Privacy Policy

In short

LinkTrail is a mobile deep linking and attribution platform. We collect personal data in two different situations, and they work differently.

If you are one of our customers — you signed up for an account, use the dashboard, or contact us — we decide how your data is used, and Sections 4 and 6 to 13 explain what we collect, why, and for how long.

If you are an end user of an app built by one of our customers, we handle click and install data about you on that customer's instructions. They decide what is collected; we act on their behalf, and their privacy notice governs it. Section 3 explains how to reach us anyway if you can't identify the app, and is honest about the limited purposes for which we use that data on our own account.

Our platform runs on servers in the European Union. We do not sell personal data. We do not use advertising identifiers — we never access the Apple IDFA or the Google Advertising ID. We do use device fingerprinting for attribution where other signals aren't available, which Section 5 describes plainly. We use cookies on our website only after you accept them. You can contact us at privacy@linktrail.io and you can complain to the Information Commissioner's Office.

1. Who we are

LinkTrail Ltd ("LinkTrail", "we", "us") is a company registered in England and Wales, company number 17312947, registered office 66 Paul Street, London EC2A 4NA, United Kingdom.

We are the controller for the personal data described in Section 4, and for the limited purposes described at the end of Section 3.

This policy covers our website at linktrail.io and our documentation, the dashboard at developer.linktrail.io, our link endpoints (including customer custom domains), our APIs, and our iOS, Android, React Native and Flutter SDKs. We refer to all of this as the Services.

2. Which law applies

We are established in the United Kingdom, so UK GDPR and the Privacy and Electronic Communications Regulations (PECR) apply to us, and the ICO is our lead supervisory authority. Because we offer the Services to customers and end users in the European Economic Area, EU GDPR also applies to that processing.

3. Two roles: controller and processor

Data protection law separates the party who decides why data is processed (the controller) from the party who processes it on someone else's instructions (the processor). LinkTrail is both, depending on whose data it is.

We are the controller for data about our own customers and prospects: people who visit linktrail.io, contact us, sign up for an account, administer a team, pay us, or raise a support ticket. Section 4 governs that data.

We are a processor for data about end users of our customers' apps: clicks on links, install signals, device identifiers, device characteristics used for attribution matching, and any custom payload the customer attaches to a link. Our customer decides what is collected and why. We process it under a data processing agreement, on their documented instructions, to provide attribution, deep linking and fraud detection back to them. The customer's own privacy notice governs that data.

If you are an end user of an app that uses LinkTrail and you want to exercise your rights, contact the app's developer — they are the controller and they hold the relationship with you. If you contact us instead, we will identify the relevant customer where we can and pass your request to them, and we will tell you we have done so, normally within one month. We cannot grant access, deletion or objection requests over that data on our own authority, because it is not ours to decide.

Where we use end-user data for our own purposes

We are open about this because it is a genuine exception to the paragraphs above. As well as processing end-user data on each customer's behalf, we use it for three purposes of our own, which makes us a controller for those purposes:

• Improving fraud detection. Fraud patterns only become visible across many apps at once — a device farm hitting twenty customers looks like noise inside any one account. We analyse signals across our customer base to develop and tune the heuristics that detect it.
• Aggregate statistics and benchmarks. We produce aggregate measures of platform performance, including match rates and attribution accuracy, some of which we publish or share with customers as benchmarks. These are aggregate figures and do not identify any individual.
• Product development and debugging. We use real processing data to diagnose faults, reproduce bugs and develop the Services.

Our lawful basis is legitimate interests (Art 6(1)(f)): operating a platform whose core promise is accurate, fraud-resistant attribution, which cannot be delivered from any single customer's data in isolation. We use the minimum data needed, we do not use it to build profiles of individuals for any purpose unrelated to fraud detection or service quality, and we do not disclose one customer's data to another in identifiable form. You can ask us for the balancing assessment behind this at privacy@linktrail.io, and you can object under Section 11.

4. What we collect as controller, and why

This table covers data where we decide the purpose — our customers, prospects and website visitors. Data collected through our link endpoints and SDKs is covered by Section 5 instead.

Where we rely on legitimate interests, you can ask us for the balancing assessment behind it, and you can object (Section 11).

