1. Who is responsible
Dot Square, established in the Netherlands and registered with the Dutch Chamber of Commerce (KvK) under number 51738856, operates Luximio and is responsible for the controller processing described in this notice.
- VAT ID
- NL002182044B06
- Business address
- Kon. Wilhelminaplein 248
1062 KS Amsterdam
The Netherlands - Telephone
- +31 6 39860349
- Legal and privacy email
- legal [at] luximio.com
For questions about this notice or to exercise a right, email the address above and mention “Privacy request”. Replace [at] with @ and remove the spaces when entering the address in your email app. You can also contact us by telephone or post using the details above.
For account administration, enquiries and our own service security, the operator acts as a controller: it decides why and how personal data is used. The separate role for customer-managed link data is explained below.
2. Whose data this covers
This notice covers visitors to our marketing website, people who contact us or request beta access, workspace owners and members, and information used to protect the Luximio service.
When a customer uses Luximio to manage links or receive analytics for its app or website, the customer normally determines the purposes of that processing. Luximio processes that customer data on its instructions as a processor. The customer must provide its own privacy notice, and an appropriate data processing agreement must govern our processing for that customer.
If your request concerns an app or link operated by a customer, contact that app or website’s operator first. We can help route a request received by mistake, and assist the responsible customer. We remain responsible for answering requests about processing for which we are the controller.
Links can take you to an app, app store or third-party website. Those destinations have their own privacy practices. Luximio does not control what they collect after you leave our service.
3. Data we use and why
Messages and beta requests
Data: your name, reply email, selected topic, message and subsequent correspondence. Please do not include passwords, API keys or sensitive personal information.
Purpose and legal basis: answering questions, reviewing beta requests and providing support. We rely on steps taken at your request before a contract or performance of a contract when you are the contracting individual (GDPR Article 6(1)(b)). For general enquiries or business contacts acting for an organisation, our legitimate interest is to respond and manage that business relationship (Article 6(1)(f)). Submitting the form does not subscribe you to marketing.
Accounts and workspace administration
Data: email, display name, verification status, workspace membership and role, invitations, app/domain configuration, and records of administrative changes. Account/session records can include an IP address and browser user-agent information.
Purpose and legal basis: signing you in, providing requested features, managing permissions and maintaining an accountable service. Contract performance applies for an individual customer; legitimate interests in administering the customer relationship and protecting workspaces apply for an organisation’s representatives.
Service delivery and protection
Data: IP address, request URL, request time, response/error information, browser/device information, and security signals. A URL may itself contain personal information, so avoid placing personal details or secrets in link paths and destinations.
Purpose and legal basis: delivering pages and links, limiting spam and abusive traffic, investigating faults and protecting accounts. We rely on our legitimate interests in keeping the service available and secure, subject to balancing those interests against your rights. Contact messages and inbox addresses are not included in the contact handler’s application error logs.
Customer link events and app verification
Data: link and project identifiers, hostname/path, event identifier and time, broad platform category, country code when available, referrer origin for browser redirects, and reported app-open/attestation status. The detailed link-events table does not store raw IP addresses or raw user-agent strings; this does not mean that hosting providers never process them.
App verification can also involve an installation identifier, an attestation key identifier/public key, challenges and verification results. Installation-linked records are not automatically anonymous. Customers must provide an appropriate notice and legal basis for their use of app analytics and verification. We process these records on customer instructions and use necessary security information to protect the service.
Billing and legal records
For Starter orders sold through Link, Sold through Link, LLC, a Stripe affiliate, acts as merchant of record for the payment sale. The applicable provider entity and buyer terms are identified in Checkout. Stripe/Link handles the payment, transaction receipts/invoices, applicable transaction tax in its covered markets, fraud/disputes and transaction support. Dot Square supplies Luximio and receives the identifiers, plan, accounting and payment amounts/currencies, subscription status and minimal payment/refund/dispute information needed to administer service and requests. We do not receive full payment-card details. Stripe/Link also processes personal data for its own merchant, financial, fraud and legal purposes under its privacy notices.
We use necessary service and order data to perform the customer agreement (Article 6(1)(b)). Applicable business-record duties use Article 6(1)(c); records needed for a specific claim use our legitimate interest in establishing, exercising or defending that claim (Article 6(1)(f)). Optional marketing remains separate. We also retain separately labelled sandbox test records, which may contain personal data; test payments and refunds move no real money. Those records support our legitimate interest in testing reliable billing and follow the sandbox retention rules below. A test acceptance is not backdated into a live agreement.
When you use agreement, confirmation and withdrawal features, we record the account and workspace, personal/business classification, exact terms version and text, acceptance time, immediate-service request, purchase references and amounts, withdrawal statement and submission time, refund-verification status, and confirmation-message content and delivery state. These records let us administer your request, provide evidence of the agreement and respond to disputes. Sandbox acceptance is labelled as a preview and is not backdated into a later launch agreement. Confirmation messages are delivered through Cloudflare; accepting terms is not consent to optional marketing.
