Privacy policy

The controller for the processing described here is [provider name] ([postal address]).

Privacy contact: [privacy contact email]. Full provider details are in the Impressum.

Data protection officer: [name and contact, or “not required” with reasoning].

Locklay lets creators place a link behind a short step. Visitors open the link, complete a task (usually a sponsored one), and are then forwarded to the destination. Creators use an account and a dashboard to manage links and receive payouts; advertisers fund campaigns that supply the tasks. This policy covers all three groups.

Three groups of people are affected, and the data is different for each:

• Visitors who open a Locklay link, with or without an account.
• Creators with an account who create links and earn from them.
• Advertisers with an account who fund campaigns.

When a locker page loads, our server records one visit. The record contains:

• a one-way hash of your IP address (for IPv6, of the /64 network prefix), not the address itself;
• your country, where our network edge can determine it;
• your browser's user-agent string (shortened), and the browser, operating system and device type derived from it;
• the page that sent you, as origin and path only — any query string is dropped;
• the time, and which link was opened.

Why: to deliver the link, to show the creator aggregate statistics about their audience, to measure whether sponsored tasks are genuinely completed, and to prevent abuse and fraud. Legal basis: [Art. 6(1)(f) GDPR, legitimate interests in operating the service and preventing fraud — confirm with counsel]. Kept for: the configured retention period, 90 days by default (see section 13).

Your IP address is also used, briefly and for as long as a rate-limit window lasts, to limit how often one address can attempt an unlock, and it is part of what a one-time unlock token is bound to. Short-lived tokens expire within minutes.

Server logs. Our web server keeps an access log that records the IP address of each request together with the requested path (without the query string), the status and the time. The application logs errors without request bodies or query strings. They are used to operate and secure the service and are rotated automatically. [Retention period of the access log. The default rotation is by size, not by time, so a period has to be set in the deployment and stated here].

Most links ask you to complete a sponsored task before you continue. While you do, the page reports a small number of events to our server so the completion can be verified: that the task was opened, that the tab regained focus or was scrolled (at most once every few seconds), video progress where the task is a video, and that you asked to complete it. Each is stored with the task session and the time it happened; no scroll positions, page content or other details are sent with them.

The task itself usually opens a page that belongs to an advertiser or an advertising network. Once you are on that page, it is their service and their privacy policy that apply. They receive what your browser sends to any website (including your IP address and user agent). For networks that confirm completions server-to-server, an identifier of your task session is passed to them so the completion can be matched; it does not contain your name or email address.

Where a sponsored task is displayed inside the locker as an embedded ad, it runs in a sandboxed frame that is isolated from the rest of the page.

A creator can also put steps of their own in front of the task: opening an address of their choosing and waiting a number of seconds, or entering a password they set. When you open such an address, that site receives your IP address and browser details, as any site does, and its own policy applies. We note when you asked for the address so the waiting time can be checked on our side. That progress is kept for 30 minutes under a one-way hash of your IP address and is deleted when the unlock is granted. A password you type is sent to our server only to be compared with the stored hash; it is not stored, and wrong attempts are counted per hashed IP address for 15 minutes to limit guessing.

Unlocking a link can require a CAPTCHA, and so does creating an account and sending a report about a link. We use Cloudflare Turnstile. When it runs, your browser loads a script from challenges.cloudflare.com and Cloudflare receives signals needed to tell people from automation, such as your IP address and browser characteristics. Cloudflare handles that data under its own terms: [link Cloudflare's privacy policy and the data processing terms].

Every locker has a “Report this link” button. A report contains the link, the reason you chose, your explanation (10 to 1,000 characters), your email address, your name if you choose to give one, and your statement that the notice is made in good faith. We use the email address to confirm that we received the notice and, if needed, to follow up. It is never shown to the owner of the link. Please do not put anything sensitive in the free text. Reports are used to review and, where necessary, remove links and to act against accounts that break the terms.[How long notices are kept, and whether the person a notice concerns can be told who sent it].

Protection against false reports. A report can lead to a link being reviewed or taken offline, so we make it hard to file many of them under false pretences. For each report we also store a hashed form of your IP address (for IPv6, of your network prefix) and a hashed form of your email address, reduced to the mailbox behind it. They are used to limit how many reports one person can send in a day, to count how many different people reported a link, and, if someone abuses the form, to block that address or mailbox for a limited time. The email we send you contains a link to confirm that the report is yours; we store whether, and when, you followed it, and the link is stored only as a hash so it works once. A report that is not confirmed is still read by a person but counts for less. Someone who is blocked, or whose form looks automated, is shown the same receipt as everyone else, so the checks cannot be probed. A moderator sees the hashes only as short references. Reports are kept as stated in section 13; a block is removed when it ends. [Art. 6(1)(f) GDPR, legitimate interests in keeping the notice procedure usable and the service free of abuse — confirm with counsel].

