Privacy Policy

Last updated: 2026-11-02

1. What we collect

When you create an account: your email address, account/business name, and (optionally) a backup password and two-factor authentication secret.

When someone clicks a link, scans a QR code, or submits a form you created: timestamp, the destination it routed to, referral source, country (derived from IP, not stored as a precise location), device type, operating system, and browser (parsed from the request's user agent), and the raw IP address and user agent string.

Billing: the payment method selected at checkout (ABC Money, Whop or Cryptomus) processes your payment details directly. We do not store full card numbers or wallet private keys ourselves.

When domain attribution is enabled, we record the platform hostname used to create and access your account and to place an order. We also count successful page views by day, platform hostname and product, without storing visitor identifiers, IP addresses, full page paths or query strings in these aggregate counters.

2. How we use it

• To operate the Service: routing links, rendering forms and Multilink pages, authenticating you.
• To show you analytics about your own links, forms, and pages.
• To send account-related email: login codes, billing receipts, renewal reminders.
• To secure the Service: detecting abuse, enforcing rate limits, investigating suspicious activity.

3. Data retention

Click and scan analytics are retained for a default of up to 400 days on accounts with an active paid subscription (this window can be extended per plan) and up to 30 days on accounts without one, after which they're permanently deleted. Account records are kept until you close your account or request deletion.

Aggregate platform-domain traffic counters are retained for up to 90 days while collection is active. Account-domain attribution follows account retention; purchase-domain information follows the associated financial record retention.

4. Who we share it with

We do not sell your data. We share the minimum necessary with the service providers that make WAPRO work: our cloud hosting provider (Amazon Web Services), the selected payment processor (ABC Money, Whop or Cryptomus), authentication provider (Google Firebase when selected), and our transactional email provider. Each processes information under its applicable terms.

5. Cookies

We use secure session and request-protection cookies. Customer sessions are scoped to the platform domain family you use; administrator sessions are separate and host-only. If domain attribution is enabled, a signed first-party cookie remembers the first platform hostname and product within that domain family for up to 30 days, without assigning a visitor identifier. We don't use third-party advertising cookies.

6. Your rights

You can access, correct, or delete your account data at any time from your account settings, or by contacting us -- that request channel handles every jurisdiction's rights request today, including GDPR access/erasure/portability requests and CCPA "do not sell" requests (we don't sell personal data in any jurisdiction, so that request is already satisfied by default). We aim to respond within 30 days. If you're located somewhere with additional statutory rights beyond what's described here, contact us and we'll address the specific request; we haven't yet published a jurisdiction-by-jurisdiction breakdown of every regional variation.

7. Security

We use industry-standard practices to protect your data, including encryption in transit (TLS), optional two-factor authentication, and access controls limiting who can see account data. No system is 100% secure, and we can't guarantee absolute security.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

9. Contact

Questions about this policy or your data? Contact us.