Do you have to give us this data? Account and billing data are required to enter into and perform our contract with you — without them we cannot give you an account or take payment. Everything else is optional: you can decline analytics cookies, decline marketing, and use the Services without contacting support.

5. What we process as processor, on our customers' behalf

We set this out for transparency. Our customer, not LinkTrail, decides which of these are collected and configures consent inside their app. The lawful basis for it is theirs to establish, and their privacy notice governs it. Section 3 explains the separate, limited purposes for which we use this data on our own account.

How long we keep it. Raw click and install records, which include device-level signals, are retained for 13 months and then deleted by an automated purge job. Aggregated attribution reports, which contain campaign-level counts and no device identifiers, are retained for 3 years. Link endpoint and API logs are retained for up to 90 days, and request and response bodies captured for debugging are retained for 90 days. A customer can ask us to delete their data sooner, and we delete it on termination in line with the data processing agreement — see Section 12 on what that means for backups. Note that the analytics history included in each plan is a product feature and is not the same as these retention periods.

Device fingerprinting

Our attribution waterfall uses deterministic signals first — the Google Play Install Referrer, or a deferred click token carried through the install. Where neither is available, it may fall back to probabilistic matching: we look for a click with the same IP address and platform (iOS or Android) as the install, within a matching window of 7 days by default. Those two fields are the whole comparison — we do not collect or compare screen metrics, timezone, language/locale or device model, and our SDKs do not send them. The result is binary: a click is matched or it is not. There is no confidence score; what we record on each install is its match type — deterministic, probabilistic, or none.

This is device fingerprinting, and we describe it as such. Under Article 5(3) of the ePrivacy Directive and PECR regulation 6, reading information from a user's device in this way requires the end user's consent, and the European Data Protection Board confirmed in Guidelines 2/2023 that this applies to fingerprinting as much as to cookies. Legitimate interests is not an available basis for it. The same is true of reading the IDFV or App Set ID, and of writing the clipboard code described above.

The fact that we do not use advertising identifiers does not change this analysis, and we do not present it as if it did.

Because we act as processor here, obtaining that consent is the customer's responsibility. Our SDKs are built to support that: collection is gated on a consent signal from the host app by default, and where no consent signal has been given, no device data is collected. A customer can disable that gate in their SDK initialisation options, in which case responsibility for obtaining consent beforehand rests entirely with them.

Controls available to customers. Probabilistic matching is off by default for a new workspace and must be switched on deliberately; it can be switched off again, and the matching window changed, at workspace level. These controls do not currently operate per app or per link. A customer needing to separate one app from another must use separate workspaces.

6. Cookies and similar technologies

On our website we store one strictly necessary value to remember your cookie choice. Only if you accept do we set Google Analytics cookies to measure usage, and a Google Ads cookie to measure whether an ad click led to a signup. We use that Google Ads cookie for conversion measurement only — not for remarketing or personalised advertising — and we run no other advertising cookies.

Our banner offers Accept and Reject with equal prominence, and rejecting takes one click. You can change your choice at any time using "Cookie settings" in the footer of any page. Our Cookie Policy lists each cookie, its provider, purpose and duration.

The SDK and link signals described in Section 5 are separate from website cookies and are governed by the customer's own consent flows.

7. Who we share data with

We do not sell personal data. We share it in these situations.

Service providers and sub-processors who process data on our behalf under contract, restricted to our instructions and bound to confidentiality and security obligations:

We are also preparing to introduce Sentry (Functional Software, Inc.) for SDK and application error monitoring, processing in the European Union. It is not receiving data yet. We will update this list and notify customers before it begins.

We maintain this list and will update it when it changes. Stripe is not only our processor: it acts as an independent controller for fraud prevention, anti-money-laundering and its own regulatory obligations, and its own privacy policy governs that processing.

Ad networks and analytics tools, at our customers' direction. Where a customer configures an integration — Meta Ads, Google Ads, TikTok Ads, Apple Search Ads, Amplitude, Mixpanel, Segment, Braze, Iterable, BigQuery — we send attribution results to that destination on their instruction. The customer chooses the destination and is responsible for the lawful basis and consent covering it. These destinations are not our sub-processors; they receive the customer's data on the customer's own arrangements.

Our customers, where we act as processor and return attribution results to the controller of that data.

Professional advisers — lawyers, accountants and auditors, under professional duties of confidentiality.

Authorities and legal claims, where we are required by law or legal process, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of LinkTrail, our users, or the public.

A buyer or successor, in connection with a merger, acquisition, financing or sale of assets. We will tell you if your data becomes subject to a different privacy policy as a result.

8. Where data is processed, and international transfers

Our platform runs in the European Union. Our application, database and monitoring infrastructure are hosted in EU regions, and customer and end-user data is stored there. We do not operate a US region.

Content delivery is an exception. Our CDN and DNS are provided by Vercel, whose edge network operates globally. Every request is received at the edge location nearest the visitor — which may be anywhere in the world, including outside the UK and EEA — and is then passed to our EU application servers. The edge handles the connection and sees the visitor's IP address. Link resolutions are not cached at the edge: every click is resolved by our EU servers. Application processing and data storage remain in the EU.

Personal data may still be transferred outside the UK and EEA in three situations, and we apply safeguards to all of them:

• Website analytics. We contract with Google Ireland Limited, which uses Google LLC to process analytics data in the United States. That onward transfer relies on Google LLC's certification under the EU-US Data Privacy Framework and its UK Extension, backed by the EU Standard Contractual Clauses. This happens only if you accept analytics cookies, and you can decline or withdraw at any time.
• Business email. Our support and business mailboxes are provided by Titan, whose infrastructure and support operations are located in the United States and India. This affects email correspondence with us, not platform data.
• Session replay. We contract with Microsoft Ireland Operations Limited for Microsoft Clarity, which uses Microsoft Corporation to process session recordings in the United States. That onward transfer relies on Microsoft Corporation's certification under the EU-US Data Privacy Framework, backed by the Standard Contractual Clauses in the Microsoft data protection terms. This happens only if you accept analytics cookies.
• Content delivery. Vercel's global edge network handles every request at the node nearest the visitor, which routinely means outside the UK and EEA. This is covered by the EU SCCs and the UK Addendum in our agreement with Vercel, supported by a transfer risk assessment.
• Vendor support and administration. Several of our providers, including Render, Vercel and Microsoft, are US-parented. Even where data is stored in the EU, their support and engineering staff may be able to access it from outside the UK and EEA, which counts as a restricted transfer.

For those transfers we rely on UK adequacy regulations where they apply, and otherwise on the ICO's International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, supported by a transfer risk assessment.

You can request details of the safeguards in place for a specific transfer at privacy@linktrail.io.

9. Automated processing

Attribution matching. We compare a click against an install to identify the source of that install, recording a match type — deterministic, probabilistic, or none. The outcome is binary and carries no confidence score. This assigns credit to a marketing campaign. It does not produce legal or similarly significant effects on the individual whose install is matched, so Article 22 does not apply to it.

Fraud scoring. Every install is scored against velocity, device-signal and spoofing heuristics, and installs at or above the threshold are flagged in the customer's reporting. Scoring affects reporting only. LinkTrail does not make payment, payout or account decisions about any individual on the basis of a fraud score. Where a customer uses our reporting to decide whether to pay an advertising partner or affiliate, that decision is made by the customer in their own systems, and they are responsible for it — including for providing human review where the law requires it.

10. How we protect data

We use TLS 1.2 or above for all data in transit, with HTTP Strict Transport Security enabled and no plain-HTTP fallback, and AES-256 encryption at rest for the production database, its replicas and its backups. Internal access is limited to a small number of authorised personnel on a least-privilege basis, with multi-factor authentication enforced at organisation level on our hosting, source control and network providers. Production, staging and development are separate environments with separate credentials. Customer SDK API keys are stored only as SHA-256 hashes and are never retrievable after creation. An immutable audit trail records changes made through the dashboard. Automated dependency scanning alerts us to known vulnerabilities in third-party dependencies, and we apply security updates on review.

We do not currently hold an independent security certification and do not currently operate scheduled independent penetration testing. Our infrastructure is hosted in the European Union.

No system is completely secure. If a personal data breach occurs we will notify the ICO and affected individuals where the law requires it.

