Privacy policy

The controller under the GDPR for lynkpop.com is:

AIOS MediaOwner: Nderim SelmanajBusiness in preparation, start after approval expected in January 2027, currently no orders acceptedHolter Kirchplatz 433758 Schloß Holte-StukenbrockGermany

Email: info@aios-media.comPhone: +49 175 9965153

lynkpop is a service for personal pages with links and bookings at lynkpop.com/<name>. We only process personal data as far as needed to run the service. Connections are encrypted with TLS. There are no advertising cookies, no third party tracking and no sharing for advertising.

Each page is created by its owner (the page owner). The owner decides what is on the page and receives your details when you book an appointment with them. The owner is responsible for their content and for how they use your details for the appointment. We provide the technology, store the data and send the emails.

Service providers that process data on our behalf (hosting, delivery, email) are bound by contract to comply with the GDPR (Art. 28 GDPR). We delete data as soon as the purpose no longer applies and no legal retention duties prevent it.

lynkpop runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland, in a data center in Germany. The database and uploaded profile photos are stored there too. The legal basis is our legitimate interest in secure and reliable operation (Art. 6 (1) (f) GDPR) and, for accounts and bookings, the performance of the contract (Art. 6 (1) (b) GDPR).

All requests go through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages quickly and protects them against attacks, bots and overload. For this, Cloudflare processes technical connection data such as your IP address, the requested address, date and time and browser details.

The legal basis is our legitimate interest in a secure and stable service (Art. 6 (1) (f) GDPR). A transfer to the USA is possible. Cloudflare is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the EU Commission. In addition, the EU standard contractual clauses apply.

With every request our server automatically stores:

• IP address
• date and time of the request
• requested address and HTTP status code
• amount of data transferred
• website the request came from (referrer)
• browser and operating system (user agent)

We use this data for security, for example to fend off attacks, and to find errors. We do not combine it with other data and delete it automatically after 14 days. The legal basis is Art. 6 (1) (f) GDPR.

Necessary cookies do not require consent under § 25 (2) TDDDG. We set these:

• lp_session: only after you log in. Keeps you logged in for up to 30 days and is deleted when you log out. The value is a random key; we only store a one-way checksum of it.
• lp_lang: only when you switch the language. Stores “en” or “de” for one year.
• Cloudflare security cookie (for example __cf_bm): protects against automated attacks (see section 4).
• lp_consent: stores your choice in the cookie notice for one year, so we don't ask on every visit.

On the home page, when logging in or signing up and on these legal pages, a cookie notice asks for your consent to optional cookies in the categories statistics and marketing. “Necessary only” and “Accept all” are equal choices. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of the page. At the moment we do not use any cookies or services in either category. If we add such services, we only load them after your consent and list them here. The legal basis is then your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Page owners' pages and the booking pages have no optional cookies and therefore no notice.

In the dashboard your browser also remembers whether you chose the light or dark look (lp_theme in localStorage). This never leaves your browser.

Our statistics (section 9) work without cookies. Fonts are served from our own server, so there is no connection to Google or other providers.

When you create and edit a page, we process:

• name, email address and your address lynkpop.com/<name>
• your password, only as a one-way hash (bcrypt); we never know it in plain text
• time zone and language
• everything you add to your page: name, role, text, location, profile photo, links, social profiles, contact email, your imprint if you add one, booking types and availability

What you add to your page is public as long as the page is published. Your profile photo is stored on our server. If you replace or remove it, we delete the old file.

For “Forgot password” we email you a one-time link. It works for 60 minutes, and we only store a checksum of it. After a password change we log your account out on all devices. To prevent abuse we count in memory how often sign up, log in and password links are requested from your IP address and email address. The count lasts at most one hour and is never stored permanently.

For short links we store the destination, short name, label and whether the link is active. To stop anyone from abusing lynkpop for phishing or malware, we check every destination when it is created or changed: only full http(s) addresses, no IP addresses, no login details in the address and no other link shorteners. The legal basis is our legitimate interest in protecting visitors and the service (Art. 6 (1) (f) GDPR).

The legal basis is the performance of our contract with you (Art. 6 (1) (b) GDPR), and Art. 6 (1) (f) GDPR for abuse protection. We keep the data as long as your account exists. To delete your account, write to info@aios-media.com. We then delete your account, page, photo, bookings and statistics.

When you book an appointment on a page owner's page, we process:

• name and email address
• your message, if you write one
• chosen booking type and time
• your time zone and language, so times and emails fit you

We use this to create the appointment, send you a confirmation with a calendar file and a personal link to manage it, and inform the page owner with your details. The owner also sees the appointment in their dashboard. If you cancel, both of you get an email. If the owner cancels, you get an email. If you reply to one of these emails, the reply goes straight to the page owner. If the owner replies to their notice, it goes to you.

Anyone who knows the personal link can see and cancel the appointment, so please do not share it. The page behind the link is blocked for search engines. To prevent abuse we count in memory how often free times are looked up, and bookings and cancellations are made, from your IP address. The count lasts at most 10 minutes and is never stored permanently.

The legal basis is carrying out the appointment you book (Art. 6 (1) (b) GDPR), and Art. 6 (1) (f) GDPR for abuse protection. 12 months after the appointment we automatically delete the booking with all details, earlier if the page owner deletes their account. What the page owner does with your details outside lynkpop, for example in their own calendar or inbox, is their own responsibility.

Page owners see in their dashboard how often their page was viewed and which links were clicked. For each view or click we store:

• the profile, the date without time and the kind (view or click)
• the clicked link or short link
• the referring website, only as a domain, or a tag from the link you came through (for example ?ref=instagram)
• a checksum

The checksum keeps the same browser from counting more than once a day. We build it from the browser identifier, language setting, date, profile and a secret key, and shorten it. Your IP address is not part of it and is not stored for statistics. Because the date is part of it, the checksum changes every day, so views on different days cannot be linked.

We count after the page has loaded: a small script sends the viewed page to our server and stores nothing on your device. Clicks on links and short links are counted through a short redirect via lynkpop.com. Known bots are not counted. To stop anyone from inflating the numbers, we also count in memory how often counting happens from your IP address. This lasts at most one minute and is not stored. Page owners only see totals, never individual visitors.

The legal basis is the legitimate interest of page owners and our interest in offering them simple reach statistics (Art. 6 (1) (f) GDPR). You can object (section 12). We delete the entries automatically after 14 months.

We send emails such as booking confirmations, notices and password links through our own mailbox at ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Deutschland. lynkpop does not keep copies of sent emails. The legal basis is Art. 6 (1) (b) GDPR.

If you write to us, we process your details to answer you (Art. 6 (1) (b) GDPR if it is about your account, otherwise (f)). We delete them once the request is done and no retention duties apply. You can also send notices about illegal content on a lynkpop page to info@aios-media.com.

Where we process data based on legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time for reasons arising from your particular situation. We then stop processing unless we can show compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

This mainly concerns server log files, delivery via Cloudflare, statistics and abuse protection. An informal email to info@aios-media.com is enough.

You have the following rights towards us:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)

Just write to info@aios-media.com. If you booked an appointment, you can also contact the page owner directly.

You can lodge a complaint with a data protection supervisory authority, in particular where you live, where you work or where the alleged violation took place (Art. 77 GDPR). The authority responsible for us is the data protection authority of North Rhine-Westphalia: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (ldi.nrw.de).

Last updated: 4 November 2026. We update this policy when lynkpop or the legal requirements change.