Privacy Policy
This Privacy Policy explains how Smart Link Flow (smartlinkflow.com) collects, processes, and protects information from both registered creators and smart link visitors.
We value your privacy. Smart Link Flow never sells, rents, or monetizes personal information to data brokers. Telemetry and click data are utilized strictly to route music listeners, display aggregated performance analytics, and forward configured ad conversion signals to your connected ad platforms.
1 Data Controller & Operator Identification
This Privacy Policy applies to the website, services, and applications operating under Smart Link Flow (accessible at smartlinkflow.com).
For general account operations, Smart Link Flow is the Data Controller of your creator account data. For fan email subscriptions collected directly on artist smart links, Smart Link Flow acts as the Data Processor on behalf of the artist (who acts as the Data Controller).
If you have questions regarding this policy or wish to exercise data rights, reach our Data Protection contact at: smartlinkflow@gmail.com.
2 Information We Collect
We collect information in three distinct categories:
- Account Registration: Name/display title, email address, password (cryptographically salted and hashed).
- OAuth Sign-In Data: If signing in with Google OAuth, we receive your verified Google ID, email, name, and profile picture URL.
- Smart Link Configuration: Track titles, artist names, artwork URLs, audio snippet preview URLs, streaming destination URLs (Spotify, Apple Music, etc.), and custom short slugs.
- Ad Telemetry Tokens: Meta Pixel Dataset ID, Meta Conversions API Access Token, TikTok Pixel ID, and Google Ads Conversion IDs.
- Technical Metadata: IP address (truncated/anonymized in analytics logs), browser User-Agent, device type (mobile, tablet, desktop), operating system, and HTTP Referrer header.
- Ad Campaign Click Tags: URL query parameters including UTM tags (
utm_source,utm_medium,utm_campaign), Meta Click ID (fbclid), TikTok Click ID (ttclid), and Google Click ID (gclid). - Interaction Timestamps & Events: Page load timestamp, audio snippet play duration, and destination button taps (e.g. Spotify click).
Email addresses voluntarily submitted by music listeners via the "Never Miss a Drop" VIP email capture form on an artist's smart link.
3 How We Use Information & Legal Bases (GDPR Art. 6)
We process personal data based on the following legal grounds:
Authenticating accounts, hosting and routing smart links, generating native deep links, and maintaining user dashboards.
Generating aggregate, privacy-preserving performance metrics for creators, preventing fraud/spam, and maintaining system uptime.
Dispatching third-party ad tracking pixels configured by the creator and capturing voluntary fan email subscriptions.
Responding to valid legal processes, copyright notices, or enforcing our Terms of Service.
4 Third-Party Ad Tracking & Conversions API Telemetry
Creators can attach advertising tracking beacons to their smart links to measure marketing performance. When enabled by the creator, the following third-party telemetry mechanisms may be initiated:
Dispatches client browser events (fbq) and synchronized server-to-server payloads (graph.facebook.com) with a unique event_id to allow Meta to deduplicate duplicate signals. Data may include destination link clicked, hashed user agent, and click IDs.
Fires standard client events (ClickButton, ViewContent, Subscribe) to TikTok Ads Manager for sound and track ad optimization.
Dispatches conversion events (conversion, view_item) to Google Ads accounts specified by the creator.
Each third-party platform processes data in accordance with their respective privacy policies. Visitors may control or opt out of personalized tracking via their respective ad provider settings (e.g., Meta Ad Preferences, TikTok Privacy Settings, Google Ad Center).
5 Cookies, Tracking Consent & Preference Management
Smart Link Flow uses cookies and local browser storage to provide secure authentication, customize interface preferences, analyze platform usage, and facilitate privacy-compliant ad conversion tracking under GDPR and the ePrivacy Directive:
1. Strictly Necessary Cookies (Always Active) Essential
Includes linkbase_session (secure HttpOnly auth token), cookie_consent (stores your consent choices for up to 1 year), and CSRF tokens. Required for website operation and security.
2. Functional & Personalization Cookies (Optional)
Saves creator UI settings, dark theme parameters, dashboard filter states, and audio player volume levels across visits.
3. Analytics & Performance Cookies (Optional)
Measures aggregated visitor metrics, page views, and outbound streaming platform clicks to provide creators with real-time performance analytics.
4. Marketing & Conversion Pixels (Optional)
Enables Meta Pixel (fbq), TikTok Pixel (ttq), Google Ads (gtag), and 1st-party attribution tokens (_fbc, _ttclid) for conversion optimization. Ad tracking only activates if you grant marketing consent.
6 Fan Email Collection & Dual Data Roles
Data Controller vs. Data Processor Responsibility:
When a music fan enters their email on a smart link to receive release updates, the Creator is the Data Controller. Smart Link Flow acts as a Data Processor that stores this record securely and allows the creator to download a CSV list.
Creators are required to maintain their own privacy policies, obtain proper marketing consent, and provide unsubscribe mechanisms in accordance with CAN-SPAM, GDPR, and CASL. Fans wishing to delete their email from an artist's subscriber list may contact the artist directly or email us at smartlinkflow@gmail.com for assistance.
7 Data Security, Infrastructure & Retention
We implement modern technical and organizational security controls:
- Encryption in Transit: All HTTP traffic is secured via TLS 1.3 encryption with strict transport security.
- Cryptographic Credential Hashing: User passwords are encrypted with individual cryptographic salts.
- Cloud Infrastructure: Hosted on Google Cloud Platform (GCP Cloud Run) in secured European and global data centers with 24/7 monitoring.
Retention Period: Creator accounts and release settings are retained as long as the account remains active. Aggregated telemetry metrics are stored to provide performance charts. If an account is deleted, all associated personal records and subscriber data are purged within 30 days.
8 Your Rights (GDPR, UK GDPR, CCPA/CPRA)
Depending on your jurisdiction, you have specific data protection rights:
To exercise any of these rights, email us at smartlinkflow@gmail.com. We will respond within 30 calendar days.
9 Children's Privacy
Smart Link Flow is not directed to children under the age of 13 (or under 16 for EU residents). We do not knowingly collect personal data from children. If we discover a minor has provided personal information, we will delete it promptly.
10 Contact & Privacy Requests
For questions, data deletion requests, or privacy concerns, please contact our team: