1. Data controller
The data controller is Nexora Links, operator of Nexora Links(https://nexoralinks.com). Contact for data protection matters: support@nexoralinks.com.
2. What data we collect
- Account data: email address, password (encrypted), OAuth provider identifier (e.g. Google) if you sign in via an external provider.
- User content: titles, descriptions, images, and destination URLs of your monetized links.
- Technical data: IP address, user agent, country (based on IP), timestamps of link visits.
- Billing data: PayPal address or bank account number (provided solely for payout purposes), payout history.
- Cookies and similar technologies: login session, language preferences, anti-fraud identifiers.
3. Purposes and legal bases
- providing the service (Art. 6(1)(b) GDPR) - account creation, link management, settlements;
- legal obligations (Art. 6(1)(c) GDPR) - accounting, tax settlements;
- legitimate interest (Art. 6(1)(f) GDPR) - fraud prevention, security, statistics, defense against claims;
- consent (Art. 6(1)(a) GDPR) - personalized ads, email marketing, non-essential cookies.
4. Data recipients
We share data only with vetted processors, to the extent necessary:
- hosting and database provider (Lovable Cloud / Supabase);
- advertising networks (e.g. Google AdSense) - ad delivery and measurement;
- payment operators (PayPal, banks) - solely for payouts;
- analytics tool providers - aggregated and pseudonymized data;
- government authorities - upon lawful request.
5. Transfers of data outside the EEA
Some of our providers (e.g. Google) may process data in the USA or other countries outside the EEA. In such cases we rely on Standard Contractual Clauses approved by the European Commission and additional technical safeguards.
6. Retention period
- account data - for the duration of the account and up to 12 months after deletion (for claims purposes);
- billing data - 5 years (tax regulations);
- security logs - up to 12 months;
- cookies - according to their individual validity period (from session to 24 months).
7. Your rights
Under GDPR, you have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- erasure of data ("right to be forgotten");
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time (without affecting prior processing);
- lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).
To exercise these rights, write to support@nexoralinks.com. We respond within 30 days.
8. Cookies
We use essential cookies (login session, security, preferences) as well as advertising and analytics cookies from partners. You can manage cookies in your browser settings. Disabling some cookies may limit the Service's functionality.
9. Google and partner ads
The Service uses Google AdSense and other advertising networks. Google uses DoubleClick cookies to display ads based on a user's prior visits. You can opt out of personalized ads at google.com/settings/ads and youronlinechoices.eu.
10. Security
We use transmission encryption (HTTPS), password hashing, access control (Row-Level Security), regular backups, and security monitoring. Nevertheless, no system is 100% secure - in case of a suspected incident, we will notify you promptly in accordance with Art. 34 GDPR.
11. Children
The Service is not directed at persons under 16 years of age and we do not knowingly collect their data. If you believe your child has provided us with data, please contact us - the data will be deleted.
12. Policy changes
This policy may be updated. We will inform you of significant changes via the Service or by email. The current version is always available at this address.