qlk.to
Privacy policy
This policy explains how we use information, how long we keep it and how you can ask us to close your account. Effective 22 October 2026.
Who is responsible
Qlk.to Ltd. is responsible for the account, support and service information described here. Contact our Privacy Compliance Officer using the email below or write to Qlk.to Ltd., 20–22 Wenlock Road, London, England, N1 7GU. A customer running a campaign or a destination website may separately be responsible for its own processing.
Accounts and support
Account information includes your email address, declared country, eligibility review, accepted terms and confirmations, account settings and security records needed for registration, verification, login and password recovery. Campaign names, placement settings and destination URLs are stored to provide the link service. Information supplied in a support enquiry is used to understand and respond to it.
Link reporting
Campaign reports use recorded link openings, when they happened, the link and campaign involved, and the device type. Click totals do not identify individual people. Separate links for email, SMS, social or print let you distinguish those placements in your reports. Access and security records are kept separately from campaign reports.
Application hosting
Our application servers are hosted in Amsterdam, Netherlands, within the European Union. The service providers described below may process information in other countries; the application-server location does not describe every provider's processing location.
Cookies and browser storage
We use essential browser storage to keep sign-in and security features working, and to save your privacy choices. With your permission, website analytics records the first page you visit in a tab after allowing analytics, limited campaign labels, and actions such as opening the demo or starting signup. The same action is counted once. These detailed website activity records are removed after 30 days during regular cleanup. Account signup and billing records are kept separately. If an advertising service is connected, advertising analytics also needs your permission. Advertising click identifiers are handled in the browser tab after permission and are not included in our internal website statistics. You can withdraw optional permission using Privacy preferences in the footer and use the public demo without allowing analytics.
Why we use information
We use account, campaign and subscription information to provide the service you request and fulfil our agreement with you. We use necessary technical and security information to protect the service, prevent abuse and resolve faults, relying on our legitimate interests where applicable. We retain or disclose records where required by law. Optional marketing and advertising measurement rely on your permission, which you can withdraw.
Payments and service providers
Stripe handles hosted payment pages and payment-card information. qlk.to uses subscription and invoice references, status, amount and currency for billing and account access; our checkout does not collect full payment-card details. SendGrid delivers verification, recovery and service emails. Cloudflare provides network protection and Turnstile verification against automated abuse. These providers receive the information needed for their functions and may process it outside your country under their applicable terms and safeguards. Credentials and payment-card details must not be sent in a support email.
Security and disclosures
We use access controls and protected connections to safeguard service information. No system can guarantee absolute security. Information may be disclosed to service providers for the purposes above, where legally required, or to protect people and the service against fraud or abuse. A link can take you to an independently operated website whose privacy practices you should review.
Current reporting retention
Detailed campaign activity expires under the plan rules that applied when it was recorded. The current standard periods are 7 days for Free, 30 days for Starter, 90 days for Pro and 365 days for Business. Daily summaries use the recorded day and its plan rules: 7 days for Free, 30 days for Starter, 12 months for Pro and 24 months for Business. Earlier or individually assigned plans keep their rules. Your current plan also determines which past reports you can view. Expired records stop appearing in reports; removal from storage happens separately. Upgrading cannot recover expired data or activity that was never recorded. Detailed optional website analytics expires after 30 days; records of how an account found us, privacy choices, signup and payments are kept separately.
Account retention and closure
We keep ordinary account, campaign and destination information while supplying the service, and remove or anonymise it within 30 days of a verified closure request, subject to specific legal or security exceptions. Unverified registrations are removed after 30 days. Expired Free accounts with no authenticated activity during the 90 days after sample expiry are scheduled to close with at least 30 days of advance notice; activity or payment cancels that pending closure. Former paid accounts receive 30 days of notice after 12 months of authenticated inactivity following the end of paid access. Cancelling payment or reaching the Free deadline does not currently erase an account. You can close your account from My account after confirming your password, or request help at contact@qlk.to. Closure stops renewals and link serving before erasure.
Support, security and accounting retention
We keep routine access and error logs for 30 days, security and staff audit records for 12 months from the action or case closure, and support correspondence for 24 months after resolution. Necessary accounting evidence, including invoices, payments and refunds, is kept for six years after the relevant financial year, or longer where an applicable obligation or unresolved matter requires it. Our financial year ends on 30 September. Longer billing retention does not justify keeping passwords, destination URLs or unrelated campaign history. Necessary incident and legal holds are documented and reviewed at least every 90 days.
Service and security records
Evidence used to investigate missing or delayed reporting is kept for 90 days after resolution. Activity-processing identifiers are kept for a maximum replay window of 90 days from the event; older activity cannot recreate reporting or consume an allowance. Minimal monthly usage totals can remain for up to 24 months to explain retained reports. Verification and password-reset links expire separately. After account erasure, we retain an old-link reservation without its destination or account association so that another customer cannot reuse that link. A keyed email fingerprint, original Free signup date and consumed allowance are kept for 12 months solely to prevent immediate recycling of the Free sample; the record contains no email address, password or campaign information. These limited safety records are not described as anonymous information.
Backup retention
The maximum rolling backup window for ordinary service data is 35 days. Deleted service data may remain in restricted backups until that window ends; it is not used for ordinary service or marketing, and information previously deleted is removed again before restored data is used. Longer accounting archives contain only the records requiring longer retention. Backup expiry and restoration controls are operated separately from the live application.
Your rights and complaints
Contact us to request access, correction, deletion or restriction of your personal information, or to raise an objection or request portability where applicable. We may need to check your identity and retain information that applicable law requires. Withdrawing optional consent does not affect earlier processing or essential service records. You may also complain to your relevant data protection authority; where UK law applies, this is the Information Commissioner’s Office.
Policy changes
We will publish updates on this page. Where a change materially affects how your account information is used, we will provide an appropriate notice and seek fresh permission when required.
Contact qlk.to
Email us for service, privacy or abuse enquiries. Include the relevant account or link, but never passwords, authenticator codes or payment-card details.
Email contact@qlk.to