ViaLink Privacy Policy

Overview

Linpert, Inc. (“Company,” “we,” “us,” or “our”), a Delaware corporation with its principal place of business in Wilmington, Delaware, is committed to protecting the personal information of users of the ViaLink service (the “Service”) in accordance with applicable data protection laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and, where applicable, the EU and UK General Data Protection Regulation (“GDPR”). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights available to you.

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes:

• Membership registration and management (identity verification, fraud prevention, notifications)
• Provision of the Service (deep link creation, click redirection, deferred deep linking, attribution analytics, dashboard)
• Marketing and advertising (new service development, customized services, and event information, where consent has been obtained)
• Service improvement (access analysis, usage statistics, quality enhancement)

Article 2 (Categories of Personal Information Processed)

The Company collects the following categories of personal information:

• Sign-up information: email address, encrypted password, name
• Optional sign-up data: profile image, company name
• Social login data: email, name, and profile image via Google OAuth
• Service usage data: IP address, browser type, operating system information, device model, screen resolution, timestamps
• Deep link click data: click IP address, User-Agent, referrer, hashed device fingerprint
• Payment information: collected via Stripe, Inc., our third-party payment processor; the Company does not store card numbers

Article 3 (Retention Periods)

The Company retains personal information for the following periods, in accordance with its data retention policy and applicable law:

• Member information: retained until the Member withdraws from membership
• Contract and payment records: retained for five (5) years
• Customer complaint and dispute records: retained for three (3) years
• Advertising and display records: retained for six (6) months
• Website access logs: retained for three (3) months
• Deep link click fingerprint data: retained for seventy-two (72) hours for Service operation purposes

Article 4 (Third-Party Sharing)

The Company does not sell or share personal information with third parties, except as described in this Policy, where required by applicable law, or with your consent.

Article 5 (Service Providers)

The Company engages the following service providers (subprocessors) to process personal information on its behalf:

• Amazon Web Services, Inc. – cloud hosting and infrastructure; retained for the duration of Service use
• Google LLC – social login via OAuth; retained until membership withdrawal
• Stripe, Inc. – payment processing; retained in accordance with Stripe’s own retention practices

An up-to-date list of the Company’s subprocessors, including the purpose of each engagement and the country in which it processes data, is available at vialink.app/subprocessors. The Company will provide advance notice, through that page or by email, before engaging a new subprocessor, consistent with the notice period set out in the Company’s Data Processing Agreement.

Article 6 (Your Rights)

Subject to the additional regional rights described in Article 11, you may request to:

• Access the personal information the Company holds about you
• Correct inaccurate personal information
• Delete your personal information
• Restrict or object to the Company's processing of your personal information

You may submit such requests through your account settings or by emailing security@vialink.app. The Company will respond without undue delay.

Article 7 (Data Destruction)

• When personal information becomes unnecessary, such as upon expiration of the applicable retention period or fulfillment of the purpose for which it was collected, the Company will destroy the personal information without undue delay.
• Electronic files are deleted using methods that prevent recovery; paper documents are shredded or incinerated.

Article 8 (Security Measures)

The Company implements the following measures to protect personal information:

• Passwords are encrypted using the bcrypt hash function
• All communications are encrypted using TLS 1.3
• Access to personal information is restricted to personnel who need it to perform their duties
• Intrusion detection systems are in place
• Access records are retained for at least one year

Article 9 (Cookies and Automatic Collection)

The Company uses cookies to maintain login sessions and analyze Service usage. You may refuse cookies through your browser settings, although doing so may affect features that depend on being logged in.

Article 10 (Contact Information)

For questions about this Privacy Policy or to exercise your rights, please contact:

Article 11 (Regional Provisions)

• EEA/UK residents (GDPR): In addition to the rights described in Article 6, you have the right to data portability, the right to object to processing, the right to withdraw consent at any time, and the right to lodge a complaint with your local supervisory authority.
• California residents (CCPA/CPRA): You may request disclosure of the personal information the Company has collected about you and opt out of the sale or sharing of your personal information. The Company does not sell or share your personal information with third parties for cross-context behavioral advertising. The Company will not discriminate against you for exercising your rights under the CCPA/CPRA.
• International data transfers: Where the Company transfers personal information internationally, it relies on appropriate safeguards, including Standard Contractual Clauses, to ensure an adequate level of protection.
• Children's privacy: The Service is not directed to children under the age of 13 (or 16 in the EEA). If the Company becomes aware that it has inadvertently collected personal information from a child, it will delete that information promptly.

Article 12 (Governing Law; Changes to this Policy)

• This Privacy Policy is governed by the laws of the State of Delaware, consistent with the governing law provision of the Company's Terms of Service.
• The Company may update this Privacy Policy from time to time. Material changes will be announced in the same manner described in the Company's Terms of Service.
• This version of the Privacy Policy is effective as of September 1, 2026 and supersedes all prior versions.