A visitor pass lets a device skip the gate. To buy or restore one we process your email address (to send a code and to link the purchase to you), the payment, and an identifier of the device the pass was claimed on. Payments are handled by Stripe; we do not receive your card number. Stripe processes payment data as an independent controller for its own compliance purposes and as our processor for the payment itself: [link Stripe's privacy policy].

What we keep about the purchase. The version of the terms you accepted and the time you confirmed that the Pass should start at once (the confirmation required by the right of withdrawal). For a purchase without an account this is stored with the subscription at Stripe; for a purchase with an account it is also stored in our database. It is evidence of how the contract came about and is kept as long as claims from the contract can be made.

One trial per card. A trial is offered once per person and payment card (terms 4.1). To check this, we store for each subscription a keyed one-way value derived from the identifier Stripe gives the card or bank account you paid with. It is not your card number, your IBAN or Stripe's identifier, and it cannot be turned back into any of them; it only lets us see whether the same card paid for an earlier subscription. It is kept after an account is deleted, because otherwise deleting the account would reset the rule: [retention period and legal basis (legitimate interest in preventing repeated trials) to be confirmed with counsel].

Cancelling. The cancellation page asks for the email address you paid with and sends a one-time code to it (if no code can be sent, it shows how to cancel by email instead). The code is stored only as a hash, works once and expires after 15 minutes. When you cancel we send you a confirmation with the time we received it and the date the Pass ends.

Codes and confirmations are sent by email through [name of the email provider].

When you register and use the dashboard we process:

• account data: email address, username, display name, a password hash, and optional profile details;
• security data: sign-in sessions, two-factor settings and API keys (stored hashed);
• the links you create, their destinations, titles, appearance themes and domains;
• statistics about visits and completions of your links, including aggregate country and device breakdowns;
• your balance, earnings, referral relationships and payout requests, with the billing details you give for payouts;
• which version of the terms you accepted at sign-up and when, and your declaration that you are an adult using Locklay for business purposes (kept as evidence of the contract);
• for advertisers: company details you enter, campaigns, spend and deposits.

Payout details. To pay you we need the destination you enter — a PayPal email address, a bank account or IBAN, or a wallet address, depending on the methods currently offered. We use it to make that payment and keep the payout record as long as accounting rules require.

Billing details. Before your first payout we ask for the details that belong on the credit note we issue in your name to settle it: whether you act as a private person or as a business, your full legal name (or the name of your company), your street address, postal code, city and country and, for a business, your VAT ID and tax number. We use them for that credit note, for our accounting and where the law requires us to report. They are stored encrypted, and only the people who process payouts can read them. A copy of the address is saved with each payout request and kept with that payout record as long as accounting rules require, even if you edit your billing details later or delete your account. The billing details you can edit are removed when you delete your account.

Images in themes. Images you upload to a locker design are stored with it and served from our own servers. Some older designs still point at an image hosted elsewhere; the host of such an image receives the IP address and browser details of everyone who opens a locker that uses it. New designs cannot do this.

Emails about your account. We email you when a payout request is received, approved, sent, refused or cancelled, and when one of your links is disabled by our team, with the reason. You can also receive a weekly summary of the views, unlocks and earnings of your links. The payout mails and the weekly summary can each be switched off under Settings. [Legal basis for the weekly summary and whether it may be on by default or needs prior consent — confirm with counsel].

Webhooks. If you register an endpoint we send it signed events about your own links and money: a link was unlocked, earnings were credited, a payout changed status, a link was disabled. They contain no data about individual visitors. We store the endpoint address, the signing secret (encrypted) and a delivery log with each event and the status our request received. Delivered entries are deleted after 3 days, failed ones after 14.

Legal basis: [Art. 6(1)(b) GDPR for the contract; Art. 6(1)(c) for tax and accounting duties; Art. 6(1)(f) for security — confirm with counsel].

The public pages of this website — the home page, pricing and the legal pages — count page views with a small counter that runs on our own servers. It is not active on the dashboard, on sign-in or registration, or on locker pages, and it does not run in a browser that has signed in. It sets no cookie, writes nothing to your browser's storage, loads no script from anyone else and sends nothing to a third party. It is also switched off for you if your browser sends a Do Not Track or Global Privacy Control signal.

