Security and Privacy

Linkssi operates from South Africa and takes account security and visitor privacy seriously. This summary points to official policies and describes platform safeguards — not legal advice.

Full documents: Privacy Policy, Terms of Service.

Account security

• Passwords stored as bcrypt hashes — never plaintext.
• Sessions use HTTP-only cookies; dashboard actions require login.
• CSRF tokens protect state-changing forms in the dashboard.
• Password reset via email link only — support never resets passwords in chat — password reset guide.

Use a strong unique password and enable careful team invite practices — Team Access.

Payment data

Card numbers are handled by Paddle (merchant of record). Linkssi does not store full PAN. Billing management via Paddle portal — How Billing Works (Paddle).

Visitor and lead data

Your bio pages, forms, and Smart Sites pixel collect visitor interactions you configure:

• Form fields submitted become leads in your CRM.
• Analytics aggregates clicks and referrers on bio pages.
• Smart Sites pixel records page paths on external sites you instrument — disclose this to visitors per POPIA/GDPR with appropriate consent banners on your sites.

Linkssi does not sell visitor analytics to third parties.

Data location and POPIA

Privacy Policy at Privacy Policy describes processing purposes, retention, and rights for account holders and end visitors. Customers act as responsible parties for their own marketing lists and form data exported from Linkssi.

Best practices

Export leads periodically for backup. Remove team access for departed staff immediately. On client Smart Sites, add cookie notices before pixel load where law requires.

Tip: Minimise form fields to what you actually need — less data collected means less compliance surface.

Data retention and deletion

Account holders may request export of lead data from CRM views on Pro+. Account deletion requests go through Contact us — we verify ownership before purging. Visitor pixel data on Smart Sites follows retention policies described in Privacy Policy; configure client sites to respect local consent requirements.

Subprocessors

Infrastructure providers process data on Linkssi's behalf under contract. Paddle processes payments; hosting and email delivery providers support application operation. Details appear in the Privacy Policy.

Your responsibilities as operator

When you collect leads via forms or track visitors via Smart Sites pixel:

1. Display appropriate privacy notice on your bio and external sites.
2. Collect only data you need for follow-up.
3. Honour unsubscribe and deletion requests for your marketing lists.
4. Do not export lead data to unsecured spreadsheets or share via unencrypted email.

Reporting issues

Suspected account compromise or data concern: Contact us with urgency in subject line.