Privacy Policy

This Privacy Policy explains what personal data Netlink.bio ("Netlink", "we", "us") collects, how we use it, and the choices you have. By using Netlink, you agree to this policy.

1. Who We Are (Data Controller)

Netlink.bio is operated by PT Netlink Labs Global, registered under NIB 0308260078406. Registered address: Jl. Karna Sosial No.128, Kelurahan Akcaya, Pontianak Selatan 78121, Indonesia. For privacy-related requests, contact contact@netlink.bio.

2. Data We Collect

• Account data: name, email, username, avatar, password (via Supabase Auth)
• Profile content: bio, CV, business page, links you add
• Certificate files: PDF files you attach to certifications on your CV (Silver plan and up)
• Wallet data: your wallet address, and your wallet's linked Google email (if you create a smart wallet)
• Verification data: identity/business verification status and documents, processed via our KYC/KYB partner
• Contacts: contacts you save for payments
• Usage data: local currency preference, theme preference, consent records
• Technical data: IP address (captured when you accept a policy), device/browser information
• Visitor analytics (public pages): when someone visits a public Netlink profile, CV, or business page, we record the page type, the date and time, the referring website (domain only, for example google.com), and which link was clicked. To count unique visitors without storing IP addresses, we store a pseudonymous identifier created by one-way hashing the IP address and browser user-agent. We may also identify automated visits from AI assistants and search crawlers by the user-agent they declare.

We do not collect your wallet's private keys or seed phrase. Wallet creation and signing are handled by our wallet infrastructure partner (Sequence WaaS); we never have access to your keys.

AI and search discoverability of public pages

Public pages (profile, CV, and business page) are intentionally structured with machine-readable data (schema.org JSON-LD and our llms.txt file) so that AI assistants and search engines can accurately read and reference them, in addition to human visitors. By publishing a public page, you acknowledge and agree that its content may be accessed, read, and referenced by automated AI agents and crawlers, and you remain responsible for what you choose to include on it.

Certificate files on your CV

What we store. If you are on the Silver plan or higher, you can attach a PDF file (up to 2 MB) to a certification on your CV. We store the file in a private storage bucket linked to your account. We do not review or verify its content.

Who can see it. You can see it from your dashboard. Anyone who opens your public CV can view the file through the "View Certificate" button, so treat every attached file as public. The file is not indexed by search engines, and its storage location is never shown on the page. We access it only to run the service, handle abuse reports, or comply with the law.

Watermark. Each time someone opens a certificate, we add a watermark to every page of the copy they see. It shows your CV address, the date it was shown, and the words "unverified copy". Your original file is not changed. Netlink does not verify that any certificate is genuine.

What not to upload. Do not upload documents that contain sensitive data, such as ID numbers, home addresses, or bank account numbers. Only upload files you have the right to share.

How to delete. Use Remove or Replace on the certification in your dashboard, then save your CV. The file is then deleted from our storage. If you downgrade to the Basic plan, the file is no longer shown on your CV but stays stored until you remove it. If you delete your account, your certificate files are deleted when the deletion is completed, after the 45-day grace period described in Section 7.

3. How We Use Your Data, and Our Legal Basis

• To provide and operate your Netlink profile, CV, business page, and wallet features: necessary to perform our contract with you
• To verify your identity or business where you request verification: contract performance / legal obligation
• To process token transfers and display transaction history: contract performance
• To communicate service updates, rewards, and account notifications: legitimate interest
• To show page owners statistics about visits to their public pages (views, clicks, and traffic sources): legitimate interest
• To comply with legal and regulatory obligations (e.g. fraud prevention, tax/audit requirements): legal obligation

Where we rely on your consent for a specific purpose (such as accepting this policy), you may withdraw that consent at any time from your Privacy & Data dashboard. See Section 7.

4. Third Parties We Work With

We share limited data with service providers who help us operate Netlink:

• Supabase: database and authentication hosting
• Vercel: application hosting
• Sequence WaaS: smart wallet infrastructure
• LI.FI: token swap routing
• Our KYC/KYB partner: identity and business verification
• Alchemy Pay: fiat on/off-ramp (where used)

These providers only receive the data needed to perform their function and are not permitted to use it for their own marketing purposes.

Identity verification. Identity verification is carried out by our partner Didit, which processes your ID document and face data on our behalf. We do not store these documents in our own database. We keep only your verification status, dates, and a session reference. Didit keeps verification data for the retention period set in our account with them. See Didit's privacy policy at didit.me for details.

5. Blockchain Data

Netlink Pay transactions occur on the Polygon blockchain, which is public and immutable by design. Wallet addresses and transaction history recorded on-chain cannot be edited or deleted by us or by you. This is separate from the personal data stored in our own database.

6. International Data Transfers

Our service providers (including Supabase and Vercel) store or process data in the following regions: application hosting and serverless functions in the United States (Vercel, Washington, D.C. region), with static content delivered through Vercel's global edge network, and database hosting in Sydney, Australia (Supabase). Where we transfer personal data internationally, we rely on our providers' standard contractual safeguards. If you are located in the European Economic Area (EEA), UK, or Switzerland, you can request more detail on these safeguards by contacting us using the details in Section 1.

7. Your Rights

From your Privacy & Data dashboard, you can:

• Access / View a summary of the data categories we store about you
• Export (data portability) your personal data as a downloadable file, in a structured, machine-readable format. The export covers your profile, links, CV, business page, contacts, consents, verification, order and wallet records, and a download link for each certificate file (the link expires after 7 days)
• Correct inaccurate profile data directly from your dashboard at any time
• Manage consent and view your consent history, including withdrawing consent
• Object to processing based on legitimate interest (e.g. service communications) by contacting us
• Request restriction of processing in certain circumstances by contacting us
• Request account deletion (erasure): processed after a 45-day grace period, during which you may cancel the request

Some data (such as blockchain transaction records, or data we are legally required to retain) cannot be deleted even after account closure.

If you have completed identity verification or made a payment, we keep your account and the related verification and payment records for as long as legal, tax, or fraud-prevention requirements apply. During this time your deletion request stays on hold and your account is not deleted. Accounts without verification or payment records are deleted after the 45-day grace period.

If you are located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data lawfully.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

8. Data Retention

We retain your data for as long as your account is active, and afterward for as long as legal, tax, or fraud-prevention requirements apply.

Individual visit records for public pages are deleted after 90 days. Only daily aggregated counts are kept, for as long as the page owner's account is active.

Certificate files are kept until you remove them or your account deletion is completed.

9. Security

We apply access controls (including database-level row security) so that your personal data is only accessible to you and to systems that need it to operate the service.

10. Changes to This Policy

When we make material changes to this policy, we will ask you to review and re-confirm your consent the next time you log in.

11. Contact

Questions about this policy or your data can be sent to contact@netlink.bio or via our support channel from within the app.