Linkfyn
Privacy Policy
Linkfyn helps small businesses sell through WhatsApp with a mini-site, forms, a leads inbox and analytics. This policy explains what personal data we handle, why, who we share it with and the choices you have. We wrote it in plain language. It follows Malaysia's Personal Data Protection Act 2010 (PDPA).
1. Who we are
Linkfyn is a service run from Malaysia ("Linkfyn", "we", "us"). For anything about your personal data, email hello@linkfyn.co.
2. Whose data, and who decides
Three groups of people use Linkfyn, and our role is different for each.
- Merchants and their team. Business owners and the agents they invite. For your account, we decide how your data is used, so we are the data user (controller) under the PDPA.
- A shop's customers. People who visit a shop at
linkfyn.co/<shop>(or the shop's own domain), fill in its form or tap its WhatsApp button. The shop decides what to ask and what to do with the answers, so the shop is responsible for your data, and Linkfyn handles it on the shop's behalf as its processor. If you want to see, correct or delete what you sent a shop, ask the shop first. We will help them, and you can also write to us. - Visitors to linkfyn.co. People reading our own homepage and these pages.
Your conversation with a shop on WhatsApp happens in WhatsApp, between you and the shop. Linkfyn does not see or store those messages.
3. What we collect
From merchants and their team
- Your email address and password. Passwords are stored only in hashed form by our sign-in provider.
- If you sign in with Google or Facebook, we get your email address, your name and your profile photo from them, and an ID that links your Google or Facebook account to your Linkfyn account. We do not get your password, contacts, posts or friends, and we post nothing on your behalf. How we handle Google user data is set out in Signing in with Google.
- Your business details: name, shop address, WhatsApp and phone number, location, opening hours, and the names, emails and working hours of agents you invite.
- What you put on your page: text, prices, forms, photos and reviews. Photos are resized and their location data is removed when you upload them.
- Settings you choose, such as Meta and TikTok pixel IDs and access tokens (stored write-only: the app never shows a token again), ad tags, a custom domain, and the AI apps you connect.
- Records of what happens in your account, such as publishing, lead stage changes and notes, and the emails we send you.
From a shop's visitors
When you open a shop page, a small script counts the visit so the shop can see which parts of its page work. It sets no cookies and stores nothing on your device. It records:
- pages, sections and buttons viewed or tapped, and time spent on sections;
- whether you are on a phone or a computer, the website you came from (its domain only), and campaign tags in the link, such as
utm_source; - an approximate country and city worked out from your IP address. We do not store the IP address with these records;
- a visitor code made by scrambling your IP address and browser details with a secret. It changes every day and is different for every shop, so it cannot follow you from shop to shop or day to day.
If your browser sends Do Not Track or Global Privacy Control, the script does not run at all.
From a shop's customers
- Appointments. When you book on a shop's booking page: your name and phone number, the service and time you picked, and any note you add. It is kept and used like a form you send, including the agreement to ads.
- Forms. What you type: usually your name, phone number and email, plus your answers, the item you picked, the estimate shown and the fact that sending it agrees to ads. We link the form to your visit, so the shop can see how you found it.
- WhatsApp button. When you tap it, we note that a chat was started, from which button and item, and the campaign tags in the link. We do not get your name or number from a tap; WhatsApp opens on your phone.
- Bot check. Forms use Cloudflare Turnstile to stop spam. It looks at your browser and IP address to decide whether you are a person.
- Ad click IDs. If you arrived from an ad, the link can carry an ID from Meta or TikTok (
fbclid,ttclid). The form keeps it with your enquiry, and we use it only as described in section 5.
From visitors to linkfyn.co
Our homepage has no ads or tracking scripts. Our hosting provider keeps short-lived technical logs (such as IP address and pages requested) to run and protect the service.
4. How we use it
- To run Linkfyn: sign you in, show your shop, save enquiries, send them to the right person on the team and show the shop its leads and analytics.
- To email merchants: sign-in and password emails, an alert for each new lead (with the lead's details), and a summary on busy hours.
- To keep Linkfyn safe: stop spam and abuse, limit how often forms can be sent, and look into shops reported as scams.
- To send ad results to Meta and TikTok, only as described in section 5.
- To improve Linkfyn and to answer you when you contact us.
We do not sell personal data, and we do not use a shop's customer data to advertise Linkfyn or other shops.
Signing in with Google
Merchants and their team can choose "Sign in with Google". This is the only way Linkfyn uses Google user data.
- What we get. Only your basic Google profile, which Google shares when you agree: your email address, your name, your profile photo and your Google account ID. We ask for no other Google permission, so we cannot see your Gmail, Contacts, Drive, Calendar or anything else in your Google account.
- How we use it. To create your Linkfyn account or sign you in to it, to link your Google sign-in to an existing Linkfyn account with the same email, to show who is signed in, in the app and in your shop's Team settings, and to send you the account and lead alert emails described above. Nothing else.
- Who sees it. It is stored with your account by our sign-in and database provider, Supabase (Singapore). We do not sell it, share it with advertisers, use it for ads, or use it to build or train AI models. We do not send it to Meta, TikTok or any other third party.
