Privacy Policy

Effective from November 1, 2026
Version 2026-11-01

What personal data we store, why, for how long, and your rights. The service rules are set out in the Terms and Conditions.

1. Data controller and contact

This privacy policy applies to the processing of personal data on MyLinks, operated by Imagine AI. The Data Controller is:

Controller: GANDINI CAROLINA LIA, commercial name Imagine AI
Tax ID (CUIT): 27-31988482-9
Address: Ruta Panamericana 0, M:E18, Barrio Aguaribay Sierras y Lagunas, Chacras de Coria, 5505, Mendoza, Argentina
Privacy contact: hola@imagineai.space

This policy is governed by Argentine Personal Data Protection Law 25.326. The Terms and Conditions govern overall service use.

2. Two roles: Controller and Processor

We process personal data in two distinct capacities:

As Data Controller: for the personal data of account holders (such as account credentials, contact information, billing records, and session history).
As Data Processor: when account owners use the «Collect emails» block or configurable forms. The page owner is the Data Controller deciding why and how visitor data is collected. MyLinks stores that data strictly on their behalf and under their instructions, does not use it for our own purposes, does not sell or share it with third parties, and deletes it when the page owner removes it or cancels their account. Full obligations are set out in the Terms and Conditions.

3. What data we process, purposes and legal basis

We process account data to deliver the service, verify access, prevent fraud, and comply with statutory duties:

Email address: required to open your account, verify your identity, send transactional alerts, and manage login sessions. Legal basis: contract performance.
Session and passkey data: cryptographically hashed session tokens and public WebAuthn credentials to securely authenticate your logins. Legal basis: contract performance and security.
Page content: texts, links, usernames, and images you upload to publish your bio page. Legal basis: contract performance.
Technical and security logs: IP address on authentication attempts and API rate limiting counters to prevent brute-force attacks and abuse. Legal basis: legitimate interest in platform security.
Cross-border transfers: hosting and computing infrastructure provided by Cloudflare, Resend, and Google in the United States. Legal basis: your express, informed consent provided during sign-up.

4. Data retention periods

We retain personal data strictly for as long as needed to fulfill the stated purposes or comply with legal obligations:

Data category	Retention period	Purpose and details
Magic login links	Link expires in 15 minutes	Deleted approximately 49 hours after expiration from database.
Rate limiting logs	Less than 4 hours	Volatile counters linked to hashed IP to protect login endpoints.
Active sessions	30 days rolling, up to 90 days	Expired sessions deleted ~25 hours after expiration; revoked sessions deleted 24 hours after sign-out.
Email change codes	Code expires in 15 minutes	Deleted between 1 hour 15 minutes and 2 hours 15 minutes after request; counter retained 26 hours.
Passkey challenges	5 minutes expiry	Temporary cryptographic challenges deleted 1 hour later.
Cookies (__Host-session, __Host-oauth)	Up to 30 days (OAuth: 10 minutes)	Session and OAuth cookies with Secure, HttpOnly, and SameSite=Lax flags.
Uploaded images	Until account deletion	Cannot be deleted one by one yet; preserved until account erasure or upon manual request by email.
Account deletion	Immediate effect, 5-day grace period	All pages and sessions go offline immediately; permanent and irreversible erasure after 5 calendar days.
Visitor emails collected	Until deleted by page owner	Retained until deleted by the page owner or until the page owner cancels their account.
Configurable form responses	Until deleted by page owner	Retained in database until deleted by the page owner or until the page owner cancels their account.
Deleted username	Permanently reserved	Reserved to prevent identity theft or impersonation of former users.

5. If you visit a page or leave your email

When you visit a public page on MyLinks:

Page views: we aggregate visits via Cloudflare Analytics Engine (country, general device type, referrer category, and any ?de= tag). We do not store your IP address, user agent, or tracking cookies.
Link clicks: we register the specific block and item clicked, country, device, and campaign tag. We do not record your origin URL.
Submitting your email: if you use the «Collect emails» block on someone's page, your email address is saved alongside the submission timestamp, page ID, block ID, and a temporary ip_hash (a truncated cryptographic HMAC of your full IPv4 address or IPv6 /64 prefix, retained for 3 hours solely to investigate spam and abuse). The block displays an explicit consent checkbox («I agree that [name] may email me»). Your email is hosted on Cloudflare servers in the United States on behalf of the page owner.

If you wish to access, correct, or delete your email address, you should contact the page owner directly. If you email us at hola@imagineai.space, we will promptly forward your request to the page owner and notify you.