Where we must keep business records or respond to a legally binding request, the legal basis is the applicable legal obligation (Article 6(1)(c)). Where records are needed for a specific dispute, our legitimate interest is establishing, exercising or defending legal claims. We do not use these exceptions to keep unrelated data indefinitely.
Providing a reply email and the information needed to understand an enquiry is necessary for us to answer it. An email address is required to create and sign in to a customer account. You can browse the marketing content without submitting a form. We do not require optional marketing consent as a condition of support or beta access.
4. Where the information comes from
We receive information directly from you when you complete a form, sign in or use the dashboard. A workspace owner or administrator may provide your email when inviting you, and your name or role as part of workspace administration.
Technical information comes from your browser or app requests and from our hosting/security services. Customer apps may submit link events and verification information. Apple or Google can return verification results when the relevant app integration uses their attestation services.
For workspace invitations, we use the email address supplied by the person inviting you to deliver the invitation and manage access. Our legal basis is our legitimate interest in administering workspace invitations. You can object to this use and contact us about your data without accepting the invitation or creating an account.
Where we obtain your personal data indirectly and act as controller, the GDPR requires us to provide the relevant privacy information within one month, at our first communication with you if sooner, or before a first disclosure if sooner, unless a lawful exception applies. Our current sign-in, workspace-creation and invitation flows provide privacy information. Contact us if you need it in another accessible form.
7. International transfers
Our suppliers operate international networks, and data may be processed outside the European Economic Area, including in the United States. The current dashboard database is configured with Cloudflare’s EU jurisdiction restriction for database storage and execution. This restriction does not cover every part of Luximio, including worldwide network access, link resolution, email and provider operations. We do not promise EU-only processing across the service.
A transfer requires an applicable GDPR safeguard: for example, an adequacy decision covering the actual recipient and processing, or the European Commission’s Standard Contractual Clauses with an assessment of the destination and supplementary measures where needed. A supplier’s general privacy statement alone is not evidence that a particular transfer is covered.
The Cloudflare data processing addendum describes safeguards for the current hosting services. The separate OpenAI Sites data processing addendum concerns the earlier Sites hosting and remaining private previews. Cloudflare, Inc. is a US supplier; its terms provide applicable adequacy mechanisms and international-transfer clauses where required. One.com Group AB is based in Sweden and states that EU customer hosting is in Denmark; its DPA also addresses applicable onward transfers. The Dutch Stripe account's financial and processor terms identify Stripe Payments Europe, Limited and applicable financial-services parties. Managed Payments adds Sold through Link, LLC, a Stripe affiliate, as merchant of record. Stripe/Link has international operations governed by the applicable privacy and transfer terms; the recipient's entity, role and safeguards depend on the activity. The provider schedule gives further details. A mechanism applies only where the recipient, operation and its conditions are covered.
You can ask us for information about the safeguards applying to your data and a copy of relevant safeguards, subject to necessary redaction of unrelated confidential information.
8. How long information is kept
Retention depends on the purpose and record type. We distinguish an access token becoming invalid from the underlying record being deleted.
| Information | Current position |
|---|---|
| Detailed link events | The resolver’s daily cleanup removes events older than 90 days. An event may remain until the next successful cleanup. This period does not automatically apply to account records or hosting logs. |
| Sign-in credentials | Sign-in codes expire after five minutes; customer sessions are configured for 30 days with renewal through use. Daily cleanup is configured to remove session and verification records more than 24 hours after expiry. Removal normally occurs 24–48 hours after expiry; batch limits, outages or failed runs can delay it. Valid sessions remain usable. |
| Authentication rate-limit records | Temporary records used to limit sign-in attempts become eligible for daily cleanup after more than 24 hours without a request. The same scheduling and backlog limits apply. This does not remove account or security audit history. |
| Team invitations | Unaccepted invitation links expire after seven days. Daily cleanup is configured to delete invitation records more than 30 days after acceptance or revocation, or after expiry if neither occurred. Removal normally occurs within 30–31 days of that event; batch limits, outages or failed runs can delay it. Inconsistent records are held for review. Deleting an accepted invitation makes its original link unavailable but preserves workspace membership, role and normal dashboard access. This cleanup does not erase team activity history or copies of delivered emails; those records have separate retention and rights-request handling. |
| App-verification challenges | Expired challenge rows become eligible for cleanup one hour after expiry. Installation/key registrations are retained as needed for the configured verification service and assessed for removal when that integration ends, the workspace closes or a valid request is received. They are not covered by the 90-day event cleanup. |
| Contact and support correspondence | Ordinary enquiries are scheduled for deletion six months after resolution and removed at the next monthly retention review. Relevant correspondence may be kept longer for an active dispute or a legal obligation, with the reason recorded. One.com documents daily Basic Mail backups covering the previous 14 days, including before its optional restore add-on is activated. Deleting a message from the mailbox does not immediately erase backup copies. Handling of exceptional or separately saved copies still needs confirmation. |
