We may update this Privacy Policy from time to time to reflect changes to the Service, our data practices, or applicable law. When we make changes, we will update the “last updated” date at the top of this page and, for material changes, we will take reasonable steps to notify you (for example, by email or through an in-product notice) before they take effect.

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at [email protected].