6. Cookies and browser storage

On the administrative dashboard, we use essential local storage keys (ml.page, ml.signup, ml.install) and an offline service worker caching /api/, /auth/, and /img/ assets. On public-facing user pages, we do not set any tracking cookies or third-party advertising trackers.

The home page sets a single functional cookie, ml_lang, only if you choose a language with the selector in the footer or with the link in the notice that suggests another language: it remembers your choice for one year (Secure, SameSite=Lax; no personal data) and is valid for mylinks.place and its subdomains (for example app.mylinks.place, the dashboard), so the dashboard respects it. The home page also keeps the local storage key ml-home-lang-dismiss, only if you close that notice, so it is not shown again. Otherwise we do not set any cookies or store anything there.

To show you the home page, the dashboard, the sign-in screens and our emails in a language you understand, we use your country, which Cloudflare derives from your IP address and reports to us on each visit; we do not store it for this purpose. Spanish-speaking countries see Spanish, Italy sees Italian, Brazil and Portugal see Portuguese, and everywhere else sees English. When you create an account, the resulting language is saved as your account language (you can change it in Settings). Your browser's language setting does not decide the language by itself: we use it to suggest, with a notice you can close, switching language and, only as a fallback, if we cannot work out your country (for example, if the dashboard cannot look it up in time).

7. Service providers and international data transfers

To operate MyLinks globally, we partner with reliable infrastructure providers whose servers are located in the United States:

Cloudflare Inc.: hosting, content delivery network (CDN), key-value storage (KV), object storage (R2), and D1 database. As our network provider, Cloudflare sees connecting IP addresses.
Resend Inc.: transactional email delivery (login links, security notices).
Google LLC: optional Google Sign-In (accessing only openid and email scopes). If you use the optional menu import feature from a document or photo, files are sent to Google (Google Cloud / Gemini API, United States) under Google's paid commercial API terms, solely to extract and structure sections, dishes, and prices; MyLinks does not store the uploaded files.

The United States is not currently recognized by Argentina's Personal Data Protection Agency (AAIP) as providing an adequate level of data protection. Accordingly, international data transfers are based on your express, informed consent provided during registration, supplemented by contractual data processing agreements and standard contractual clauses where applicable. Our internal administrative interfaces do not expose visitor emails or private messages to administrative personnel without authorized technical audit logging.

8. Third-party photos and videos

User avatars and profile images are hosted directly in Cloudflare R2. Uploaded photos cannot be deleted one by one yet; they are removed when the account is deleted or upon verified email request. When a page includes embeds from third-party platforms (such as YouTube, TikTok, or Spotify), those services may process data in accordance with their respective privacy policies when you interact with the player.

9. Security

We implement appropriate technical and organizational safeguards to protect your personal data, including TLS encryption in transit, strict passwordless authentication, SHA-256 token hashing, Content Security Policies (CSP), and automated rate limiting.

10. Your rights and how to exercise them

You have the right to access, rectify, update, export, or delete your personal data, as well as revoke consent at any time:

From the dashboard under Settings, you can download a full data export or delete your account.
If your terms acceptance is pending, your account is suspended, or you prefer email, you may exercise all rights by writing to hola@imagineai.space.
Argentine regulatory notice (Res. AAIP 14/2018, art. 3): «THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, in its capacity as the Controlling Body of Law No. 25.326, has the power to address complaints and claims filed by those whose rights are affected by non-compliance with prevailing personal data protection standards.» Access requests must be resolved within 10 calendar days; rectification and deletion requests within 5 business days, at intervals not less than six months (art. 14, inc. 3, Law 25.326).

11. Children's privacy

MyLinks is not directed to children under 13. Individuals aged 13 to 17 may only use the service with the verifiable consent of a parent or guardian. If we discover an account created by a minor under 13, we will promptly delete it.

12. If you use MyLinks from the European Union

If you are located in the European Union, you benefit from the rights guaranteed under Regulation (EU) 2016/679 (GDPR), including the rights of access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with your local supervisory authority (such as the Garante per la protezione dei dati personali in Italy). MyLinks is operated by Imagine AI from Argentina, a country recognized by the European Commission under Decision 2003/490/EC as providing an adequate level of data protection. In the event of discrepancy between language versions, the Spanish version (Política de privacidad) shall prevail.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we introduce changes affecting your statutory rights, obligations, or personal data handling, we will notify you by email at least 30 days before the changes take effect. Non-substantive adjustments take effect upon publication.

Version 2026-11-01, effective November 1, 2026. View Terms and Conditions.