Privacy Policy

Elevate Links is a SaaS bio-links platform for creators, brands, and businesses, operated from the State of Florida, United States. We are the data controller for any personal data collected through the service.

For any matter related to this policy, you can reach us at elevatehuboficial@gmail.com.

We only collect what is necessary for the product to work:

• Account: email, name, and profile picture.
• Product usage: aggregated, anonymous analytics about views and clicks on your pages (we do not identify your visitors).
• OAuth credentials: tokens from the platforms you voluntarily connect, plus the minimum public profile data each platform exposes (handle, follower count, channel name, avatar URL). Specifically: Instagram (handle, public profile), TikTok (handle, follower count), YouTube (channel name and URL), Facebook (basic profile when used for sign-in), Google (email and basic profile when used for sign-in), Mailchimp (list ID, API key).
• Content you upload: your links, images, banners, backgrounds, and the configuration of each page.
• Payments: fully processed by Stripe. We only keep the last 4 digits of the card and minimal billing information. We never see or store full card numbers.
• Billing address: collected at checkout via Stripe so Stripe Tax can calculate the correct sales tax for your state and we can comply with US tax law.
• Verification documents: if you request the verified badge, you upload a government ID. The document is stored encrypted in private storage, only reviewed by our team, and deleted within 30 days after the verification decision (approved or rejected).
• Poll vote deduplication: when a visitor of one of your pages votes in a poll widget, we store a SHA-256 hash of their IP address (with a private salt) so the same visitor cannot vote twice. We do not store raw IP addresses.
• Cancellation feedback (optional): if you cancel a paid plan, we may ask you why. Your answer (and any optional free-text comment) is stored linked to your account for product analytics.

• To deliver the service and keep your account running.
• To support you when you have a question or a technical issue.
• To improve the product (understand which features are used most and which are not).
• To send transactional communications (account changes, receipts, important notices). We will not send you marketing without your explicit permission.
• To comply with legal obligations (tax, court orders).

We process your data under one of these legal bases:

• Consent: when you connect third-party integrations or subscribe to optional communications.
• Contract performance: for everything required to deliver the service you signed up for.
• Legitimate interest: for aggregated analytics, product improvement, and abuse prevention.

We do not sell your data. We share it only with the providers strictly needed to operate:

• Supabase: hosting, database, and authentication.
• Stripe: payment and subscription processing.
• Mailchimp, Google, Meta, and similar: only when you voluntarily connect one of these integrations from your dashboard.
• Authorities: when there is a legal obligation or a valid court order.

Email_signup widgets, contact_form widgets and similar tools on your bio page let your visitors leave their email or phone number. Those records are stored in our database for your own use.

For those contacts, you are the data controller and we act as a data processor on your behalf. That means:

• You are responsible for having a legal basis to collect each contact (consent, contract performance, etc.).
• You must respect the rights of the people whose data you captured (access, deletion, etc.).
• We will not use your contacts for our own marketing or share them with anyone else. They live in your dashboard only.
• When you delete your account, all the contacts you captured are deleted with it.

We use Stripe Tax to automatically calculate and collect US sales tax where it applies. When you check out, Stripe asks for your billing address to determine the correct tax rate for your jurisdiction. The tax we collect is remitted to the corresponding state authority.

Florida does not currently tax SaaS subscriptions, so customers based in Florida see no sales tax on their invoice. Customers in states that do tax SaaS (such as NY, TX, WA, PA, MA, etc.) see the applicable tax added at checkout.

We use the minimum cookies required for login and language to work, plus an anonymous cookie to deduplicate analytics.

We also use the Meta Pixel (Facebook Pixel) to measure the effectiveness of our ad campaigns. The pixel tracks page views and key conversion events (registration, plan upgrade, purchase) and sends them to Meta so we can optimize our advertising and build similar audiences. You can opt out of this in your browser settings or via the cookie preferences banner.

Full detail in our Cookie Policy.

Your data is processed mainly in the United States, where our providers operate. Some providers may store backup copies or operate sub-processors in the European Union or other jurisdictions:

• Supabase (database, auth, storage) — US.
• Stripe (payments and tax) — US, with global processing.
• Resend (transactional email) — US.
• Vercel (hosting) — global edge network.
• Meta (advertising pixel) — global infrastructure.

When data leaves the US or EU, our providers rely on Standard Contractual Clauses or equivalent safeguards approved by the European Commission.

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) give you additional rights:

• The right to know what personal information we collect about you, why, and who we share it with.
• The right to delete your personal information, subject to legal exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising.
• The right not to be discriminated against for exercising your rights.

Do Not Sell or Share My Personal Information: we do not sell your personal information for money. We do share limited identifiers (such as your email or hashed identifiers) with Meta for advertising optimization, which CPRA can classify as “sharing”. To opt out, email us at elevatehuboficial@gmail.com with the subject “Do Not Sell or Share - California”.

Regarding your personal data, you have the right to:

• Access: know what data of yours we hold.
• Rectification: correct inaccurate or incomplete data.
• Erasure: delete your account and the associated data. You can find the instructions in Data deletion.
• Portability: receive your data in a structured format.
• Objection: object to processing based on legitimate interest.

To exercise any of these rights, write to us at elevatehuboficial@gmail.com from the email address linked to your account. We will reply within a maximum of 30 days.

• While your account is active, plus 30 days after deletion (in case you decide to come back or we need to resolve an incident).
• Tax and billing data is kept for up to 5 years, as required by law.
• Anonymized logs without personally identifiable information may be kept for aggregated analysis and abuse prevention.

Elevate Links is not directed at children under 16. We do not knowingly collect data from people below that age. If you believe a minor has created an account, write to us and we will delete it immediately.

If we update this policy, we will notify you by email and through a notice in your dashboard before the changes take effect. The last updated date will always be shown at the bottom of this page.