Privacy Policy
How LinkToast collects, uses, and protects personal information when you use the platform.
This Privacy Policy explains what information LinkToast collects, how we use it, and what choices you have. It applies to all users of the LinkToast platform and services (the "Service").
1. Information We Collect
We collect information that you provide directly to us, including:
- Account information: name, email address, password
- Business profile information: company name, description, logo, website URL, industry type, business domain, verification status, and relationship connections with other verified businesses on the platform
- Verification contact email: the business email address you provide for domain verification purposes. This email is used to confirm domain ownership and to receive incoming relationship requests from other businesses on the platform. It is retained for as long as the associated business profile exists on the Service.
- Communication data: messages or inquiries you send us
- Usage data: how you interact with the Service, features used, pages visited
- Technical and security-related data: IP address, approximate geographic location derived from IP (city, region, country), request timestamps, browser type, and device information
2. How We Use Your Information
We process your personal data on the following lawful bases under the GDPR:
| Purpose | Lawful Basis |
|---|---|
| Providing and operating the Service | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional communications (account activity, verification codes) | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Analytics and product improvement (with consent) | Consent (Art. 6(1)(a)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
3. Information Sharing
We do not sell your personal information. We may share your information:
- With service providers (subprocessors) who help us operate the Service (see Section 4)
- With your consent when you explicitly authorize sharing
- To comply with legal obligations: court orders, regulatory requests, or applicable law
- To protect rights and safety: to enforce our Terms, prevent fraud, or protect users
4. Subprocessors
We use the following third-party service providers to operate LinkToast. Each subprocessor handles data in accordance with their own privacy policies and our data processing agreements with them.
| Subprocessor | Role |
|---|---|
| Amazon Web Services | Cloud hosting (application servers, file storage, CDN) and transactional email delivery via Amazon SES (verification codes, notifications, account emails) |
| MongoDB Inc. | Primary database (stores all user and business data) |
| Stripe Inc. | Payment processing and subscription management |
| Anthropic, PBC | AI-powered widget generation (processes the prompt text you enter, and for edits, the current widget layout configuration, to generate widget designs via the Claude API) |
| PostHog Inc. | Product analytics (consent-gated) |
| Google LLC | Sign-in with Google (OAuth authentication) and Maps Places API (location search) |
| OpenFreeMap | Map tile delivery. When interactive maps are displayed, your browser requests map tiles from OpenFreeMap servers, which may process your IP address and approximate location |
| CookieYes Ltd. | Cookie consent management |
| Logo.dev (Simple Casual, LLC) | Company logo lookup by domain, used to display brand logos for unverified/pending business relationships in the Studio editor |
This list may be updated from time to time. We will update this page when changes are made.
5. International Data Transfers
LinkToast is operated from the European Union (Estonia). Some of our subprocessors are located outside the EEA, including in the United States.
When we transfer personal data outside the EEA, we rely on appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Transfers to organizations covered by an applicable adequacy decision
You may request a copy of the transfer safeguards we rely on by contacting us at legal@linktoast.com.
6. Security and Fraud Prevention
To protect the integrity of the platform, we automatically collect certain technical metadata when users perform security-sensitive actions (such as account registration, login, or domain verification).
This may include:
- IP address
- Approximate geographic location (city, region, country) derived from IP
- Date and time of the request
- Basic request headers (browser type, device type)
This data is processed solely for security, fraud detection, abuse prevention, and audit purposes. It is not used for advertising or behavioral profiling.
7. Data Security
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
These include encrypted connections (TLS), access controls, and periodic security reviews. However, no method of transmission over the Internet or electronic storage is 100% secure.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
For EU/EEA residents (GDPR):
- Right of access: request a copy of the data we hold about you
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing based on legitimate interests
- Right to withdraw consent at any time (where processing is based on consent)
- Right to lodge a complaint with a supervisory authority. In Estonia: Andmekaitse Inspektsioon (AKI)
For California residents (CCPA/CPRA):
- Right to know what personal information is collected and how it is used
- Right to delete personal information
- Right to opt-out of the sale or sharing of personal information (we do not sell personal information)
- Right to correct inaccurate personal information
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising your privacy rights
- Authorized agents may submit requests on your behalf, subject to verification
To exercise any of these rights, contact us at legal@linktoast.com. We will respond within 30 days (GDPR) or 45 days (CCPA).
9. Cookies and Analytics Consent
We use cookies and similar technologies to keep the Service working and, where permitted, to understand product usage trends.
Essential cookies are required for the Service to function and cannot be disabled.
Analytics cookies are optional and activated only after you grant consent through our cookie banner (powered by CookieYes). If you decline analytics cookies, no analytics tracking occurs.
When analytics consent is enabled, we may process limited event data (page context, event name, timestamp, basic device/browser metadata) through PostHog and, where enabled, Google Analytics 4.
We do not intentionally collect direct identifiers such as your full name, email address, or payment card data through the analytics layer.
You can withdraw or change your cookie choices at any time via Cookie preferences. Withdrawing consent stops future analytics collection.
Do Not Track (DNT): Our Service does not currently respond to browser DNT signals. You can control analytics tracking through our cookie consent banner.
10. Third-Party Links
Our Service contains links to external websites and resources operated by third parties (such as payment processors, regulatory authorities, and referenced platforms). These links are provided for convenience and informational purposes. We are not responsible for the content or privacy practices of those external sites and encourage you to review their respective privacy policies before providing any personal information.
11. Embedded Widgets
LinkToast provides embeddable widgets (via iframe) that businesses may display on their own websites. These widgets are served as isolated iframes and do not collect, transmit, or process any data from visitors of the embedding website. LinkToast has no access to visitor behavior, identity, or any other information from third-party websites where our widgets are embedded.
12. Children's Privacy
LinkToast is a business-to-business platform intended for adults and companies. We do not target or knowingly collect personal information from individuals under the age of 18. If you become aware that a minor has provided us with personal information without appropriate consent, please notify us at legal@linktoast.com and we will take prompt steps to remove that information.
13. Data Retention and Deletion
We retain personal data only as long as necessary for the purposes described in this policy.
When you delete your account or a business profile, LinkToast permanently removes the associated data from active systems.
We may retain limited information where required to:
- Comply with legal and regulatory obligations
- Maintain financial and accounting records (typically 7 years under Estonian law)
- Prevent fraud and abuse
Such retained data is stored securely and is not used for marketing or operational purposes.
Security and audit logs collected for fraud prevention and abuse detection purposes are retained for [X months] and then permanently deleted.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
15. Contact Us
Data Controller:
Always Cold In Space OÜ
Registry code: 17532178
Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia
For privacy inquiries, to exercise your rights, or for any legal matters, contact us at:
legal@linktoast.com
Alternatively, you can reach us through our contact page.