What is stored. For each day and each page, only totals and breakdowns: the number of page views, the number of visitors, the host of the website that sent you (for example news.example.com, not the full address), your country where it can be determined, and the class of device you use (desktop, mobile or tablet). These counts are aggregated. No IP address, no user-agent string and no identifier is stored with them.

How a visitor is counted once without an identifier. To count you one time per day rather than once per page view, the server computes a one-way hash from your IP address, your browser details and the date. That hash is held in short-lived memory for at most about 36 hours, is used only to check whether the same visitor has already been counted that day, and is never stored together with the counts. The date is part of it, so it cannot be used to recognise you on another day.

Why: to see which public pages are read and where visitors come from, so the site can be improved. Legal basis: [Art. 6(1)(f) GDPR, legitimate interests in understanding how the public website is used; state whether consent is needed under the national rules implementing Art. 5(3) ePrivacy, given that nothing is read from or written to the device — confirm with counsel]. Kept for: about 14 months (see section 13).

This is everything Locklay itself stores in your browser. All of it is needed for the feature you asked for, and none of it is used for advertising or tracking across sites. The account cookies are set by the API host, which is on the same site as this website.

Cloudflare Turnstile, Stripe and any sponsor page you open can set their own cookies or storage on their own domains; those are governed by their policies.

We use service providers to run Locklay. The list below must be kept in step with what is deployed:

• Hosting and infrastructure: [provider, region]
• CAPTCHA (locker unlock, registration and link reports): Cloudflare Turnstile
• Payments and billing portal: Stripe
• Email delivery: [Resend, Inc. (mail provider)]
• Website analytics: none. Page views on the public pages are counted on our own servers and are not shared with an analytics provider (section 9)
• Payouts: [payout providers, e.g. PayPal, bank, crypto service]
• Sponsor and advertising-network pages that you choose to open from a locker, as described in section 4. When you open one, the network receives the address of the page (which carries the task's id and, for survey networks, a pseudonymous id derived from the lk_vid cookie for that network only), and your browser sends it your IP address and browser details as with any website. [Name each network in use, e.g. CPX Research (Make Opinion GmbH, Berlin), and the agreement in place with it]
• The hosts of images in older locker designs that were set up with an external image link, as described in section 8
• Servers that a creator registers as webhook endpoints and addresses that a creator asks visitors to open as a step, as described in sections 4 and 8

We disclose data to authorities where the law requires it. Creators see aggregate statistics about their links; they are not given the IP addresses or identities of individual visitors.

[State which of the providers above process data outside the EU/EEA and the mechanism relied on (adequacy decision, standard contractual clauses). Cloudflare and Stripe are both US-headquartered.]

Retention is configurable by the operator and enforced by a daily clean-up job. Unless a different period is configured:

• visit records (hashed IP, country, user agent, referrer origin and path): 90 days;
• website page-view counts (per day and page: views, visitors, referrer host, country and device class; no personal data): about 14 months;
• task and unlock events: [number] days; aggregated statistics contain no individual-level data and are kept;
• expired visitor passes: 30 days after they expire;
• webhook delivery logs: 3 days once delivered, 14 days when delivery failed;
• progress through a creator's steps (opened address, accepted password): 30 minutes, or until the unlock is granted;
• account data: until you delete your account, then removed except where we must keep records;
• payment, payout and invoice records, including the billing address saved with each payout: [statutory retention period, e.g. 6–10 years];
• link reports: [period].

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where no legal ground requires us to keep it;
• restrict processing, and receive your data in a portable format;
• object to processing based on legitimate interests;
• complain to a supervisory authority, for example the one where you live or work.

To exercise a right, write to the privacy contact above. Because visit records are stored under a one-way hash of the IP address, we may ask you to help us identify which records are yours, and some cannot be tied to a person at all.

Signed-in creators and advertisers can change profile details in the dashboard settings, and can download a copy of their account data and delete (anonymise) their account in the “Your data” section of the account settings. Deleting requires confirming with your password and settling any remaining balance.

Passwords are stored hashed, API keys are stored hashed, IP addresses are stored as one-way hashes, and traffic is encrypted in transit. The session token is not kept in browser storage that page scripts can read. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

Locklay is not directed at children, and accounts are for adults. Sponsored tasks and third-party sites reached through a link may not be suitable for minors.

We will update this page when the service or the law changes and show the date of the latest revision at the top. [Define how material changes are announced].