| Accounts, workspace records and audit history | Needed while the account/service or relevant customer instruction continues. On a verified closure/deletion instruction, we aim to complete active-system handling within 30 calendar days, subject to earlier legal or agreed deadlines. We assess shared resources, necessary security/activity evidence and specific lawful exceptions separately and remove or redact unnecessary personal references. The process is support-assisted; cancelling a plan does not automatically erase an account. |
| Hosting and security records | Cloudflare documents seven-day retention for Workers Logs on our Paid plan. Sent-message content previews were disabled on 23 September 2026; delivery records are separate, and expiry of earlier preview copies has not been verified. These facts do not establish a single retention period for all security or email records. |
| Database recovery and previous hosting | Cloudflare’s Paid D1 service provides a rolling 30-day recovery history. Deleted database records can therefore remain in that history, and restoring an older version requires reapplying relevant deletions. This is not a guarantee that all provider copies disappear within 30 days. The former OpenAI Sites dashboard and database were deleted on 25 September 2026; the expiry of historical provider backups and logs remains unverified. |
| Agreement and withdrawal evidence | We keep the minimum evidence necessary to administer the agreement and address a claim, reviewing its necessity annually. Evidence outside the tax/accounting set is removed no later than five years after the relevant agreement or matter ends, unless a specific legal duty or claim justifies longer retention with a recorded review date. This is a manual rule, not a statement that every legal claim expires after five years. |
| Sandbox billing records | Identifiable test customer, subscription, webhook and preview-agreement records are scheduled for removal 90 days after the relevant test ends and checked during the monthly manual review. Local and Stripe copies are assessed separately. An unfinished test is not silently treated as finished, and test activity is not automatically a statutory tax record. |
| Privacy-request exports and case records | Temporary exports are removed seven days after confirmed delivery, sooner on request where possible. Undelivered copies are reviewed promptly. We keep only necessary case/incident accountability evidence, with a stated purpose and review date; we review necessity annually and do not retain the full export as the case record. |
| Legal and financial records | Dutch basic business/tax records are generally retained for seven years; records subject to a specific ten-year rule are retained for that period where applicable. This does not mean that every contact message or account record is kept for seven years. Relevant evidence for an active dispute is retained only as needed for that claim and its applicable limitation period. |
Customer-controlled personal data must be returned or deleted under the agreed processing instructions and data processing agreement. Archiving a link, cancelling a subscription or removing a workspace member does not by itself erase every related record.
9. Your privacy rights
Depending on the processing and the conditions in the GDPR, you can:
- ask whether we process your data and obtain access and a copy;
- ask us to correct inaccurate data or complete incomplete data;
- ask for erasure, or for use of your data to be restricted;
- receive data you provided in a structured, commonly used, machine-readable form and, where feasible, have it sent to another controller, when portability applies;
- object to processing based on legitimate interests for reasons relating to your situation; we must stop unless the applicable legal grounds allow it to continue;
- object to direct marketing at any time, if such processing is introduced;
- withdraw consent at any time where consent is the legal basis, without affecting processing that was lawful before withdrawal.
Email legal [at] luximio.com and mention “Privacy request”; replace [at] with @ and remove the spaces. You do not need to create an account or pay to make an ordinary request. We may ask for proportionate information needed to verify your identity; please do not send an identity document unless it is necessary and we have agreed a suitable method.
We aim to acknowledge ordinary requests within two business days and respond without undue delay, normally within one calendar month of receipt. The 30-day active-system target does not extend an earlier rights-request deadline. Where the GDPR permits an extension for complexity or the number of requests, we explain it within the first month; the extension may be up to two further months. If we cannot comply, we explain why and how you can challenge the decision. Any lawful exception or fee is assessed under the GDPR, not applied automatically.
You may complain to a supervisory authority, in particular in the EU/EEA country where you live, work or believe an infringement occurred. For the Netherlands, contact the Autoriteit Persoonsgegevens. You may complain without contacting us first, and your right to seek a judicial remedy remains available.
10. Security and automated decisions
Current safeguards include HTTPS, access controls for the dashboard, workspace permissions, server-side validation and limits on contact submissions. Secrets are kept outside public website files. Security measures reduce risk; they do not guarantee that every incident can be prevented.
Beta admission is reviewed by a person. Automated controls can reject an invalid sign-in attempt, limit a submission or enforce a plan limit. We do not use the current service to make solely automated decisions producing legal or similarly significant effects about you. If a website security control prevents you from using the contact form, you can email our legal and privacy address directly.
The service is intended for developers and organisations and is not directed at children. Customers remain responsible for the audience of their apps and for any additional requirements when processing children’s data.
11. Changes and contact
We will update this notice when our processing changes and show the revision date. Where required, we will bring a material change to your attention before it applies. A privacy notice is information about processing; it is not a blanket request for consent.
For a question or request, use the legal and privacy email above. Please include enough context to help us identify the account or processing concerned.