11. Your rights

Where we are the controller, you have the right to:

• access the personal data we hold about you, and get a copy;
• rectify data that is inaccurate or incomplete;
• erase your data in certain circumstances;
• restrict how we process it while a dispute is resolved;
• object to processing based on legitimate interests — including the purposes in Section 3 — and to direct marketing at any time. For marketing this right is absolute and we will always stop;
• portability — receive data you gave us in a structured, machine-readable format, where processing is based on consent or contract and is automated;
• withdraw consent at any time where consent is our basis, without affecting processing already carried out; and
• complain to a supervisory authority.

To exercise any of these, email privacy@linktrail.io. We respond within one month, and will tell you if we need to extend that by up to two further months for a complex request. We may need to verify your identity first. Exercising your rights costs nothing and we will not treat you differently for doing so.

If your request is about an app that uses LinkTrail, see Section 3 — we act as processor and will pass your request to the app's developer.

Device-level controls. Because we do not use advertising identifiers, resetting your advertising ID will not affect our attribution. What does affect it is the consent prompt shown by the app you are using: declining it stops our SDK collecting device data at all. On iOS you can also review app permissions in Settings → Privacy & Security. On Android, Settings → Privacy → Ads controls ads personalisation generally.

Complaints. You can complain to the ICO at ico.org.uk, on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are in the EEA, you can complain to your national supervisory authority. We would rather hear from you first, at privacy@linktrail.io.

12. Deletion and backups

When data reaches the end of a retention period in Sections 4 or 5, when you delete your account, or when you ask us to delete it, we begin deleting it straight away and complete removal from our active production systems within 7 days. Deletion runs as a controlled process rather than an instantaneous wipe, which is why it takes days rather than seconds. Deleting your account is not reversible.

Residual copies remain in two places, each on its own expiry cycle:

• Database backups and point-in-time recovery archives, which expire on a rolling basis up to 12 months. These are held encrypted, are not used for any purpose other than disaster recovery, and are not searched or restored to serve a request.
• Request and response logs held for debugging, which expire after 90 days. These are not searched or exported to serve a request, and access is limited to personnel diagnosing a fault or a support issue.

Deletion is therefore complete in production within 7 days, and complete across all copies once the relevant log or backup has expired. Where we certify deletion in writing, the certificate covers production systems and states both positions.

We may retain data for longer only where the law requires it — for example the billing and tax records in Section 4 — and where we do, it is used only for that purpose.

13. Children

The Services are sold to businesses and are not directed to children. You must be 18 or over to create an account, and we do not knowingly collect personal data from anyone under 18 through our website or dashboard.

End users of our customers' apps may include children, depending on the app. Customers must not use our SDKs or link endpoints in apps directed to children under 16, or under the age of digital consent applicable in the end user's country where that is lower, without our prior written agreement. Where we do agree, the customer is responsible for establishing a lawful basis before sending us data about children, and for configuring the Services accordingly — including disabling probabilistic matching.

If you believe a child's data has reached us, contact privacy@linktrail.io.

14. Changes to this policy

We update this policy when our practices, technology, or the law change. The version number and "last updated" date at the top always reflect the current version. Where a change materially affects how we use your data, we will tell you by email or through the dashboard before it takes effect.

15. Contact

Questions, requests and complaints: privacy@linktrail.io

Security reports: security@linktrail.io

Post: LinkTrail Ltd, 66 Paul Street, London EC2A 4NA, United Kingdom

Appendix: US residents

If you are a resident of a US state with a comprehensive privacy law — including California, Virginia, Colorado, Connecticut and Texas — you may have rights to know what personal information we hold about you, to obtain a copy, to have it corrected or deleted, and to opt out of targeted advertising and of the sale or sharing of personal information.

We are a UK company and our platform runs in the European Union. We do not sell personal information, and we do not use it for cross-context behavioural advertising of our own. Where a customer configures us to send their attribution results to an advertising platform, that is the customer's processing decision and their disclosures apply.

To make a request, email privacy@linktrail.io. We will honour applicable rights and will not treat you differently for asking. You may use an authorised agent, subject to verification.

Global Privacy Control. We honour the GPC browser signal. Where your browser sends it, we treat it as a valid opt-out request and as a decline of our cookie banner, and we set no analytics or advertising cookies. You can still choose to accept them afterwards if you want to.