getallmysocials Privacy Policy
Service provider identity
This Privacy Policy explains how getallmysocials processes personal data, the purposes and legal bases of processing, applicable retention periods, and the rights of individuals.
1. Data Controller
The data controller is the sole trader identified in the “Service provider identity” block above (name, registration number, business address).
Privacy contact: support@getallmysocials.link. DPO: none has been appointed.
The Controller determines the purposes and means of processing described in this Policy.
2. Categories of Data Subjects
Data subjects may include registered Users, public-profile Visitors, paying customers, support contacts, and individuals whose personal information is included in user-generated profiles or links.
3. Categories of Personal Data
3.1. Account Data
Email addresses, usernames, account identifiers, securely stored password hashes, language preferences, login information and account status.
3.2. Profile and Content Data
Display names, profile pictures, biographies, link titles, destination URLs, link order, visibility settings, security configuration and design preferences.
Destination URLs may remain stored server-side even where omitted from public profile HTML. This does not guarantee that destination URLs will remain confidential.
3.3. Technical and Security Data
IP addresses, User-Agent strings, request timestamps, requested URLs, security events, session identifiers, challenge outcomes and technical metadata reasonably necessary for security.
3.4. Analytics Events
Profile views, click attempts, redirect decisions, timestamps, profile and link identifiers, and available device, referral or approximate geographic information, where processing is lawful and proportionate.
Traffic may be classified as likely_human, likely_automated or unknown. These labels are probabilistic and do not conclusively establish whether a Visitor is human or automated.
3.5. Payment and Billing Data
For paid services, we may process billing names, addresses, tax identifiers, subscription plans, prices, currency, transaction references and payment status.
Payments are processed or intended to be processed through Stripe (including the customer portal for subscription management). We do not store complete payment card numbers or card security codes in the getallmysocials application database.
3.6. Communications
Support messages, contact information, request contents and related support history.
4. Purposes and Legal Bases
| Purpose | GDPR legal basis |
|---|---|
| Account registration and authentication | Article 6(1)(b), performance of a contract |
| Operation of profiles and links | Article 6(1)(b), or Article 6(1)(f) for appropriate Visitor processing |
| Infrastructure security and fraud prevention | Article 6(1)(f), legitimate interests |
| Security logging and incident investigation | Article 6(1)(f), or Article 6(1)(c) where applicable |
| Proportionate operational analytics without advertising profiling | Article 6(1)(f), where its requirements are satisfied |
| Accounting and tax compliance | Article 6(1)(c), legal obligation |
| Subscription and payment administration | Article 6(1)(b) |
| Optional marketing, if introduced | Article 6(1)(a), or another lawful basis applicable to the specific channel |
Our legitimate interests include protecting the Service, preventing abuse, resolving technical problems and obtaining proportionate aggregated operational statistics.
We assess necessity, proportionality and the impact on data subjects before relying on legitimate interests.
Access to or storage of information on end-user devices is separately governed by applicable electronic communications rules. A GDPR legal basis does not replace any consent required under those rules.
5. Security Checks and Automated Assessment
- We may use Cloudflare WAF, Managed Challenge, Turnstile, rate limiting and related security measures.
- Security systems may automatically assess request risk and require verification or temporarily restrict access.
- Automated classifications can produce errors, including false positives affecting legitimate Visitors.
- Incorrect access restrictions can be reported at support@getallmysocials.link.
- Before deployment, we will assess whether any relevant automated decision-making falls within Article 22 GDPR. Where decisions produce legal or similarly significant effects, applicable safeguards will be implemented.
6. Recipients and Service Providers
We may use the following recipient categories:
- Application hosting: Laravel Cloud — production application and database according to the current environment configuration.
- Database or object-storage provider: part of hosting, unless separated.
- Cloudflare and relevant Cloudflare group entities for DNS, CDN, WAF, Managed Challenge / Turnstile, and optionally Email Routing for inbound support mail.
- Stripe and relevant Stripe group entities for payments, subscriptions, the customer portal and payment fraud prevention (when payments are enabled).
- Outbound email provider (e.g. Resend / Postmark / SES): per production configuration once system email sending is enabled.
- Support or monitoring provider: per production configuration (if used).
- Public authorities where disclosure is legally required.