- Keeping and deleting it. We keep it while your account is open and delete it with your account (see section 9). You can remove Linkfyn's access at any time in your Google Account, under Security, Your connections to third-party apps and services (myaccount.google.com/connections), and you can ask us to delete your account at hello@linkfyn.co.
Linkfyn's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Ads on Facebook, Instagram and TikTok
A shop that runs ads can connect its own Meta or TikTok account. Linkfyn then tells that ad account when someone arrived from one of its ads, when an ad led to an enquiry ("Started") and when the shop marks it as a sale ("Won"), so the ads can find more buyers.
- Arriving from an ad. If you tap the shop's Meta or TikTok ad, the platform adds a click ID to the page's address. Linkfyn then tells only that platform that you opened the page: the click ID, the page address, your IP address and browser details, and the time. Nothing is sent if you didn't come from an ad, or if your browser sends Do Not Track or Global Privacy Control.
- Your details are sent only when you send a form. Above its Send button, every form says that by sending, you agree the shop may use your details to show you ads on Facebook, Instagram and TikTok. A message you start from a chat button sends nothing about you. If you don't agree, don't send the form; message the shop instead.
- What is sent for a form and a sale: your phone number and email address in scrambled (hashed, SHA-256) form, your IP address and browser details, the ad click ID if you came from an ad, the event and when it happened, and for a sale the amount the shop recorded. Your name and answers are not sent.
- It is sent from our servers to the shop's own ad account, and Meta and TikTok then use it under their own policies (Meta, TikTok).
- Linkfyn does not put Meta or TikTok pixels or cookies on shop pages.
To withdraw this consent, tell the shop or email us. We stop sending anything new. Data already sent is held by Meta or TikTok, and you can manage it in your account settings there.
6. Who we share it with
We use these providers to run Linkfyn. Each handles data only to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in: accounts, shops, leads | Singapore |
| Cloudflare | Hosting, shop pages, photo storage and resizing, visit analytics, bot check, email sending, custom domains | Its global network, nearest to the visitor |
| Meta and TikTok | Ad results, only with the customer's consent, to the shop's own ad account | Their own data centres |
| Google and Meta (Facebook) | Sign-in, only for merchants who choose "Continue with Google" or "Continue with Facebook" | Their own data centres |
| AI apps a merchant connects (such as Claude) | Editing and publishing the merchant's page, and setting up how the shop takes appointments (services, opening hours, rooms and people), when the merchant asks. They cannot read leads, customers or appointments. | The AI app's provider |
Within a shop, the owner and the agents they invite can see its leads. An agent can be limited to their own leads. We may also share data when the law requires it, to protect people from harm or fraud, or with a buyer if Linkfyn's business is sold, under this same policy.
7. Data stored outside Malaysia
Our database is in Singapore, and Cloudflare serves pages from data centres around the world. So your data is transferred and stored outside Malaysia. We choose providers with strong security and contracts that protect personal data, so it is protected to a standard comparable to the PDPA.
8. Pages we make for businesses
To show a business what Linkfyn can do, we sometimes build a sample page for it from what the business has already made public, such as its name, photos, menu, prices, address and business phone number. These pages:
- are unlisted: hidden from search engines and not linked from anywhere, though anyone who has the page address can open it, and only the business receives the link to claim it;
- can be claimed by the business, which moves the page into its own account;
- can be removed at any time with the "Take my page down" link on the page, or by emailing us. We then take it offline.
9. How long we keep it
- Visit details (each page view and tap) are kept for about three months. Daily totals without personal data are kept while the shop exists.
- Leads are kept while the shop's account is open, so the shop can follow up and see its history, unless the shop or the customer asks us to delete them.
- Accounts. When a merchant closes their account, we delete their shop, page and leads within 30 days, apart from what we must keep by law or for a dispute. Backups roll over within 7 days.
- Ad delivery records (what was sent to Meta or TikTok and whether it was accepted) are kept with the lead.
10. Your rights
Under the PDPA you can:
- ask for a copy of the personal data we hold about you, and ask us to correct it;
- withdraw consent you gave, such as for ads, and ask us to stop using your data in a way that causes you damage or distress;
- ask us to delete it where we no longer need it;
- complain to the Personal Data Protection Commissioner (pdp.gov.my).
Email hello@linkfyn.co. We reply within 21 days. If your request is about an enquiry you sent a shop, we will pass it to that shop and help it answer.
Giving us data is voluntary, but without an email and password we cannot make an account, and without a way to reach you a shop cannot reply to your enquiry.
11. Security
Data is encrypted on its way to and from Linkfyn. Each shop's data is kept apart by access rules in the database, so one merchant cannot see another's. Ad tokens are write-only, photos lose their location data and forms are protected from bots. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
12. Children, changes and contact
Merchant accounts are for people aged 18 or over. Shops on Linkfyn are not meant for children under 13, and we do not knowingly collect their data.
We will update this policy when Linkfyn changes, and show the new date at the top. If a change matters, we will tell merchants by email before it applies.
Questions or requests: hello@linkfyn.co. If this English version and a Bahasa Malaysia version differ, the English version applies.