Privacy policy
Last updated: May 24, 2026
This Privacy Policy explains how Link2L, the link-in-bio platform at l2l.to ("Link2L", "we", "us"), collects, uses, and shares your data. It applies to every Link2L product — creator profiles, the shop, forms, custom domains, and the ad network — and to signing in to Link2L with Google, Apple, or TikTok.
1. Data we collect
From you as a user: email, password (bcrypt-hashed), your profile (display name, bio, avatar, links), your forms and products. From visitors: aggregated metrics (views, clicks, approximate country via Cloudflare, browser language, device type). From shop buyers: email and minimal purchase data. From advertisers: company info, contact, and Stripe balance.
2. Cookies
We use a technical cookie (NEXT_LOCALE) to remember your language. An anonymous visitor cookie (l2l_vid, random UUID, 1 year) for ad frequency capping — it contains no personal data. Auth.js session cookies when you sign in. AdSense cookies only if you accept the consent banner.
3. Advertising (AdSense)
We only load Google AdSense cookies if you accept the banner. Without your permission no personalized ads are served and no marketing cookies are stored. Targeting info is limited to country, language and profile category — we never share individual identity.
4. Conversion pixel
When an in-house ad network advertiser installs our pixel (https://l2l.to/p.js) on their landing page, we record the conversion event tied to the click that originated it. This uses a URL param (l2l_cid), not third-party cookies. We don't identify the visitor individually; we only aggregate events per campaign.
5. Shop — buyer data
When a buyer purchases a digital product, we store their email, amount, payment status and signed download link. We process payment via Stripe (their terms apply). We share the buyer's email with the selling creator so they can provide support. We keep orders for accounting reconciliation during the applicable legal period.
6. Forms — submission data
When someone submits a form on your profile, the data is stored and emailed to you. As the creator operating the form you are the data controller; we act as processor. We don't use that data for our own purposes.
7. Your rights (GDPR)
You can access, correct, export or delete your data at any time from Settings. You may object to processing or request restriction by contacting us. If you believe we process your data improperly, you can file a complaint with your local data protection authority.
8. Retention
We keep your data while your account is active. If you delete it, we erase account, profile, links, forms, responses and products within 30 days at most. Ad events (impressions, clicks) are kept raw for 90 days then aggregated. Billing data is kept for the applicable legal period (typically 5-7 years).
9. Subprocessors we share data with
Stripe (payment processing, creator payouts), Amazon SES (transactional + verification email), Google AdSense (advertising — opt-in), Cloudflare (CDN + approximate visitor country), OpenAI (IAB profile classification — only public bio and links). Each operates under their own terms and GDPR compliance.
10. Contact
For any privacy request, reach out through the contact page. We handle access, rectification and deletion requests within 30 days at most.