Privacy Policy

1. What data we collect

Your account: your email address and password (encrypted; we never see it), or your Google or Apple identity if you sign in with them, and the username you choose. From Google we receive your email, name and profile photo; from Apple, your email or, if you choose to hide it, a relay address Apple creates for you.

Your acceptance of these terms: when you create your account we record which version of the Terms and of this Policy you accepted, the date, how you signed up (email, Google or Apple), your IP address and your browser. It serves only as proof of that acceptance and is deleted with your account.

Your page: everything you put on it — name, bio, links, blocks, images and videos you upload, and your design. Your page is public by nature: that is what it is for.

Your onboarding answers and your identity collection: your sector, your goal and — if you choose one — your cultural collection. This data is private: it is stored in a separate column that is NOT publicly accessible, and it is only used to personalize your experience. We never sell it or display it.

Your page metrics: we count visits and clicks to show them to you in your dashboard. For each visit or click we keep only which page it was, the type of event, the link clicked and the time: not the IP address, the browser, the country or where your visitor came from.

Fans who subscribe on your page: if you turn on fan capture, we store the email (and the name, if given) the fan writes — for you. That data is yours: you can export it, and the fan can ask you to delete it.

Your contact card: on the plan that includes it, the “Save contact” button on your page gives whoever taps it a contact file (vCard) with your name, photo, bio, page link and social links. Your phone numbers and emails are only included if you add them in Settings or in your contact block. The same panel can show a QR code and a button to share your page.

Security: to stop abuse we count how many requests come from the same connection. We do not store the IP address: we store an encrypted fingerprint that changes every day and is deleted within a few days.

2. What we use it for

To operate your account and your page, show you your metrics, charge you if you choose a paid plan, send you the service emails (confirming your account, resetting your password and notices about your account) and give you support. Nothing else. We do not sell personal data to third parties. We do not use your data for advertising.

3. Who it is shared with

Only with the providers that make the service work, each under its own security guarantees:

• Supabase: database, sign-in and storage for your images and videos.
• Vercel: website hosting and its technical logs.
• Stripe: payments. Your card is seen by Stripe, never by us. When you pay, Stripe receives your email and an identifier of your account.
• Google and Apple: only if you choose to sign in with them, to confirm your identity.
• Resend: sends the service emails.
• Google Workspace: receives the emails you write to soporte@voralink.bio.

Your videos: when you upload a video, we convert it to a lightweight format on a machine owned by SALMERON STUDIOS LLC, not on a third-party service. The original is deleted once the conversion succeeds.

If you are an affiliate and choose to be paid through Stripe, we share with Stripe, Inc. your name, email, affiliate code and your page address; Stripe processes your data as an independent controller under its own privacy policy.

4. Third-party content on pages

Each creator can add YouTube or Vimeo videos and music players (Spotify, Apple Music, SoundCloud, Deezer, Tidal, Amazon Music, YouTube Music, Mixcloud, Audiomack and Flow Music) to their page. YouTube videos (in their no-cookie mode) and Vimeo videos load when the page opens; music players load only when the visitor taps to listen. At that moment your browser connects to that service, which receives your IP address and may use its own cookies under its privacy policy. Some audio is served from Google servers. The poster and cover images we show are downloaded by our server, without sending any of your data.

5. Cookies and storage in your browser

We do not use advertising tracking cookies. Our only first-party cookies are:

• Your session cookie (from Supabase): keeps you signed in and is renewed while you use it.
• vl_idioma: the language you choose, for one year.
• vl_periodo: if you arrive with the annual plan selected, it remembers it for 30 days.
• vl_ref: if you arrive through an affiliate's link (section 6).

Your browser also stores the light or dark theme you choose and whether you last signed in with Google or Apple, plus some technical data that is cleared when you close the tab. None of it leaves your browser.

When we run campaigns we may load measurement pixels from Google, Meta or TikTok, which set their own cookies and would also load on creators' pages. They are off today; we will say so here before turning them on.

6. Affiliate program

Affiliate link cookie: if you reach VORALINK through an affiliate's link (voralink.bio/r/code), we store in your browser a first-party cookie named vl_ref with that code for the period set by the program (60 days by default). It is used only to attribute your signup to whoever recommended you and to apply their discount; it holds no personal data and is not used for advertising. You can delete it from your browser.

If you are an affiliate: in addition to your account we store your legal name, your payout method and details (your Stripe account or your PayPal email), the agreement you accept with its date, time, IP address, browser, language and accepted text, your tax form (W-9 or W-8BEN) if you send it to us, and the history of clicks, referrals, commissions and payments. We use them to calculate and pay your commissions, issue the tax forms the IRS requires and comply with the law. If you choose to be paid through Stripe, Stripe collects your identity, tax and bank details directly on its own page and processes them as an independent controller; we only receive the status of your payout account. Affiliates see only aggregate figures about their referrals (clicks, accounts, payments) and the amount and date of each payment that earns them a commission, never names or emails.

Retention: agreement data, payments and tax forms are kept for as long as US tax law requires (generally seven years), even if you close your affiliate account or your VORALINK account.

7. How long we keep your data

• Your account, your page, your fans and your acceptance of these terms: for as long as you have the account.
• Your page history: we keep the last 30 versions of its settings (including the private part) so you can go back, for as long as the page exists.
• Metrics: each visit or click is kept for 90 days; after that only hourly and daily totals remain, for as long as your page exists.
• Invitations: if we invite you to try a plan, we keep your email with the invitation.
• The security fingerprint from section 1: a few days.
• Affiliate data: as described in section 6.

8. Your rights and deleting your account

You can edit your page whenever you want and request the deletion of your account and all its data by writing to soporte@voralink.bio. You can also delete your account yourself at any time from Settings → “Delete account”: your page, links, fans, stats, history and notices are deleted and your subscription, if any, is cancelled. Some copies of files you uploaded (for example, videos) may remain in storage after deletion; if you write to us, we delete them.

After deletion, Stripe keeps your customer record, the invoices and the billing details of your payments. We keep your username reserved for 30 days so nobody can reuse it right away, and a record that the account was deleted with your username, whether you had a paid plan and the date.

If you are an affiliate with commissions or payments, deletion from Settings is not available: write to us, we close your affiliate account, pay what is owed and keep only what section 6 describes. We respond within 30 days at most. If you are in a jurisdiction with additional rights (GDPR, CCPA), we honor them.

9. Children

VORALINK is not directed at children under 13, and you must be at least 13 to create an account. If you believe a child created an account, let us know and we will delete it.

10. Changes

If this policy changes in a substantial way, we will announce it on this page and, if you have an account, by email.