Depending on the particular processing activity, a recipient may act as a processor, an independent controller or in another legally applicable capacity.
We will enter into Article 28 GDPR data processing agreements with relevant processors.
7. International Data Transfers
- The use of global infrastructure and payment providers may involve transfers of personal data outside the European Economic Area.
- Where a European Commission adequacy decision applies, transfers may rely on Article 45 GDPR.
- Where appropriate, other transfers rely on safeguards under Article 46 GDPR, particularly Standard Contractual Clauses, together with supplementary measures where necessary.
- Providers in use (especially Cloudflare and Stripe) may process data in the United States or other countries outside the EEA; transfers rely on applicable mechanisms (adequacy decisions / EU–US Data Privacy Framework, or Standard Contractual Clauses under Article 46 GDPR), according to each provider’s then-current terms.
- Information about applicable safeguards, including copies where legally available, may be requested at support@getallmysocials.link.
8. Data Retention
We retain personal data only for the period necessary for its purposes or required by law.
| Data category | Retention |
|---|---|
| Account information | For the account's lifetime and any subsequent period necessary for legal claims |
| Profile content and destination URLs | For the profile's lifetime, followed by deletion under the technical retention schedule |
| Temporary Visitor sessions | Until configured expiration |
| Raw security logs | 90 days (or shorter according to operational needs) |
| Raw analytics events | 90 days |
| Aggregated analytics | until no longer needed or anonymized |
| Support communications | 24 months after the communication ends |
| Accounting and tax records | As required by law; accounting records are generally retained for 10 years under applicable Slovak requirements |
| Backups | 30-day rotation and deletion schedule |
After the applicable retention period, data is deleted or anonymized unless further retention is legally required or properly justified for legal claims.
9. Data Subject Rights
Subject to GDPR requirements and exceptions, individuals may exercise their rights to:
- Access personal data.
- Rectify inaccurate data.
- Erase personal data.
- Restrict processing.
- Data portability, where applicable.
- Object to processing based on legitimate interests.
- Withdraw consent where processing relies on consent.
- Avoid decisions based solely on automated processing where Article 22 GDPR applies.
Requests may be submitted to support@getallmysocials.link.
We ordinarily respond within one month. This period may be extended in circumstances allowed by GDPR.
We may reasonably verify the requester's identity where necessary.
Individuals may lodge a complaint with the Slovak Data Protection Authority at www.dataprotection.gov.sk or another competent EU supervisory authority.
10. Requirement to Provide Data
Certain data is necessary to create accounts, authenticate Users and deliver requested functionality.
Failure to provide such data may prevent account registration or access to relevant features.
Where optional processing is introduced, the provision of related data will not be made a condition of basic Service access unless legally justified.
11. User-Published Personal Information
- Public profiles may contain personal information voluntarily published by Users.
- Users must not disclose third-party personal information without an appropriate legal basis or authorization.
- A User who independently determines the purposes and means of processing other individuals' data may act as a separate controller in relation to that processing.
- The actual allocation of data protection roles depends on the circumstances and cannot be determined solely by contractual labels.
12. Children
Account registration is restricted to individuals aged 18 or older.
We do not knowingly permit younger individuals to register accounts. Where an underage account is identified, we will take appropriate measures consistent with applicable law.
Public-profile access may require additional age-related restrictions depending on content.
13. Cookies and Similar Technologies
We use technologies required for login sessions, language settings, security checks and protected redirects.
Details are available in our Cookie Policy at /legal/cookies.
Under the currently described configuration, we do not use advertising trackers on the marketing website.
If technologies or processing purposes change, we will update this Policy and obtain consent where legally required before the relevant technology is used.
14. Security
We implement appropriate technical and organizational safeguards, including encrypted connections, access controls, security monitoring and automated-abuse prevention.
No system is completely secure. Personal data breaches are handled in accordance with GDPR, including notification obligations where applicable.
15. Policy Updates
We may update this Policy when processing activities, providers or legal obligations change.
Material changes will be communicated appropriately. Where a new processing purpose requires consent, we will obtain it before processing begins.
16. Contact
For privacy-related inquiries:
Email: support@getallmysocials.link
Postal address: Coburgova ulica 12, 917 02 Trnava, Slovenská republika