This Data Processing Addendum ("DPA") supplements the Terms of Service and applies where LinkSafe processes personal data on your behalf in the course of providing the Service. To countersign, email hello@linksafe.io.

This is a template. Have counsel review before public launch.

1. Roles

You are the data controller of personal data you submit to the Service. LinkSafe is the data processor and acts on your documented instructions.

2. Scope and purpose

LinkSafe processes the personal data necessary to operate the Service: account information, saved link metadata, notes, tags, preferences, and technical logs.

3. Subprocessors

We use the following subprocessors. By using the Service you authorize them.

Lovable Cloud (Supabase) — application hosting, database, authentication, storage. Region: United States (primary).
Cloudflare, Inc. — global edge runtime and CDN for the LinkSafe web app. Region: global edge.
Stripe, Inc. — billing and payments. Region: United States.
Google (Gemini via Lovable AI Gateway) — AI enrichment of saved link metadata. Prompts and responses are not used to train models. Region: United States.

We will notify customers of material changes to this list at least 30 days in advance.

4. Security

See our Security page for the technical and organizational measures we currently rely on.

5. Data subject requests

We will assist you in responding to data subject requests (access, correction, deletion, portability) within a reasonable timeframe.

6. Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data.

7. International transfers

Where personal data is transferred outside its origin jurisdiction, we and our subprocessors rely on Standard Contractual Clauses or an equivalent lawful mechanism.

8. Deletion

Upon termination we will delete or return your personal data within 30 days, unless retention is required by law.

9. Contact

DPA requests: hello@linksafe.io.